release: v4.1.0 — restructure entry points, add CIS baselines, reporting tools and fzf hints
- Restructure launchers: Start-IntuneToolkit.ps1 moves to repo root; Start-HeadlessIntune.ps1 moves to Scripts/; TUI helper moves to Scripts/Private/ - Add AGENTS.md with project architecture, entry points, and security notes - Add CIS M365 baseline assets (CISM365-v7, M365-CIS-Rapid) and reporting scripts - Add Python reporting utilities (Export-SettingsReport, Export-AssignmentReport, Export-ObjectInventoryReport) and CA wizard helpers - Update Deploy-IntuneBaseline.ps1 with Merge conflict resolution, ReportPath, and optimized group loading - Update Initialize-IntuneAuth.ps1 with -RotateSecret and configurable secret expiry - Update Extensions for Settings Catalog definition auto-export - Update README with v4.1.0, new entry points and script catalog - Bump VERSION to 4.1.0 - Harden .gitignore against .DS_Store, __pycache__, .venv-pdf/, local exports, Settings.json and IntuneManagement.log
This commit is contained in:
@@ -0,0 +1,466 @@
|
||||
# =====================================================================
|
||||
# CIS Microsoft 365 Foundations Benchmark v7.0.0 (Draft)
|
||||
# Tenant-Level Baseline Manifest
|
||||
# =====================================================================
|
||||
# This YAML extends the OpenIntuneBaseline format to cover M365 tenant
|
||||
# configuration: Entra ID, Conditional Access, Defender, Exchange,
|
||||
# SharePoint, and Teams.
|
||||
#
|
||||
# HOW TO USE WITH A DRAFT PDF:
|
||||
# 1. Copy this file to your own baseline (e.g., mytenant-cisv7.yaml)
|
||||
# 2. As you read the CIS v7.0.0 PDF, transcribe controls into the
|
||||
# appropriate sections below. Each control has a 'cisControl' field
|
||||
# for traceability.
|
||||
# 3. Customize names, exclusions, and groups for your tenant.
|
||||
# 4. Run: ./Scripts/Deploy-CISM365Baseline.ps1 -BaselinePath ./Baselines/mytenant-cisv7.yaml
|
||||
#
|
||||
# SAFETY:
|
||||
# - Conditional Access policies default to 'reportOnly: true' (globally)
|
||||
# and 'state: enabledForReportingButNotEnforced' (per-policy).
|
||||
# - The script also supports -WhatIf.
|
||||
# - Break-glass accounts/groups are automatically excluded from CA.
|
||||
# =====================================================================
|
||||
|
||||
baseline:
|
||||
name: CIS-M365-v7-Example
|
||||
conflictResolution: Skip # Skip | Update | Error
|
||||
whatIf: false
|
||||
|
||||
# -------------------------------------------------------------------
|
||||
# Global name mutation applied to every policy / CA rule (optional)
|
||||
# -------------------------------------------------------------------
|
||||
tenantMutation:
|
||||
search: "CIS-v7-"
|
||||
replace: "ACME-CIS-"
|
||||
# Alternatively use prefix instead of search/replace:
|
||||
# prefix: "ACME-CIS-"
|
||||
|
||||
# -------------------------------------------------------------------
|
||||
# Cloud-only security groups (mirrors Intune baseline format)
|
||||
# These are created if they do not exist and can be referenced
|
||||
# in CA policy assignments by displayName.
|
||||
# -------------------------------------------------------------------
|
||||
groups:
|
||||
- displayName: "CIS-BreakGlass"
|
||||
mailNickname: "CISBreakGlass"
|
||||
securityEnabled: true
|
||||
|
||||
- displayName: "CIS-Pilot-Users"
|
||||
mailNickname: "CISPilotUsers"
|
||||
securityEnabled: true
|
||||
|
||||
- displayName: "CIS-All-Company"
|
||||
mailNickname: "CISAllCompany"
|
||||
securityEnabled: true
|
||||
|
||||
# -------------------------------------------------------------------
|
||||
# Intune policies (optional — reuses the exact same schema as
|
||||
# OpenIntuneBaseline.example.yaml). Keep them here if you want a
|
||||
# single manifest for the whole tenant.
|
||||
# -------------------------------------------------------------------
|
||||
policies:
|
||||
# Example: reuse your existing Intune exports
|
||||
# - sourcePath: ./policies/CIS-Windows-Compliance.json
|
||||
# type: CompliancePolicies
|
||||
# assignments:
|
||||
# - targetType: Group
|
||||
# groupName: "CIS-All-Company"
|
||||
|
||||
# -------------------------------------------------------------------
|
||||
# TENANT-LEVEL CONFIGURATION (new section)
|
||||
# -------------------------------------------------------------------
|
||||
tenantConfig:
|
||||
|
||||
# ===============================================================
|
||||
# 1. M365 Admin Center (CIS Section 1)
|
||||
# ===============================================================
|
||||
adminCenter:
|
||||
# 1.3.1 (L1) Password expiration
|
||||
passwordExpiration: NeverExpire # NeverExpire | 90Days | 180Days
|
||||
|
||||
# 1.3.2 (L2) Idle session timeout (hours)
|
||||
idleSessionTimeoutHours: 3
|
||||
|
||||
# 1.3.4 (L1) Restrict user owned apps and services
|
||||
restrictUserOwnedApps: true
|
||||
|
||||
# 1.3.5 (L1) Internal phishing protection for Forms
|
||||
formsPhishingProtection: true
|
||||
|
||||
# 1.3.6 (L2) Customer Lockbox
|
||||
customerLockbox: true
|
||||
|
||||
# 1.3.7 (L2) Restrict third-party storage services
|
||||
restrictThirdPartyStorage: true
|
||||
|
||||
# ===============================================================
|
||||
# 5. Entra ID (CIS Section 5)
|
||||
# ===============================================================
|
||||
entraId:
|
||||
# 5.1.1.1 (L1) Cloud-only administrative accounts
|
||||
# NOTE: Manual — script can only validate, not create accounts.
|
||||
|
||||
# 5.1.1.3 (L1) Global admin count (2-4)
|
||||
# NOTE: Manual — script assesses only.
|
||||
|
||||
# 5.1.2.2 (L2) Disallow third-party integrated applications
|
||||
blockUserConsent: true
|
||||
|
||||
# 5.1.2.3 (L1) Restrict non-admin tenant creation
|
||||
blockTenantCreation: true
|
||||
|
||||
# 5.1.2.4 (L1) Restrict access to Entra admin center
|
||||
restrictAdminCenterAccess: true
|
||||
|
||||
# 5.1.2.6 (L2) Disable LinkedIn account connections
|
||||
disableLinkedIn: true
|
||||
|
||||
# 5.1.3.1 (L1) Dynamic group for guest users
|
||||
# NOTE: Manual — requires tenant-specific query.
|
||||
|
||||
# 5.1.4.2 (L1) Maximum devices per user
|
||||
maxDevicesPerUser: 5
|
||||
|
||||
# 5.1.4.3 (L1) GA not added as local admin during Entra join
|
||||
gaLocalAdminDisabled: true
|
||||
|
||||
# 5.2.3.2 (L1) Custom banned password list
|
||||
bannedPasswords:
|
||||
- "Contoso"
|
||||
- "Password"
|
||||
- "Welcome"
|
||||
- "Admin"
|
||||
- "Login"
|
||||
|
||||
# 5.2.3.4 (L1) Ensure all member users are MFA capable
|
||||
# NOTE: Enforced via Conditional Access below.
|
||||
|
||||
# ===============================================================
|
||||
# 5.2.2 Conditional Access (CIS Section 5.2.2)
|
||||
# ===============================================================
|
||||
# CRITICAL: All CA policies are created in REPORT-ONLY mode by
|
||||
# default. Flip 'reportOnly: false' after you have validated
|
||||
# traffic in the Entra admin center.
|
||||
# ===============================================================
|
||||
conditionalAccess:
|
||||
reportOnly: true # Global switch for all CA policies
|
||||
breakGlassGroup: "CIS-BreakGlass" # Auto-excluded from every CA policy
|
||||
|
||||
policies:
|
||||
# -----------------------------------------------------------
|
||||
# CIS 5.2.2.3 (L1) Block legacy authentication
|
||||
# -----------------------------------------------------------
|
||||
- name: "Block-Legacy-Auth"
|
||||
cisControl: "5.2.2.3"
|
||||
description: "Block all legacy authentication protocols (EAS, basic auth)"
|
||||
state: enabledForReportingButNotEnforced # enabled | enabledForReportingButNotEnforced | disabled
|
||||
conditions:
|
||||
applications:
|
||||
includeApplications: ["All"]
|
||||
users:
|
||||
includeUsers: ["All"]
|
||||
# breakGlassGroup is injected automatically by the script
|
||||
clientAppTypes: ["exchangeActiveSync", "other"]
|
||||
grantControls:
|
||||
builtInControls: ["block"]
|
||||
operator: "OR"
|
||||
|
||||
# -----------------------------------------------------------
|
||||
# CIS 5.2.2.1 (L1) Require MFA for administrative roles
|
||||
# -----------------------------------------------------------
|
||||
- name: "Require-MFA-Admins"
|
||||
cisControl: "5.2.2.1"
|
||||
description: "Require MFA for all users assigned to administrative roles"
|
||||
state: enabledForReportingButNotEnforced
|
||||
conditions:
|
||||
applications:
|
||||
includeApplications: ["All"]
|
||||
users:
|
||||
includeRoles:
|
||||
- "Global Administrator"
|
||||
- "Privileged Role Administrator"
|
||||
- "Security Administrator"
|
||||
- "Exchange Administrator"
|
||||
- "SharePoint Administrator"
|
||||
- "Conditional Access Administrator"
|
||||
- "Application Administrator"
|
||||
- "Cloud Application Administrator"
|
||||
- "User Administrator"
|
||||
- "Helpdesk Administrator"
|
||||
- "Billing Administrator"
|
||||
- "Authentication Administrator"
|
||||
- "Password Administrator"
|
||||
- "Global Reader"
|
||||
excludeUsers: [] # Add break-glass UPNs here if not using breakGlassGroup
|
||||
grantControls:
|
||||
builtInControls: ["mfa"]
|
||||
operator: "OR"
|
||||
|
||||
# -----------------------------------------------------------
|
||||
# CIS 5.2.2.2 (L1) Require MFA for all users
|
||||
# -----------------------------------------------------------
|
||||
- name: "Require-MFA-All-Users"
|
||||
cisControl: "5.2.2.2"
|
||||
description: "Require MFA for all user sign-ins"
|
||||
state: enabledForReportingButNotEnforced
|
||||
conditions:
|
||||
applications:
|
||||
includeApplications: ["All"]
|
||||
users:
|
||||
includeUsers: ["All"]
|
||||
excludeGroups: [] # e.g., ["CIS-Pilot-Users"] for staged rollout
|
||||
locations:
|
||||
includeLocations: ["AllTrusted"] # Requires named locations; use "All" if none defined
|
||||
grantControls:
|
||||
builtInControls: ["mfa"]
|
||||
operator: "OR"
|
||||
|
||||
# -----------------------------------------------------------
|
||||
# CIS 5.2.2.4 (L1) Sign-in frequency for admins
|
||||
# -----------------------------------------------------------
|
||||
- name: "Admin-SignIn-Frequency"
|
||||
cisControl: "5.2.2.4"
|
||||
description: "Require re-authentication every 12h for admins; no persistent browser"
|
||||
state: enabledForReportingButNotEnforced
|
||||
conditions:
|
||||
applications:
|
||||
includeApplications: ["All"]
|
||||
users:
|
||||
includeRoles:
|
||||
- "Global Administrator"
|
||||
- "Privileged Role Administrator"
|
||||
- "Security Administrator"
|
||||
sessionControls:
|
||||
signInFrequency:
|
||||
value: 12
|
||||
type: hours
|
||||
isEnabled: true
|
||||
persistentBrowser:
|
||||
mode: never
|
||||
isEnabled: true
|
||||
grantControls:
|
||||
builtInControls: ["mfa"]
|
||||
operator: "OR"
|
||||
|
||||
# -----------------------------------------------------------
|
||||
# CIS 5.2.2.5 (L2) Phishing-resistant MFA for admins
|
||||
# -----------------------------------------------------------
|
||||
- name: "Require-PhishingResistant-MFA-Admins"
|
||||
cisControl: "5.2.2.5"
|
||||
description: "Require phishing-resistant MFA (FIDO2, certificate) for admins"
|
||||
state: enabledForReportingButNotEnforced
|
||||
conditions:
|
||||
applications:
|
||||
includeApplications: ["All"]
|
||||
users:
|
||||
includeRoles:
|
||||
- "Global Administrator"
|
||||
- "Privileged Role Administrator"
|
||||
- "Security Administrator"
|
||||
grantControls:
|
||||
builtInControls: ["authenticationStrength"]
|
||||
authenticationStrength:
|
||||
id: "00000000-0000-0000-0000-000000000004" # Phishing-resistant MFA
|
||||
operator: "OR"
|
||||
|
||||
# -----------------------------------------------------------
|
||||
# CIS 5.2.2.12 (L1) Block device code flow
|
||||
# -----------------------------------------------------------
|
||||
- name: "Block-Device-Code-Flow"
|
||||
cisControl: "5.2.2.12"
|
||||
description: "Block sign-ins using the device code authentication flow"
|
||||
state: enabledForReportingButNotEnforced
|
||||
conditions:
|
||||
applications:
|
||||
includeApplications: ["All"]
|
||||
users:
|
||||
includeUsers: ["All"]
|
||||
authenticationFlows:
|
||||
deviceCodeFlow:
|
||||
isEnabled: true
|
||||
ruleType: "include"
|
||||
grantControls:
|
||||
builtInControls: ["block"]
|
||||
operator: "OR"
|
||||
|
||||
# -----------------------------------------------------------
|
||||
# CIS 5.2.2.8 (L2) Block medium/high risk sign-ins
|
||||
# -----------------------------------------------------------
|
||||
- name: "Block-HighRisk-SignIns"
|
||||
cisControl: "5.2.2.8"
|
||||
description: "Block sign-ins with medium or high risk score (requires Entra ID P2)"
|
||||
state: enabledForReportingButNotEnforced
|
||||
conditions:
|
||||
applications:
|
||||
includeApplications: ["All"]
|
||||
users:
|
||||
includeUsers: ["All"]
|
||||
signInRiskLevels: ["medium", "high"]
|
||||
grantControls:
|
||||
builtInControls: ["block"]
|
||||
operator: "OR"
|
||||
|
||||
# -----------------------------------------------------------
|
||||
# CIS 5.2.2.9 (L1) Require managed device
|
||||
# -----------------------------------------------------------
|
||||
- name: "Require-Managed-Device"
|
||||
cisControl: "5.2.2.9"
|
||||
description: "Require device to be compliant or hybrid Entra joined"
|
||||
state: enabledForReportingButNotEnforced
|
||||
conditions:
|
||||
applications:
|
||||
includeApplications: ["All"]
|
||||
users:
|
||||
includeUsers: ["All"]
|
||||
grantControls:
|
||||
builtInControls: ["compliantDevice", "domainJoinedDevice"]
|
||||
operator: "OR"
|
||||
|
||||
# -----------------------------------------------------------
|
||||
# CIS 5.2.2.10 (L1) Require managed device to register security info
|
||||
# -----------------------------------------------------------
|
||||
- name: "Require-Managed-Device-Security-Info"
|
||||
cisControl: "5.2.2.10"
|
||||
description: "Require managed device when registering security information"
|
||||
state: enabledForReportingButNotEnforced
|
||||
conditions:
|
||||
applications:
|
||||
includeUserActions: ["urn:user:registersecurityinfo"]
|
||||
users:
|
||||
includeUsers: ["All"]
|
||||
grantControls:
|
||||
builtInControls: ["compliantDevice", "domainJoinedDevice"]
|
||||
operator: "OR"
|
||||
|
||||
# ===============================================================
|
||||
# 2. Microsoft Defender for Office 365 (CIS Section 2)
|
||||
# ===============================================================
|
||||
defender:
|
||||
# 2.1.1 (L2) Safe Links for Office Applications
|
||||
safeLinks:
|
||||
- name: "SafeLinks-Default"
|
||||
cisControl: "2.1.1"
|
||||
enabled: true
|
||||
trackClicks: true
|
||||
allowClickThrough: false
|
||||
scanUrls: true
|
||||
enableForInternalSenders: true
|
||||
# The script auto-creates a rule applying this to all accepted domains
|
||||
|
||||
# 2.1.4 (L2) Safe Attachments
|
||||
safeAttachments:
|
||||
- name: "SafeAttachments-Default"
|
||||
cisControl: "2.1.4"
|
||||
enabled: true
|
||||
action: Block # Block | DynamicDelivery | Monitor
|
||||
quarantineMessages: true
|
||||
|
||||
# 2.1.2 (L1) Common Attachment Types Filter
|
||||
antiMalware:
|
||||
- name: "AntiMalware-Default"
|
||||
cisControl: "2.1.2"
|
||||
enabled: true
|
||||
enableInternalNotifications: true
|
||||
fileTypes:
|
||||
- ace
|
||||
- ani
|
||||
- app
|
||||
- docm
|
||||
- exe
|
||||
- jar
|
||||
- jnlp
|
||||
- msi
|
||||
- ps1
|
||||
- scr
|
||||
- vbs
|
||||
- wsf
|
||||
|
||||
# 2.1.3 (L1) Internal malware notifications
|
||||
# 2.4.4 (L1) Zero-hour auto purge for Teams
|
||||
|
||||
# ===============================================================
|
||||
# 6. Exchange Online (CIS Section 6)
|
||||
# ===============================================================
|
||||
exchange:
|
||||
# 6.1.1 (L1) AuditDisabled organizationally set to False
|
||||
enableMailboxAuditOrgWide: true
|
||||
|
||||
# 6.1.2 (L1) Mailbox audit actions configured
|
||||
# NOTE: Enabled automatically when org-wide auditing is on (above).
|
||||
|
||||
# 6.2.1 (L1) Block all forms of external forwarding
|
||||
blockExternalForwarding: true
|
||||
|
||||
# 6.2.2 (L1) Transport rules do not whitelist domains
|
||||
# NOTE: Manual review required.
|
||||
|
||||
# 6.2.3 (L1) Identify email from external senders
|
||||
enableExternalSenderBanner: true
|
||||
|
||||
# Transport rule: prepend external email warning
|
||||
externalEmailWarningRule: true
|
||||
|
||||
# ===============================================================
|
||||
# 7. SharePoint / OneDrive (CIS Section 7)
|
||||
# ===============================================================
|
||||
sharePoint:
|
||||
# Default sharing link type
|
||||
defaultSharingLinkType: Direct # Direct | Internal | AnonymousAccess
|
||||
|
||||
# External sharing for SharePoint
|
||||
sharePointExternalSharing: Disabled
|
||||
# Options: Disabled | ExistingExternalUserSharingOnly | ExternalUserSharingOnly | Anyone
|
||||
|
||||
# External sharing for OneDrive
|
||||
oneDriveExternalSharing: Disabled
|
||||
|
||||
# Guest access expiration (days)
|
||||
guestAccessExpirationDays: 30
|
||||
|
||||
# 7.x (L1) Prevent custom script execution
|
||||
# NOTE: Set via Set-PnPTenant -DenyAddAndCustomizePages 1
|
||||
denyCustomScripts: true
|
||||
|
||||
# ===============================================================
|
||||
# 8. Microsoft Teams (CIS Section 8)
|
||||
# ===============================================================
|
||||
teams:
|
||||
# 8.x Anonymous meeting join
|
||||
allowAnonymousUsersToJoinMeeting: false
|
||||
|
||||
# 8.x Anonymous meeting start
|
||||
allowAnonymousUsersToStartMeeting: false
|
||||
|
||||
# 8.x Teams email integration
|
||||
enableEmailIntegration: false
|
||||
|
||||
# 8.x Federation / external access
|
||||
allowFederatedUsers: false
|
||||
allowTeamsConsumer: false
|
||||
|
||||
# 8.x Restrict unmanaged user access
|
||||
# NOTE: Controlled via Teams meeting policy; script sets Global.
|
||||
|
||||
# ===============================================================
|
||||
# 3. Microsoft Purview (CIS Section 3)
|
||||
# ===============================================================
|
||||
# NOTE: DLP, sensitivity labels, and retention policies are
|
||||
# highly business-specific. Add them here as needed:
|
||||
#
|
||||
# purview:
|
||||
# dlpPolicies:
|
||||
# - name: "CIS-DLP-Default"
|
||||
# ...
|
||||
|
||||
# ===============================================================
|
||||
# 9. Power BI (CIS Section 9)
|
||||
# ===============================================================
|
||||
# NOTE: Power BI tenant settings are best managed via
|
||||
# Microsoft365DSC or direct Admin API calls. Add here if needed.
|
||||
|
||||
# ===============================================================
|
||||
# NEW in v7.0.0 (expected)
|
||||
# ===============================================================
|
||||
# As you read the draft PDF, transcribe new controls into the
|
||||
# appropriate sections above. Use the 'cisControl' field to
|
||||
# preserve traceability (e.g., cisControl: "5.2.3.7").
|
||||
Reference in New Issue
Block a user