Skip to content

Commit a7615cc

Browse files
merillmerill
authored
Merge pull request #727 from HenrikPiecha/add-intune-platform-tests
Add intune platform tests
2 parents 94fcaf1 + 7347d0b commit a7615cc

File tree

9 files changed

+197
-0
lines changed

9 files changed

+197
-0
lines changed

‎powershell/Maester.psd1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,7 @@ FunctionsToExport = 'Add-MtTestResultDetail', 'Clear-MtGraphCache', 'Connect-Mae
156156
'Test-MtCisZAP',
157157
'Test-MtConditionalAccessWhatIf',
158158
'Test-MtConnection',
159+
'Test-MtDeviceCleanupSettings', 'Test-MtDeviceComplianceSettings',
159160
'Test-MtEidscaControl',
160161
'Test-MtPimAlertsExists', 'Test-MtPrivPermanentDirectoryRole',
161162
'Update-MaesterTests', 'Compare-MtTestResult', 'Get-MailAuthenticationRecord',

‎powershell/public/maester/intune/Test-MtDeviceCleanupSettings.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
Ensure device clean-up rule is configured
2+
3+
This test checks if the device clean-up rule is configured.
4+
5+
Set your Intune device cleanup rules to delete Intune MDM enrolled devices that appear inactive, stale, or unresponsive. Intune applies cleanup rules immediately and continuously so that your device records remain current.
6+
7+
#### Remediation action:
8+
9+
To enable device clean-up rules:
10+
1. Navigate to Microsoft Intune admin center [https://intune.microsoft.com](https://intune.microsoft.com).
11+
2. Click **Devices** scroll down to **Organize devices**.
12+
3. Select **Device clean-up rules**.
13+
4. Set **Delete devices based on last check-in date** to **Yes**
14+
5. Set **Delete devices that haven’t checked in for this many days** to **30 days or more** depending on your organizational needs.
15+
6. Click **Save**.
16+
17+
#### Related links
18+
19+
* [Microsoft 365 Admin Center](https://admin.microsoft.com)
20+
* [Microsoft Intune - Device clean-up rules](https://intune.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/deviceCleanUp)
21+
22+
<!--- Results --->
23+
%TestResult%

‎powershell/public/maester/intune/Test-MtDeviceCleanupSettings.ps1‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<#
2+
.SYNOPSIS
3+
Ensure device clean-up rule is configured
4+
5+
.DESCRIPTION
6+
The device clean-up rule should be configured
7+
8+
.EXAMPLE
9+
Test-MtManagedDeviceCleanupSettings
10+
11+
Returns true if the device clean-up rule is configured
12+
13+
.LINK
14+
https://maester.dev/docs/commands/Test-MtManagedDeviceCleanupSettings
15+
#>
16+
function Test-MtManagedDeviceCleanupSettings {
17+
[CmdletBinding()]
18+
[OutputType([bool])]
19+
param()
20+
21+
if ((Get-MtLicenseInformation EntraID) -eq "Free") {
22+
Add-MtTestResultDetail -SkippedBecause NotLicensedEntraIDP1
23+
return $null
24+
}
25+
26+
$return = $true
27+
try {
28+
$deviceCleanupSettings = Invoke-MtGraphRequest -RelativeUri "deviceManagement/managedDeviceCleanupSettings" -ApiVersion beta
29+
if ((-not $deviceCleanupSettings.deviceInactivityBeforeRetirementInDays) -or ($deviceCleanupSettings.deviceInactivityBeforeRetirementInDays -eq 0)) {
30+
$testResultMarkdown = "Your Intune device clean-up rule is not configured."
31+
$return = $false
32+
} else {
33+
$testResultMarkdown = "Well done. Your Intune device clean-up rule is configured to retire inactive devices after $($deviceCleanupSettings.deviceInactivityBeforeRetirementInDays) days."
34+
}
35+
Add-MtTestResultDetail -Result $testResultMarkdown
36+
} catch {
37+
$return = $false
38+
Write-Error $_.Exception.Message
39+
}
40+
return $return
41+
}

‎powershell/public/maester/intune/Test-MtDeviceComplianceSettings.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
Ensure the built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'.
2+
3+
Set your Intune built-in Device Compliance Policy to mark devices with no compliance policy assigned as 'Not compliant'.
4+
This ensures that new devices that do not have any policies assigned are not compliant per default.
5+
6+
#### Remediation action:
7+
8+
To change the built-in device compliance policy:
9+
1. Navigate to Microsoft Intune admin center [https://intune.microsoft.com](https://intune.microsoft.com).
10+
2. Click **Devices** scroll down to **Manage devices**.
11+
3. Select **Compliance** and Select **Compliance settings**.
12+
4. Set **Mark devices with no compliance policy assigned as** to **Not compliant**
13+
5. Click **Save**.
14+
15+
#### Related links
16+
17+
* [Microsoft 365 Admin Center](https://admin.microsoft.com)
18+
* [Microsoft Intune - Compliance](https://intune.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/compliance)
19+
* [Compliance policy settings](https://learn.microsoft.com/de-de/mem/intune/protect/device-compliance-get-started#compliance-policy-settings)
20+
21+
<!--- Results --->
22+
%TestResult%

‎powershell/public/maester/intune/Test-MtDeviceComplianceSettings.ps1‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<#
2+
.SYNOPSIS
3+
Ensure the built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'
4+
5+
.DESCRIPTION
6+
The built-in Device Compliance Policy should mark devices with no compliance policy assigned as 'Not compliant'
7+
8+
9+
.EXAMPLE
10+
Test-MtDeviceComplianceSettings
11+
12+
Returns true if the device compliance settings are configured
13+
14+
.LINK
15+
https://maester.dev/docs/commands/Test-MtDeviceComplianceSettings
16+
#>
17+
function Test-MtDeviceComplianceSettings {
18+
[CmdletBinding()]
19+
[OutputType([bool])]
20+
param()
21+
22+
if ((Get-MtLicenseInformation EntraID) -eq "Free") {
23+
Add-MtTestResultDetail -SkippedBecause NotLicensedEntraIDP1
24+
return $null
25+
}
26+
27+
$return = $true
28+
try {
29+
$deviceComplianceSettings = Invoke-MtGraphRequest -RelativeUri "deviceManagement/settings" -ApiVersion beta
30+
Write-Verbose "Device Compliance Settings: $deviceComplianceSettings"
31+
if ($deviceComplianceSettings.secureByDefault -ne $true) {
32+
$testResultMarkdown = "Your Intune built-in Device Compliance Policy **incorrectly** marks devices with no compliance policy assigned as 'Compliant'."
33+
$return = $false
34+
} else {
35+
$testResultMarkdown = "Well done. Your Intune built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'."
36+
}
37+
Add-MtTestResultDetail -Result $testResultMarkdown
38+
} catch {
39+
$return = $false
40+
Write-Error $_.Exception.Message
41+
}
42+
return $return
43+
}

‎tests/Maester/Intune/Test-MtIntunePlatform.Tests.ps1‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
Describe "Intune" -Tag "Maester", "Intune", "All" {
2+
It "Ensure intune device clean-up rule is configured" -Tag "MT.1053" {
3+
$result = Test-MtManagedDeviceCleanupSettings
4+
if ($null -ne $result) {
5+
$result | Should -Be $true -Because "automatic device clean-up rule is configured."
6+
}
7+
}
8+
9+
It "Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'" -Tag "MT.1054" {
10+
$result = Test-MtDeviceComplianceSettings
11+
if ($null -ne $result) {
12+
$result | Should -Be $true -Because "built-in device compliance policy marks devices with no policy assigned as 'Not compliant'."
13+
}
14+
}
15+
}

‎website/docs/sections/permissions.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,4 @@
99
- **RoleManagement.Read.All**
1010
- **SharePointTenantSettings.Read.All**
1111
- **UserAuthenticationMethod.Read.All**
12+
- **DeviceManagementManagedDevices.Read.All**

‎website/docs/tests/maester/MT.1053.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
title: MT.1053 - Intune automatic device clean-up rule is configured.
3+
description: Checks if the intune automatic device clean-up rule is configured.
4+
slug: /tests/MT.1053
5+
sidebar_class_name: hidden
6+
---
7+
8+
# Intune automatic device clean-up rule is configured.
9+
10+
## Description
11+
12+
Set your Intune device cleanup rules to delete Intune MDM enrolled devices that appear inactive, stale, or unresponsive. Intune applies cleanup rules immediately and continuously so that your device records remain current.
13+
14+
## How to fix
15+
16+
1. Navigate to Microsoft Intune admin center [https://intune.microsoft.com](https://intune.microsoft.com).
17+
2. Click **Devices** scroll down to **Organize devices**.
18+
3. Select **Device clean-up rules**.
19+
4. Set **Delete devices based on last check-in date** to **Yes**
20+
5. Set **Delete devices that haven’t checked in for this many days** to **30 days or more** depending on your organizational needs.
21+
6. Click **Save**.
22+
23+
## Learn more
24+
* [Microsoft 365 Admin Center](https://admin.microsoft.com)
25+
* [Microsoft Intune - Device clean-up rules](https://intune.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/deviceCleanUp)

‎website/docs/tests/maester/MT.1054.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
title: MT.1054 - Intune built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'.
3+
description: Checks if the intune built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'
4+
slug: /tests/MT.1054
5+
sidebar_class_name: hidden
6+
---
7+
8+
# Intune built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'.
9+
10+
## Description
11+
12+
Set your Intune built-in Device Compliance Policy to mark devices with no compliance policy assigned as 'Not compliant'.
13+
This ensures that new devices that do not have any policies assigned are not compliant per default.
14+
15+
## How to fix
16+
17+
1. Navigate to Microsoft Intune admin center [https://intune.microsoft.com](https://intune.microsoft.com).
18+
2. Click **Devices** scroll down to **Manage devices**.
19+
3. Select **Compliance** and Select **Compliance settings**.
20+
4. Set **Mark devices with no compliance policy assigned as** to **Not compliant**
21+
5. Click **Save**.
22+
23+
## Learn more
24+
* [Microsoft 365 Admin Center](https://admin.microsoft.com)
25+
* [Microsoft Intune - Compliance](https://intune.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/compliance)
26+
* [Compliance policy settings](https://learn.microsoft.com/de-de/mem/intune/protect/device-compliance-get-started#compliance-policy-settings)

0 commit comments

Comments
 (0)