vibecoding/M365FoundationsCISReport
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: Formatting Invoke-M365SecurityAudit

Browse Source
This commit is contained in:
DrIOS
2024-06-23 18:16:56 -05:00
parent e81395bb4c
commit 6dc52f5b89
1 changed files with 86 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files

167
source/Public/Invoke-M365SecurityAudit.ps1
View File

@@ -1,106 +1,111 @@
<# <#
.SYNOPSIS .SYNOPSIS
Invokes a security audit for Microsoft 365 environments. Invokes a security audit for Microsoft 365 environments.
.DESCRIPTION .DESCRIPTION
The Invoke-M365SecurityAudit cmdlet performs a comprehensive security audit based on the specified parameters. It allows auditing of various configurations and settings within a Microsoft 365 environment, such as compliance with CIS benchmarks. The Invoke-M365SecurityAudit cmdlet performs a comprehensive security audit based on the specified parameters. It allows auditing of various configurations and settings within a Microsoft 365 environment, such as compliance with CIS benchmarks.
.PARAMETER TenantAdminUrl .PARAMETER TenantAdminUrl
The URL of the tenant admin. If not specified, none of the SharePoint Online tests will run. The URL of the tenant admin. If not specified, none of the SharePoint Online tests will run.
.PARAMETER M365DomainForPWPolicyTest .PARAMETER M365DomainForPWPolicyTest
The domain name of the Microsoft 365 environment to test. This parameter is not mandatory and by default it will pass/fail all found domains as a group if a specific domain is not specified. The domain name of the Microsoft 365 environment to test. This parameter is not mandatory and by default it will pass/fail all found domains as a group if a specific domain is not specified.
.PARAMETER ELevel .PARAMETER ELevel
Specifies the E-Level (E3 or E5) for the audit. This parameter is optional and can be combined with the ProfileLevel parameter. Specifies the E-Level (E3 or E5) for the audit. This parameter is optional and can be combined with the ProfileLevel parameter.
.PARAMETER ProfileLevel .PARAMETER ProfileLevel
Specifies the profile level (L1 or L2) for the audit. This parameter is optional and can be combined with the ELevel parameter. Specifies the profile level (L1 or L2) for the audit. This parameter is optional and can be combined with the ELevel parameter.
.PARAMETER IncludeIG1 .PARAMETER IncludeIG1
If specified, includes tests where IG1 is true. If specified, includes tests where IG1 is true.
.PARAMETER IncludeIG2 .PARAMETER IncludeIG2
If specified, includes tests where IG2 is true. If specified, includes tests where IG2 is true.
.PARAMETER IncludeIG3 .PARAMETER IncludeIG3
If specified, includes tests where IG3 is true. If specified, includes tests where IG3 is true.
.PARAMETER IncludeRecommendation .PARAMETER IncludeRecommendation
Specifies specific recommendations to include in the audit. Accepts an array of recommendation numbers. Specifies specific recommendations to include in the audit. Accepts an array of recommendation numbers.
.PARAMETER SkipRecommendation .PARAMETER SkipRecommendation
Specifies specific recommendations to exclude from the audit. Accepts an array of recommendation numbers. Specifies specific recommendations to exclude from the audit. Accepts an array of recommendation numbers.
.PARAMETER DoNotConnect .PARAMETER DoNotConnect
If specified, the cmdlet will not establish a connection to Microsoft 365 services. If specified, the cmdlet will not establish a connection to Microsoft 365 services.
.PARAMETER DoNotDisconnect .PARAMETER DoNotDisconnect
If specified, the cmdlet will not disconnect from Microsoft 365 services after execution. If specified, the cmdlet will not disconnect from Microsoft 365 services after execution.
.PARAMETER NoModuleCheck .PARAMETER NoModuleCheck
If specified, the cmdlet will not check for the presence of required modules. If specified, the cmdlet will not check for the presence of required modules.
.PARAMETER DoNotConfirmConnections .PARAMETER DoNotConfirmConnections
If specified, the cmdlet will not prompt for confirmation before proceeding with established connections and will disconnect from all of them. If specified, the cmdlet will not prompt for confirmation before proceeding with established connections and will disconnect from all of them.
.EXAMPLE .EXAMPLE
PS> Invoke-M365SecurityAudit PS> Invoke-M365SecurityAudit
Performs a security audit using default parameters.
Output: Performs a security audit using default parameters.
Status : Fail Output:
ELevel : E3 Status : Fail
ProfileLevel: L1 ELevel : E3
Connection : Microsoft Graph ProfileLevel: L1
Rec : 1.1.1 Connection : Microsoft Graph
Result : False Rec : 1.1.1
Details : Non-compliant accounts: Result : False
Username | Roles | HybridStatus | Missing Licence Details : Non-compliant accounts:
user1@domain.com| Global Administrator | Cloud-Only | AAD_PREMIUM Username | Roles | HybridStatus | Missing Licence
user2@domain.com| Global Administrator | Hybrid | AAD_PREMIUM, AAD_PREMIUM_P2 user1@domain.com| Global Administrator | Cloud-Only | AAD_PREMIUM
FailureReason: Non-Compliant Accounts: 2 user2@domain.com| Global Administrator | Hybrid | AAD_PREMIUM, AAD_PREMIUM_P2
FailureReason: Non-Compliant Accounts: 2
.EXAMPLE .EXAMPLE
PS> Invoke-M365SecurityAudit -TenantAdminUrl "https://contoso-admin.sharepoint.com" -M365DomainForPWPolicyTest "contoso.com" -ELevel "E5" -ProfileLevel "L1" PS> Invoke-M365SecurityAudit -TenantAdminUrl "https://contoso-admin.sharepoint.com" -M365DomainForPWPolicyTest "contoso.com" -ELevel "E5" -ProfileLevel "L1"
Performs a security audit for the E5 level and L1 profile in the specified Microsoft 365 environment.
Output: Performs a security audit for the E5 level and L1 profile in the specified Microsoft 365 environment.
Status : Fail Output:
ELevel : E5 Status : Fail
ProfileLevel: L1 ELevel : E5
Connection : Microsoft Graph ProfileLevel: L1
Rec : 1.1.1 Connection : Microsoft Graph
Result : False Rec : 1.1.1
Details : Non-compliant accounts: Result : False
Username | Roles | HybridStatus | Missing Licence Details : Non-compliant accounts:
user1@domain.com| Global Administrator | Cloud-Only | AAD_PREMIUM Username | Roles | HybridStatus | Missing Licence
user2@domain.com| Global Administrator | Hybrid | AAD_PREMIUM, AAD_PREMIUM_P2 user1@domain.com| Global Administrator | Cloud-Only | AAD_PREMIUM
FailureReason: Non-Compliant Accounts: 2 user2@domain.com| Global Administrator | Hybrid | AAD_PREMIUM, AAD_PREMIUM_P2
FailureReason: Non-Compliant Accounts: 2
.EXAMPLE .EXAMPLE
PS> Invoke-M365SecurityAudit -TenantAdminUrl "https://contoso-admin.sharepoint.com" -M365DomainForPWPolicyTest "contoso.com" -IncludeIG1 PS> Invoke-M365SecurityAudit -TenantAdminUrl "https://contoso-admin.sharepoint.com" -M365DomainForPWPolicyTest "contoso.com" -IncludeIG1
Performs an audit including all tests where IG1 is true.
Output: Performs an audit including all tests where IG1 is true.
Status : Fail Output:
ELevel : E3 Status : Fail
ProfileLevel: L1 ELevel : E3
Connection : Microsoft Graph ProfileLevel: L1
Rec : 1.1.1 Connection : Microsoft Graph
Result : False Rec : 1.1.1
Details : Non-compliant accounts: Result : False
Username | Roles | HybridStatus | Missing Licence Details : Non-compliant accounts:
user1@domain.com| Global Administrator | Cloud-Only | AAD_PREMIUM Username | Roles | HybridStatus | Missing Licence
user2@domain.com| Global Administrator | Hybrid | AAD_PREMIUM, AAD_PREMIUM_P2 user1@domain.com| Global Administrator | Cloud-Only | AAD_PREMIUM
FailureReason: Non-Compliant Accounts: 2 user2@domain.com| Global Administrator | Hybrid | AAD_PREMIUM, AAD_PREMIUM_P2
FailureReason: Non-Compliant Accounts: 2
.EXAMPLE .EXAMPLE
PS> Invoke-M365SecurityAudit -TenantAdminUrl "https://contoso-admin.sharepoint.com" -M365DomainForPWPolicyTest "contoso.com" -SkipRecommendation '1.1.3', '2.1.1' PS> Invoke-M365SecurityAudit -TenantAdminUrl "https://contoso-admin.sharepoint.com" -M365DomainForPWPolicyTest "contoso.com" -SkipRecommendation '1.1.3', '2.1.1'
Performs an audit while excluding specific recommendations 1.1.3 and 2.1.1. Performs an audit while excluding specific recommendations 1.1.3 and 2.1.1.
Output: Output:
Status : Fail Status : Fail
ELevel : E3 ELevel : E3
ProfileLevel: L1 ProfileLevel: L1
Connection : Microsoft Graph Connection : Microsoft Graph
Rec : 1.1.1 Rec : 1.1.1
Result : False Result : False
Details : Non-compliant accounts: Details : Non-compliant accounts:
Username | Roles | HybridStatus | Missing Licence Username | Roles | HybridStatus | Missing Licence
user1@domain.com| Global Administrator | Cloud-Only | AAD_PREMIUM user1@domain.com| Global Administrator | Cloud-Only | AAD_PREMIUM
user2@domain.com| Global Administrator | Hybrid | AAD_PREMIUM, AAD_PREMIUM_P2 user2@domain.com| Global Administrator | Hybrid | AAD_PREMIUM, AAD_PREMIUM_P2
FailureReason: Non-Compliant Accounts: 2 FailureReason: Non-Compliant Accounts: 2
.EXAMPLE .EXAMPLE
PS> $auditResults = Invoke-M365SecurityAudit -TenantAdminUrl "https://contoso-admin.sharepoint.com" -M365DomainForPWPolicyTest "contoso.com" PS> $auditResults = Invoke-M365SecurityAudit -TenantAdminUrl "https://contoso-admin.sharepoint.com" -M365DomainForPWPolicyTest "contoso.com"
PS> $auditResults | Export-Csv -Path "auditResults.csv" -NoTypeInformation PS> $auditResults | Export-Csv -Path "auditResults.csv" -NoTypeInformation
Captures the audit results into a variable and exports them to a CSV file.
Output: Captures the audit results into a variable and exports them to a CSV file.
CISAuditResult[] Output:
auditResults.csv CISAuditResult[]
auditResults.csv
.EXAMPLE .EXAMPLE
PS> Invoke-M365SecurityAudit -WhatIf PS> Invoke-M365SecurityAudit -WhatIf
Displays what would happen if the cmdlet is run without actually performing the audit.
Output: Displays what would happen if the cmdlet is run without actually performing the audit.
What if: Performing the operation "Invoke-M365SecurityAudit" on target "Microsoft 365 environment". Output:
What if: Performing the operation "Invoke-M365SecurityAudit" on target "Microsoft 365 environment".
.INPUTS .INPUTS
None. You cannot pipe objects to Invoke-M365SecurityAudit. None. You cannot pipe objects to Invoke-M365SecurityAudit.
.OUTPUTS .OUTPUTS