vibecoding/M365FoundationsCISReport
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: SPO formatting and output

Browse Source
This commit is contained in:
DrIOS
2024-07-02 09:47:06 -05:00
parent 5ef32eb4b8
commit 5d11b46d96
7 changed files with 106 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
source/tests/Test-OneDriveSyncRestrictions.ps1
View File

@@ -5,14 +5,13 @@ function Test-OneDriveSyncRestrictions {
# Aligned
# Define your parameters here
)
begin {
# Dot source the class script if necessary
#. .\source\Classes\CISAuditResult.ps1
# Initialization code, if needed
$recnum = "7.3.2"
Write-Verbose "Running Test-OneDriveSyncRestrictions for $recnum..."
}
process {
try {
# 7.3.2 (L2) Ensure OneDrive sync is restricted for unmanaged devices
@@ -30,20 +29,20 @@ function Test-OneDriveSyncRestrictions {
# - Condition A: "Allow syncing only on computers joined to specific domains" is not enabled.
# - Condition B: "TenantRestrictionEnabled" is set to False.
# - Condition C: "AllowedDomainList" does not contain the trusted domain GUIDs from the on-premises environment.
# Retrieve OneDrive sync client restriction settings
$SPOTenantSyncClientRestriction = Get-CISSpoOutput -Rec $recnum
$isSyncRestricted = $SPOTenantSyncClientRestriction.TenantRestrictionEnabled -and $SPOTenantSyncClientRestriction.AllowedDomainList
# Condition A: Check if TenantRestrictionEnabled is True
# Condition B: Ensure AllowedDomainList contains trusted domains GUIDs
$failureReasons = if (-not $isSyncRestricted) {
"OneDrive sync is not restricted to managed devices. TenantRestrictionEnabled should be True and AllowedDomainList should contain trusted domains GUIDs."
"OneDrive sync is not restricted to managed devices. For hybrid devices, TenantRestrictionEnabled should be True and AllowedDomainList should contain trusted domains GUIDs.`n" + `
"To remediate this setting, edit and use the Set-SPOTenantSyncClientRestriction command below:`n" + `
"Set-SPOTenantSyncClientRestriction -TenantRestrictionEnabled `$true -AllowedDomainList `"<GUID1>`",`"<GUID2>`"`n`n" + `
"Note: Utilize the -BlockMacSync:`$true parameter if you are not using conditional access to ensure Macs cannot sync."
}
else {
"N/A"
}
# Condition C: Prepare details based on whether sync is restricted
$details = if ($isSyncRestricted) {
"OneDrive sync is restricted for unmanaged devices."
@@ -51,7 +50,6 @@ function Test-OneDriveSyncRestrictions {
else {
"TenantRestrictionEnabled: $($SPOTenantSyncClientRestriction.TenantRestrictionEnabled); AllowedDomainList: $($SPOTenantSyncClientRestriction.AllowedDomainList -join ', ')"
}
# Create and populate the CISAuditResult object
$params = @{
Rec = $recnum
@@ -67,7 +65,6 @@ function Test-OneDriveSyncRestrictions {
$auditResult = Get-TestError -LastError $LastError -recnum $recnum
}
}
end {
# Return auditResult
return $auditResult