Skip to content

Commit bdc4330

Browse files
KelvinTegelaarKelvinTegelaar
committed
Tests
1 parent 1ef2c30 commit bdc4330

File tree

6 files changed

+271
-0
lines changed

6 files changed

+271
-0
lines changed

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24541.ps1‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
function Invoke-CippTestZTNA24541 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24541'
5+
6+
try {
7+
$IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntunePolicies'
8+
9+
if (-not $IntunePolicies) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Intune policies not found in database' -Risk 'High' -Name 'Compliance policies protect Windows devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
11+
return
12+
}
13+
14+
$WindowsPolicies = @($IntunePolicies | Where-Object {
15+
$_.'@odata.type' -in @('#microsoft.graph.windows10CompliancePolicy', '#microsoft.graph.windows11CompliancePolicy')
16+
})
17+
18+
$AssignedPolicies = @($WindowsPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
19+
$Passed = $AssignedPolicies.Count -gt 0
20+
21+
if ($Passed) {
22+
$ResultMarkdown = "✅ At least one Windows compliance policy exists and is assigned.`n`n"
23+
} else {
24+
$ResultMarkdown = "❌ No Windows compliance policy exists or none are assigned.`n`n"
25+
}
26+
27+
$ResultMarkdown += "## Windows Compliance Policies`n`n"
28+
$ResultMarkdown += "| Policy Name | Assigned |`n"
29+
$ResultMarkdown += "| :---------- | :------- |`n"
30+
31+
foreach ($policy in $WindowsPolicies) {
32+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
33+
$ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
34+
}
35+
36+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
37+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Compliance policies protect Windows devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
38+
39+
} catch {
40+
$ErrorMessage = Get-CippException -Exception $_
41+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
42+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Compliance policies protect Windows devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
43+
}
44+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24542.ps1‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
function Invoke-CippTestZTNA24542 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24542'
5+
6+
try {
7+
$IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntunePolicies'
8+
9+
if (-not $IntunePolicies) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Intune policies not found in database' -Risk 'High' -Name 'Compliance policies protect macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
11+
return
12+
}
13+
14+
$MacOSPolicies = @($IntunePolicies | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.macOSCompliancePolicy' })
15+
$AssignedPolicies = @($MacOSPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
16+
$Passed = $AssignedPolicies.Count -gt 0
17+
18+
if ($Passed) {
19+
$ResultMarkdown = "✅ At least one macOS compliance policy exists and is assigned.`n`n"
20+
} else {
21+
$ResultMarkdown = "❌ No macOS compliance policy exists or none are assigned.`n`n"
22+
}
23+
24+
$ResultMarkdown += "## macOS Compliance Policies`n`n"
25+
$ResultMarkdown += "| Policy Name | Assigned |`n"
26+
$ResultMarkdown += "| :---------- | :------- |`n"
27+
28+
foreach ($policy in $MacOSPolicies) {
29+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
30+
$ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
31+
}
32+
33+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
34+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Compliance policies protect macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
35+
36+
} catch {
37+
$ErrorMessage = Get-CippException -Exception $_
38+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
39+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Compliance policies protect macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
40+
}
41+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24543.ps1‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
function Invoke-CippTestZTNA24543 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24543'
5+
6+
try {
7+
$IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntunePolicies'
8+
9+
if (-not $IntunePolicies) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Intune policies not found in database' -Risk 'High' -Name 'Compliance policies protect iOS/iPadOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
11+
return
12+
}
13+
14+
$iOSPolicies = @($IntunePolicies | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.iosCompliancePolicy' })
15+
$AssignedPolicies = @($iOSPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
16+
$Passed = $AssignedPolicies.Count -gt 0
17+
18+
if ($Passed) {
19+
$ResultMarkdown = "✅ At least one iOS/iPadOS compliance policy exists and is assigned.`n`n"
20+
} else {
21+
$ResultMarkdown = "❌ No iOS/iPadOS compliance policy exists or none are assigned.`n`n"
22+
}
23+
24+
$ResultMarkdown += "## iOS/iPadOS Compliance Policies`n`n"
25+
$ResultMarkdown += "| Policy Name | Assigned |`n"
26+
$ResultMarkdown += "| :---------- | :------- |`n"
27+
28+
foreach ($policy in $iOSPolicies) {
29+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
30+
$ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
31+
}
32+
33+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
34+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Compliance policies protect iOS/iPadOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
35+
36+
} catch {
37+
$ErrorMessage = Get-CippException -Exception $_
38+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
39+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Compliance policies protect iOS/iPadOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
40+
}
41+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24569.ps1‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
function Invoke-CippTestZTNA24569 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24569'
5+
6+
try {
7+
$DeviceConfigs = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceConfigurations'
8+
9+
if (-not $DeviceConfigs) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Device configurations not found in database' -Risk 'High' -Name 'FileVault encryption protects data on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
11+
return
12+
}
13+
14+
$MacOSEndpointProtectionPolicies = @($DeviceConfigs | Where-Object {
15+
$_.'@odata.type' -eq '#microsoft.graph.macOSEndpointProtectionConfiguration'
16+
})
17+
18+
$FileVaultEnabledPolicies = @($MacOSEndpointProtectionPolicies | Where-Object { $_.fileVaultEnabled -eq $true })
19+
$AssignedFileVaultPolicies = @($FileVaultEnabledPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
20+
$Passed = $AssignedFileVaultPolicies.Count -gt 0
21+
22+
if ($Passed) {
23+
$ResultMarkdown = "✅ macOS FileVault encryption policies are configured and assigned in Intune.`n`n"
24+
} else {
25+
$ResultMarkdown = "❌ No relevant macOS FileVault encryption policies are configured or assigned.`n`n"
26+
}
27+
28+
if ($FileVaultEnabledPolicies.Count -gt 0) {
29+
$ResultMarkdown += "## macOS FileVault Policies`n`n"
30+
$ResultMarkdown += "| Policy Name | FileVault Enabled | Assigned |`n"
31+
$ResultMarkdown += "| :---------- | :---------------- | :------- |`n"
32+
33+
foreach ($policy in $FileVaultEnabledPolicies) {
34+
$fileVault = if ($policy.fileVaultEnabled -eq $true) { '✅ Yes' } else { '❌ No' }
35+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
36+
$ResultMarkdown += "| $($policy.displayName) | $fileVault | $assigned |`n"
37+
}
38+
} else {
39+
$ResultMarkdown += "No macOS Endpoint Protection policies with FileVault settings found.`n"
40+
}
41+
42+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
43+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'FileVault encryption protects data on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
44+
45+
} catch {
46+
$ErrorMessage = Get-CippException -Exception $_
47+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
48+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'FileVault encryption protects data on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
49+
}
50+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24572.ps1‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
function Invoke-CippTestZTNA24572 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24572'
5+
6+
try {
7+
$EnrollmentConfigs = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceEnrollmentConfigurations'
8+
9+
if (-not $EnrollmentConfigs) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Device enrollment configurations not found in database' -Risk 'Medium' -Name 'Device enrollment notifications are enforced to ensure user awareness and secure onboarding' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
11+
return
12+
}
13+
14+
$EnrollmentNotifications = @($EnrollmentConfigs | Where-Object {
15+
$_.'@odata.type' -eq '#microsoft.graph.windowsEnrollmentStatusScreenSettings' -or
16+
$_.'deviceEnrollmentConfigurationType' -eq 'EnrollmentNotificationsConfiguration'
17+
})
18+
19+
$AssignedNotifications = @($EnrollmentNotifications | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
20+
$Passed = $AssignedNotifications.Count -gt 0
21+
22+
if ($Passed) {
23+
$ResultMarkdown = "✅ At least one device enrollment notification is configured and assigned.`n`n"
24+
} else {
25+
$ResultMarkdown = "❌ No device enrollment notification is configured or assigned in Intune.`n`n"
26+
}
27+
28+
if ($EnrollmentNotifications.Count -gt 0) {
29+
$ResultMarkdown += "## Device Enrollment Notifications`n`n"
30+
$ResultMarkdown += "| Policy Name | Assigned |`n"
31+
$ResultMarkdown += "| :---------- | :------- |`n"
32+
33+
foreach ($policy in $EnrollmentNotifications) {
34+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
35+
$ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
36+
}
37+
}
38+
39+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
40+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Device enrollment notifications are enforced to ensure user awareness and secure onboarding' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
41+
42+
} catch {
43+
$ErrorMessage = Get-CippException -Exception $_
44+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
45+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Device enrollment notifications are enforced to ensure user awareness and secure onboarding' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
46+
}
47+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA24576.ps1‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
function Invoke-CippTestZTNA24576 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA24576'
5+
6+
try {
7+
$DeviceConfigs = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceConfigurations'
8+
9+
if (-not $DeviceConfigs) {
10+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Investigate' -ResultMarkdown 'Device configurations not found in database' -Risk 'Low' -Name 'Endpoint Analytics is enabled to help identify risks on Windows devices' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
11+
return
12+
}
13+
14+
$WindowsHealthMonitoringPolicies = @($DeviceConfigs | Where-Object {
15+
$_.'@odata.type' -eq '#microsoft.graph.windowsHealthMonitoringConfiguration'
16+
})
17+
18+
$AssignedPolicies = @($WindowsHealthMonitoringPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
19+
$Passed = $AssignedPolicies.Count -gt 0
20+
21+
if ($Passed) {
22+
$ResultMarkdown = "✅ An Endpoint analytics policy is created and assigned.`n`n"
23+
} else {
24+
$ResultMarkdown = "❌ Endpoint analytics policy is not created or not assigned.`n`n"
25+
}
26+
27+
if ($WindowsHealthMonitoringPolicies.Count -gt 0) {
28+
$ResultMarkdown += "## Endpoint Analytics Policies`n`n"
29+
$ResultMarkdown += "| Policy Name | Assigned |`n"
30+
$ResultMarkdown += "| :---------- | :------- |`n"
31+
32+
foreach ($policy in $WindowsHealthMonitoringPolicies) {
33+
$assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
34+
$ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
35+
}
36+
} else {
37+
$ResultMarkdown += "No Endpoint Analytics policies found in this tenant.`n"
38+
}
39+
40+
$Status = if ($Passed) { 'Passed' } else { 'Failed' }
41+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'Low' -Name 'Endpoint Analytics is enabled to help identify risks on Windows devices' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
42+
43+
} catch {
44+
$ErrorMessage = Get-CippException -Exception $_
45+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
46+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Endpoint Analytics is enabled to help identify risks on Windows devices' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
47+
}
48+
}

0 commit comments

Comments
 (0)