Network 25377: Users accessing external applications from corporate devices are blocked unless explicitly authorized by tenant restrictions policies

[ashwinikarke]

No description provided.

[Copilot]

Pull request overview

Adds a new Network/Global Secure Access assessment (Test ID 25377) to validate that Universal Tenant Restrictions (UTR) are configured to block access to unauthorized external tenants.

Changes:

• Introduces Test-Assessment-25377 PowerShell test to evaluate Global Secure Access network packet tagging and the tenant restrictions v2 default policy.
• Adds markdown remediation/description content for the new assessment.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/powershell/tests/Test-Assessment.25377.ps1	Implements the assessment logic and detailed markdown reporting for UTR configuration validation.
src/powershell/tests/Test-Assessment.25377.md	Provides risk context and remediation guidance with a %TestResult% insertion point.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alexandair]

@ashwinikarke Please, address my feedback.

[alexandair]

@ashwinikarke
Spec says:

Note: If Users & Groups Target does not equal AllUsers, put Specific users and groups configured in the Current Value column.
Note: If Applications Target does not equal AllApplications, put Specific applications configured in the Current Value column.

Please, address that.

[ashwinikarke]

@ashwinikarke Spec says:

Note: If Users & Groups Target does not equal AllUsers, put Specific users and groups configured in the Current Value column. Note: If Applications Target does not equal AllApplications, put Specific applications configured in the Current Value column.

Please, address that.

@alexandair As discussed in the DSM, I’ve updated the table to display up to five applications, with an ellipsis ... shown if there are more than five.

[merill]

@ashwinikarke we need to get the names of the apps and show them. The GUIDs are not going to be helpful. if only the ID is available then you should look up the Service Principals (or Applications) db table by objectid to get the name

[ashwinikarke]

@ashwinikarke we need to get the names of the apps and show them. The GUIDs are not going to be helpful. if only the ID is available then you should look up the Service Principals (or Applications) db table by objectid to get the name

@merill / @alexandair To retrieve application names from the DB, can I create a shared function in the shared folder so Praneet can also reuse it and include this change in this same PR?

[alexandair]

@ashwinikarke How will this work if assessment test function doesn't have Database parameter?

[ashwinikarke]

@ashwinikarke How will this work if assessment test function doesn't have Database parameter?

@alexandair It worked without the $Database parameter maybe because the test framework uses $global:Database, but I added the parameter to follow best practices and align with other tests.

[alexandair]

LGTM

/cc @merill

Something went wrong.