diff --git a/source/Private/Get-CISExoOutput.ps1 b/source/Private/Get-CISExoOutput.ps1 index ac8280e..9f95f1e 100644 --- a/source/Private/Get-CISExoOutput.ps1 +++ b/source/Private/Get-CISExoOutput.ps1 @@ -284,7 +284,7 @@ function Get-CISExoOutput { # Retrieve the necessary settings for Teams and Exchange Online # Condition B: Verify that 'Monitor reported messages in Microsoft Teams' is checked in the Microsoft 365 Defender portal. # Condition C: Ensure the 'Send reported messages to' setting in the Microsoft 365 Defender portal is set to 'My reporting mailbox only' with the correct report email addresses. - $ReportSubmissionPolicy = Get-ReportSubmissionPolicy | Select-Object -Property ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, ReportPhishToCustomizedAddress, ReportChatMessageToCustomizedAddressEnabled + $ReportSubmissionPolicy = Get-ReportSubmissionPolicy | Select-Object -Property ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, ReportPhishToCustomizedAddress,ReportJunkAddresses,ReportNotJunkAddresses,ReportPhishAddresses,ReportChatMessageEnabled,ReportChatMessageToCustomizedAddressEnabled return $ReportSubmissionPolicy } default { throw "No match found for test: $Rec" } diff --git a/source/tests/Test-ReportSecurityInTeams.ps1 b/source/tests/Test-ReportSecurityInTeams.ps1 index 0247956..026b185 100644 --- a/source/tests/Test-ReportSecurityInTeams.ps1 +++ b/source/tests/Test-ReportSecurityInTeams.ps1 @@ -30,21 +30,51 @@ function Test-ReportSecurityInTeams { $ReportSubmissionPolicy.ReportJunkToCustomizedAddress -and $ReportSubmissionPolicy.ReportNotJunkToCustomizedAddress -and $ReportSubmissionPolicy.ReportPhishToCustomizedAddress -and - $ReportSubmissionPolicy.ReportChatMessageToCustomizedAddressEnabled + $null -ne $ReportSubmissionPolicy.ReportJunkAddresses -and + $null -ne $ReportSubmissionPolicy.ReportNotJunkAddresses -and + $null -ne $ReportSubmissionPolicy.ReportPhishAddresses -and + $ReportSubmissionPolicy.ReportChatMessageToCustomizedAddressEnabled -and + -not $ReportSubmissionPolicy.ReportChatMessageEnabled + $faildetailstring = @" +The following settings are required for users to report security concerns in Teams: + +MS Teams: +AllowSecurityEndUserReporting: True + +EXO: +ReportJunkToCustomizedAddress : True +ReportNotJunkToCustomizedAddress : True +ReportPhishToCustomizedAddress : True +ReportJunkAddresses : +ReportNotJunkAddresses : +ReportPhishAddresses : +ReportChatMessageEnabled : False +ReportChatMessageToCustomizedAddressEnabled : True +"@ + $detailsString = "Users cannot report security concerns in Teams due to one or more incorrect settings:`n`n" + + "MSTeams: AllowSecurityEndUserReporting: $($CsTeamsMessagingPolicy.AllowSecurityEndUserReporting); `n" + + "EXO: ReportJunkToCustomizedAddress: $($ReportSubmissionPolicy.ReportJunkToCustomizedAddress); `n" + + "EXO: ReportNotJunkToCustomizedAddress: $($ReportSubmissionPolicy.ReportNotJunkToCustomizedAddress); `n" + + "EXO: ReportPhishToCustomizedAddress: $($ReportSubmissionPolicy.ReportPhishToCustomizedAddress); `n" + + "EXO: ReportJunkAddresses: $($ReportSubmissionPolicy.ReportJunkAddresses -join ', '); `n" + + "EXO: ReportNotJunkAddresses: $($ReportSubmissionPolicy.ReportNotJunkAddresses -join ', '); `n" + + "EXO: ReportPhishAddresses: $($ReportSubmissionPolicy.ReportPhishAddresses -join ', '); `n" + + "EXO: ReportChatMessageEnabled: $($ReportSubmissionPolicy.ReportChatMessageEnabled); `n" + + "EXO: ReportChatMessageToCustomizedAddressEnabled: $($ReportSubmissionPolicy.ReportChatMessageToCustomizedAddressEnabled); " # Prepare failure reasons and details based on compliance $failureReasons = if (-not $securityReportEnabled) { - "Users cannot report security concerns in Teams due to one or more incorrect settings" + $detailsString } else { "N/A" } - - $details = "AllowSecurityEndUserReporting: $($CsTeamsMessagingPolicy.AllowSecurityEndUserReporting); " + - "ReportJunkToCustomizedAddress: $($ReportSubmissionPolicy.ReportJunkToCustomizedAddress); " + - "ReportNotJunkToCustomizedAddress: $($ReportSubmissionPolicy.ReportNotJunkToCustomizedAddress); " + - "ReportPhishToCustomizedAddress: $($ReportSubmissionPolicy.ReportPhishToCustomizedAddress); " + - "ReportChatMessageToCustomizedAddressEnabled: $($ReportSubmissionPolicy.ReportChatMessageToCustomizedAddressEnabled)" + $details = if ($securityReportEnabled) { + "Users can report security concerns in Teams." + } + else { + $faildetailstring + } # Create and populate the CISAuditResult object $params = @{