Skip to content

Commit e8e1465

Browse files
KelvinTegelaarKelvinTegelaar
committed
extra test
1 parent 20158d3 commit e8e1465

File tree

5 files changed

+221
-0
lines changed

5 files changed

+221
-0
lines changed

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,10 @@ function Push-CIPPDBCacheData {
142142
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskDetections collection failed: $($_.Exception.Message)" -sev Error
143143
}
144144

145+
try { Set-CIPPDBCacheDeviceRegistrationPolicy -TenantFilter $TenantFilter } catch {
146+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "DeviceRegistrationPolicy collection failed: $($_.Exception.Message)" -sev Error
147+
}
148+
145149
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Completed database cache collection for tenant' -sev Info
146150

147151
} catch {

‎Modules/CIPPCore/Public/Set-CIPPDBCacheDeviceRegistrationPolicy.ps1‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
function Set-CIPPDBCacheDeviceRegistrationPolicy {
2+
<#
3+
.SYNOPSIS
4+
Caches device registration policy for a tenant
5+
6+
.PARAMETER TenantFilter
7+
The tenant to cache device registration policy for
8+
#>
9+
[CmdletBinding()]
10+
param(
11+
[Parameter(Mandatory = $true)]
12+
[string]$TenantFilter
13+
)
14+
15+
try {
16+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching device registration policy' -sev Info
17+
18+
$DeviceRegistrationPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/deviceRegistrationPolicy' -tenantid $TenantFilter
19+
20+
if ($DeviceRegistrationPolicy) {
21+
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'DeviceRegistrationPolicy' -Data @($DeviceRegistrationPolicy)
22+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached device registration policy successfully' -sev Info
23+
}
24+
25+
} catch {
26+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
27+
-message "Failed to cache device registration policy: $($_.Exception.Message)" `
28+
-sev Warning `
29+
-LogData (Get-CippException -Exception $_)
30+
}
31+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21866.ps1‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
function Invoke-CippTestZTNA21866 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA21866'
5+
6+
try {
7+
# Get directory recommendations from cache
8+
$Recommendations = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DirectoryRecommendations'
9+
10+
if (-not $Recommendations) {
11+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'Directory recommendations not found in cache' -Risk 'Medium' -Name 'All Microsoft Entra recommendations are addressed' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Monitoring'
12+
return
13+
}
14+
15+
# Filter for unaddressed recommendations (active or postponed status)
16+
$UnaddressedRecommendations = $Recommendations | Where-Object { $_.status -in @('active', 'postponed') }
17+
18+
$Passed = if ($UnaddressedRecommendations.Count -eq 0) { 'Passed' } else { 'Failed' }
19+
20+
if ($Passed -eq 'Passed') {
21+
$ResultMarkdown = '✅ All Entra Recommendations are addressed.'
22+
} else {
23+
$ResultMarkdown = "❌ Found $($UnaddressedRecommendations.Count) unaddressed Entra recommendations.`n`n"
24+
$ResultMarkdown += "## Unaddressed Entra recommendations`n`n"
25+
$ResultMarkdown += "| Display Name | Status | Insights | Priority |`n"
26+
$ResultMarkdown += "| :--- | :--- | :--- | :--- |`n"
27+
28+
foreach ($Item in $UnaddressedRecommendations) {
29+
$DisplayName = $Item.displayName
30+
$Status = $Item.status
31+
$Insights = $Item.insights
32+
$Priority = $Item.priority
33+
$ResultMarkdown += "| $DisplayName | $Status | $Insights | $Priority |`n"
34+
}
35+
}
36+
37+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'All Microsoft Entra recommendations are addressed' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
38+
39+
} catch {
40+
$ErrorMessage = Get-CippException -Exception $_
41+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
42+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'All Microsoft Entra recommendations are addressed' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
43+
}
44+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21872.ps1‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
function Invoke-CippTestZTNA21872 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA21872'
5+
6+
try {
7+
# Get conditional access policies and device registration policy from cache
8+
$CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
9+
$DeviceRegistrationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DeviceRegistrationPolicy'
10+
11+
if (-not $CAPolicies) {
12+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'Conditional Access policies not found in cache' -Risk 'High' -Name 'Require multifactor authentication for device join and device registration using user action' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
13+
return
14+
}
15+
16+
if (-not $DeviceRegistrationPolicy) {
17+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'Device registration policy not found in cache' -Risk 'High' -Name 'Require multifactor authentication for device join and device registration using user action' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
18+
return
19+
}
20+
21+
$MfaRequiredInDeviceSettings = $DeviceRegistrationPolicy.multiFactorAuthConfiguration -eq 'required'
22+
23+
# Filter for enabled device registration CA policies
24+
$DeviceRegistrationPolicies = $CAPolicies | Where-Object {
25+
($_.state -eq 'enabled') -and
26+
($_.conditions.applications.includeUserActions -eq 'urn:user:registerdevice')
27+
}
28+
29+
# Check each policy to see if it properly requires MFA
30+
$ValidPolicies = [System.Collections.Generic.List[object]]::new()
31+
foreach ($Policy in $DeviceRegistrationPolicies) {
32+
$RequiresMfa = $false
33+
34+
# Check if the policy directly requires MFA
35+
if ($Policy.grantControls.builtInControls -contains 'mfa') {
36+
$RequiresMfa = $true
37+
}
38+
39+
# Check if the policy uses any authentication strength
40+
if ($null -ne $Policy.grantControls.authenticationStrength) {
41+
$RequiresMfa = $true
42+
}
43+
44+
# If the policy requires MFA, add it to valid policies
45+
if ($RequiresMfa) {
46+
$ValidPolicies.Add($Policy)
47+
}
48+
}
49+
50+
# Determine pass/fail conditions
51+
if ($MfaRequiredInDeviceSettings) {
52+
$Passed = 'Failed'
53+
$ResultMarkdown = "❌ **MFA is configured incorrectly.** Device Settings has 'Require Multi-Factor Authentication to register or join devices' set to Yes. According to best practices, this should be set to No, and MFA should be enforced through Conditional Access policies instead.`n`n"
54+
} elseif ($DeviceRegistrationPolicies.Count -eq 0) {
55+
$Passed = 'Failed'
56+
$ResultMarkdown = "❌ **No Conditional Access policies found** for device registration or device join. Create a policy that requires MFA for these user actions.`n`n"
57+
} elseif ($ValidPolicies.Count -eq 0) {
58+
$Passed = 'Failed'
59+
$ResultMarkdown = "❌ **Conditional Access policies found**, but they're not correctly configured. Policies should require MFA or appropriate authentication strength.`n`n"
60+
} else {
61+
$Passed = 'Passed'
62+
$ResultMarkdown = "✅ **Properly configured Conditional Access policies found** that require MFA for device registration/join actions.`n`n"
63+
}
64+
65+
# Add device settings information
66+
$ResultMarkdown += "## Device Settings Configuration`n`n"
67+
$ResultMarkdown += "| Setting | Value | Recommended Value | Status |`n"
68+
$ResultMarkdown += "| :------ | :---- | :---------------- | :----- |`n"
69+
70+
$DeviceSettingStatus = if ($MfaRequiredInDeviceSettings) { '❌ Should be set to No' } else { '✅ Correctly configured' }
71+
$DeviceSettingValue = if ($MfaRequiredInDeviceSettings) { 'Yes' } else { 'No' }
72+
$ResultMarkdown += "| Require Multi-Factor Authentication to register or join devices | $DeviceSettingValue | No | $DeviceSettingStatus |`n"
73+
74+
# Add policies information if any found
75+
if ($DeviceRegistrationPolicies.Count -gt 0) {
76+
$ResultMarkdown += "`n## Device Registration/Join Conditional Access Policies`n`n"
77+
$ResultMarkdown += "| Policy Name | State | Requires MFA | Status |`n"
78+
$ResultMarkdown += "| :---------- | :---- | :----------- | :----- |`n"
79+
80+
foreach ($Policy in $DeviceRegistrationPolicies) {
81+
$PolicyName = $Policy.displayName
82+
$PolicyState = $Policy.state
83+
$PolicyLink = "https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/$($Policy.id)"
84+
$PolicyNameLink = "[$PolicyName]($PolicyLink)"
85+
86+
# Check if this policy is properly configured
87+
$IsValid = $Policy -in $ValidPolicies
88+
$RequiresMfaText = if ($IsValid) { 'Yes' } else { 'No' }
89+
$StatusText = if ($IsValid) { '✅ Properly configured' } else { '❌ Incorrectly configured' }
90+
91+
$ResultMarkdown += "| $PolicyNameLink | $PolicyState | $RequiresMfaText | $StatusText |`n"
92+
}
93+
}
94+
95+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Require multifactor authentication for device join and device registration using user action' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
96+
97+
} catch {
98+
$ErrorMessage = Get-CippException -Exception $_
99+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
100+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Require multifactor authentication for device join and device registration using user action' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
101+
}
102+
}

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21874.ps1‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
function Invoke-CippTestZTNA21874 {
2+
param($Tenant)
3+
4+
$TestId = 'ZTNA21874'
5+
6+
try {
7+
# Get B2B Management Policy from cache
8+
$B2BManagementPolicyObject = New-CIPPDbRequest -TenantFilter $Tenant -Type 'B2BManagementPolicy'
9+
10+
if (-not $B2BManagementPolicyObject) {
11+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'B2B Management Policy not found in cache' -Risk 'Medium' -Name 'Guest access is limited to approved tenants' -UserImpact 'Medium' -ImplementationEffort 'High' -Category 'External collaboration'
12+
return
13+
}
14+
15+
$Passed = 'Failed'
16+
$AllowedDomains = $null
17+
18+
if ($B2BManagementPolicyObject.definition) {
19+
$B2BManagementPolicy = ($B2BManagementPolicyObject.definition | ConvertFrom-Json).B2BManagementPolicy
20+
$AllowedDomains = $B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains
21+
22+
if ($AllowedDomains -and $AllowedDomains.Count -gt 0) {
23+
$Passed = 'Passed'
24+
}
25+
}
26+
27+
if ($Passed -eq 'Passed') {
28+
$ResultMarkdown = '✅ Allow/Deny lists of domains to restrict external collaboration are configured.'
29+
} else {
30+
$ResultMarkdown = '❌ Allow/Deny lists of domains to restrict external collaboration are not configured.'
31+
}
32+
33+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Guest access is limited to approved tenants' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'External collaboration'
34+
35+
} catch {
36+
$ErrorMessage = Get-CippException -Exception $_
37+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
38+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Guest access is limited to approved tenants' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'External collaboration'
39+
}
40+
}

0 commit comments

Comments
 (0)