Skip to content

Commit fbf8aec

Browse files
SagarSatheSagarSathe
authored
Merge pull request #731 from alexandair/alex-35007
35007 - Add test for Information Rights Management (IRM) in SharePoint Online
2 parents eb41d25 + 63621e6 commit fbf8aec

File tree

3 files changed

+198
-0
lines changed

3 files changed

+198
-0
lines changed

‎code-tests/test-assessments/Test-Assessment.35007.Tests.ps1‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
Describe "Test-Assessment-35007" {
2+
BeforeAll {
3+
$here = $PSScriptRoot
4+
$srcRoot = Join-Path $here "../../src/powershell"
5+
6+
# Mock external module dependencies if they are not present
7+
if (-not (Get-Command Write-PSFMessage -ErrorAction SilentlyContinue)) {
8+
function Write-PSFMessage {}
9+
}
10+
if (-not (Get-Command Get-SPOTenant -ErrorAction SilentlyContinue)) {
11+
function Get-SPOTenant {}
12+
}
13+
14+
# Load the class
15+
$classPath = Join-Path $srcRoot "classes/ZtTest.ps1"
16+
if (-not ("ZtTest" -as [type])) {
17+
. $classPath
18+
}
19+
20+
# Load the SUT
21+
$sut = Join-Path $srcRoot "tests/Test-Assessment.35007.ps1"
22+
. $sut
23+
24+
# Setup output file
25+
$script:outputFile = Join-Path $here "../TestResults/Report-Test-Assessment.35007.md"
26+
$outputDir = Split-Path $script:outputFile
27+
if (-not (Test-Path $outputDir)) { New-Item -ItemType Directory -Path $outputDir | Out-Null }
28+
"# Test Results for 35007`n" | Set-Content $script:outputFile
29+
}
30+
31+
# Mock common module functions
32+
BeforeEach {
33+
Mock Write-PSFMessage {}
34+
Mock Write-ZtProgress {}
35+
}
36+
37+
Context "When querying SharePoint tenant settings fails" {
38+
It "Should return Investigate status" {
39+
Mock Get-SPOTenant { throw "Connection error" }
40+
Mock Add-ZtTestResultDetail {
41+
param($TestId, $Title, $Status, $Result)
42+
"## Scenario: Error querying settings`n`n$Result`n" | Add-Content $script:outputFile
43+
}
44+
45+
Test-Assessment-35007
46+
47+
Should -Invoke Add-ZtTestResultDetail -ParameterFilter {
48+
$Status -eq $false -and $Result -match "Unable to query SharePoint Tenant Settings"
49+
}
50+
}
51+
}
52+
53+
Context "When IRM is enabled (Fail)" {
54+
It "Should return Fail status" {
55+
Mock Get-SPOTenant {
56+
return [PSCustomObject]@{
57+
IrmEnabled = $true
58+
}
59+
}
60+
Mock Add-ZtTestResultDetail {
61+
param($TestId, $Title, $Status, $Result)
62+
"## Scenario: IRM enabled`n`n$Result`n" | Add-Content $script:outputFile
63+
}
64+
65+
Test-Assessment-35007
66+
67+
Should -Invoke Add-ZtTestResultDetail -ParameterFilter {
68+
$Status -eq $false -and $Result -match 'IrmEnabled: True'
69+
}
70+
}
71+
}
72+
73+
Context "When IRM is disabled (Pass)" {
74+
It "Should return Pass status" {
75+
Mock Get-SPOTenant {
76+
return [PSCustomObject]@{
77+
IrmEnabled = $false
78+
}
79+
}
80+
Mock Add-ZtTestResultDetail {
81+
param($TestId, $Title, $Status, $Result)
82+
"## Scenario: IRM disabled`n`n$Result`n" | Add-Content $script:outputFile
83+
}
84+
85+
Test-Assessment-35007
86+
87+
Should -Invoke Add-ZtTestResultDetail -ParameterFilter {
88+
$Status -eq $true -and $Result -match 'IrmEnabled: False'
89+
}
90+
}
91+
}
92+
}

‎src/powershell/tests/Test-Assessment.35007.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
Information Rights Management (IRM) integration in SharePoint Online libraries is a legacy feature that has been replaced by Enhanced SharePoint Permissions (ESP). Any library using this legacy capability should be flagged to move to newer capabilities.
2+
3+
**Remediation action**
4+
5+
To disable legacy IRM in SharePoint Online:
6+
1. Identify libraries currently using IRM protection (audit existing sites)
7+
2. Plan migration to modern sensitivity labels with encryption
8+
3. Connect to SharePoint Online: `Connect-SPOService -Url https://<tenant>-admin.sharepoint.com`
9+
4. Disable legacy IRM: `Set-SPOTenant -IrmEnabled $false`
10+
5. Enable modern sensitivity labels: `Set-SPOTenant -EnableAIPIntegration $true`
11+
6. Configure and publish sensitivity labels with encryption to replace IRM policies
12+
13+
- [Enable sensitivity labels for SharePoint and OneDrive](https://learn.microsoft.com/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files)
14+
- [SharePoint IRM and sensitivity labels (migration guidance)](https://learn.microsoft.com/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files#sharepoint-information-rights-management-irm-and-sensitivity-labels)
15+
- [Create and configure sensitivity labels with encryption](https://learn.microsoft.com/microsoft-365/compliance/encryption-sensitivity-labels)
16+
17+
<!--- Results --->
18+
%TestResult%

‎src/powershell/tests/Test-Assessment.35007.ps1‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
<#
2+
.SYNOPSIS
3+
Information Rights Management (IRM) Enabled in SharePoint Online
4+
5+
.DESCRIPTION
6+
Information Rights Management (IRM) integration in SharePoint Online libraries is a legacy feature that has been replaced by Enhanced SharePoint Permissions (ESP). Any library using this legacy capabilitiy should be flagged to move to newer capabilities.
7+
8+
.NOTES
9+
Test ID: 35007
10+
Pillar: Data
11+
Risk Level: Low
12+
#>
13+
14+
function Test-Assessment-35007 {
15+
[ZtTest(
16+
Category = 'SharePoint Online',
17+
ImplementationCost = 'Low',
18+
MinimumLicense = ('Microsoft 365 E3'),
19+
Pillar = 'Data',
20+
RiskLevel = 'Low',
21+
SfiPillar = '',
22+
TenantType = ('Workforce'),
23+
TestId = 35007,
24+
Title = 'Information Rights Management (IRM) Enabled in SharePoint Online',
25+
UserImpact = 'Low'
26+
)]
27+
[CmdletBinding()]
28+
param()
29+
30+
#region Data Collection
31+
Write-PSFMessage '🟦 Start' -Tag Test -Level VeryVerbose
32+
33+
$activity = 'Checking Information Rights Management (IRM) Status in SharePoint Online'
34+
Write-ZtProgress -Activity $activity -Status 'Getting SharePoint Tenant Settings'
35+
36+
$spoTenant = $null
37+
$errorMsg = $null
38+
39+
try {
40+
# Query: Retrieve SharePoint Online tenant IRM enablement status
41+
$spoTenant = Get-SPOTenant -ErrorAction Stop
42+
}
43+
catch {
44+
$errorMsg = $_
45+
Write-PSFMessage "Error querying SharePoint Tenant Settings: $_" -Level Error
46+
}
47+
#endregion Data Collection
48+
49+
#region Assessment Logic
50+
if ($errorMsg) {
51+
$passed = $false
52+
}
53+
else {
54+
$passed = $null -ne $spoTenant -and $spoTenant.IrmEnabled -ne $true
55+
}
56+
#endregion Assessment Logic
57+
58+
#region Report Generation
59+
if ($errorMsg) {
60+
$testResultMarkdown = "### Investigate`n`n"
61+
$testResultMarkdown += "Unable to query SharePoint Tenant Settings due to error: $errorMsg"
62+
}
63+
else {
64+
if ($passed) {
65+
$testResultMarkdown = "✅ Legacy IRM feature is disabled. Organizations should use modern sensitivity labels for document protection.`n`n"
66+
}
67+
else {
68+
$testResultMarkdown = "❌ Legacy IRM feature is still enabled. Libraries may be using outdated protection mechanisms.`n`n"
69+
}
70+
71+
$testResultMarkdown += "### SharePoint Online Configuration Summary`n`n"
72+
$testResultMarkdown += "**Tenant Settings:**`n"
73+
74+
$irmEnabled = if ($null -ne $spoTenant -and $spoTenant.IrmEnabled -eq $true) { "True" } else { "False" }
75+
$testResultMarkdown += "* IrmEnabled: $irmEnabled`n"
76+
77+
$testResultMarkdown += "`n[Manage Information Rights Management (IRM) in SharePoint Admin Center](https://admin.microsoft.com/sharepoint?page=classicSettings&modern=true)`n"
78+
}
79+
#endregion Report Generation
80+
81+
$params = @{
82+
TestId = '35007'
83+
Title = 'Information Rights Management (IRM) Enabled in SharePoint Online'
84+
Status = $passed
85+
Result = $testResultMarkdown
86+
}
87+
Add-ZtTestResultDetail @params
88+
}

0 commit comments

Comments
 (0)