add: Get-CISSpoOutput function and updated respective tests
This commit is contained in:
@@ -34,7 +34,7 @@ function Test-DisallowInfectedFilesDownload {
|
||||
# - Condition C: Verification using the PowerShell command indicates that the setting is incorrectly configured.
|
||||
|
||||
# Retrieve the SharePoint tenant configuration
|
||||
$SPOTenantDisallowInfectedFileDownload = Get-SPOTenant | Select-Object DisallowInfectedFileDownload
|
||||
$SPOTenantDisallowInfectedFileDownload = Get-CISSpoOutput -Rec $recnum
|
||||
|
||||
# Condition A: The `DisallowInfectedFileDownload` setting is set to `True`
|
||||
$isDisallowInfectedFileDownloadEnabled = $SPOTenantDisallowInfectedFileDownload.DisallowInfectedFileDownload
|
||||
|
||||
@@ -34,7 +34,7 @@ function Test-GuestAccessExpiration {
|
||||
# - Condition C: Verification using the SharePoint Admin Center indicates that guest access is not set to expire automatically after the specified number of days.
|
||||
|
||||
# Retrieve SharePoint tenant settings related to guest access expiration
|
||||
$SPOTenantGuestAccess = Get-SPOTenant | Select-Object ExternalUserExpirationRequired, ExternalUserExpireInDays
|
||||
$SPOTenantGuestAccess = Get-CISSpoOutput -Rec $recnum
|
||||
$isGuestAccessExpirationConfiguredCorrectly = $SPOTenantGuestAccess.ExternalUserExpirationRequired -and $SPOTenantGuestAccess.ExternalUserExpireInDays -le 30
|
||||
|
||||
# Prepare failure reasons and details based on compliance
|
||||
|
||||
@@ -33,7 +33,7 @@ function Test-LinkSharingRestrictions {
|
||||
# - Condition C: Verification using the UI indicates that the link sharing settings are not configured as recommended.
|
||||
|
||||
# Retrieve link sharing configuration for SharePoint and OneDrive
|
||||
$SPOTenantLinkSharing = Get-SPOTenant | Select-Object DefaultSharingLinkType
|
||||
$SPOTenantLinkSharing = Get-CISSpoOutput -Rec $recnum
|
||||
$isLinkSharingRestricted = $SPOTenantLinkSharing.DefaultSharingLinkType -eq 'Direct' # Or 'SpecificPeople' as per the recommendation
|
||||
|
||||
# Prepare failure reasons and details based on compliance
|
||||
|
||||
@@ -33,7 +33,7 @@ function Test-ModernAuthSharePoint {
|
||||
process {
|
||||
try {
|
||||
# 7.2.1 (L1) Ensure modern authentication for SharePoint applications is required
|
||||
$SPOTenant = Get-SPOTenant | Select-Object -Property LegacyAuthProtocolsEnabled
|
||||
$SPOTenant = Get-CISSpoOutput -Rec $recnum
|
||||
$modernAuthForSPRequired = -not $SPOTenant.LegacyAuthProtocolsEnabled
|
||||
|
||||
# Prepare failure reasons and details based on compliance
|
||||
|
||||
@@ -34,7 +34,7 @@ function Test-OneDriveContentRestrictions {
|
||||
# 7.2.4 (L2) Ensure OneDrive content sharing is restricted
|
||||
|
||||
# Retrieve OneDrive sharing capability settings
|
||||
$SPOTenant = Get-SPOTenant | Select-Object OneDriveSharingCapability
|
||||
$SPOTenant = Get-CISSpoOutput -Rec $recnum
|
||||
$isOneDriveSharingRestricted = $SPOTenant.OneDriveSharingCapability -eq 'Disabled'
|
||||
|
||||
# Prepare failure reasons and details based on compliance
|
||||
|
||||
@@ -32,7 +32,7 @@ function Test-OneDriveSyncRestrictions {
|
||||
# - Condition C: "AllowedDomainList" does not contain the trusted domain GUIDs from the on-premises environment.
|
||||
|
||||
# Retrieve OneDrive sync client restriction settings
|
||||
$SPOTenantSyncClientRestriction = Get-SPOTenantSyncClientRestriction | Select-Object TenantRestrictionEnabled, AllowedDomainList
|
||||
$SPOTenantSyncClientRestriction = Get-CISSpoOutput -Rec $recnum
|
||||
$isSyncRestricted = $SPOTenantSyncClientRestriction.TenantRestrictionEnabled -and $SPOTenantSyncClientRestriction.AllowedDomainList
|
||||
|
||||
# Condition A: Check if TenantRestrictionEnabled is True
|
||||
|
||||
@@ -34,7 +34,7 @@ function Test-ReauthWithCode {
|
||||
# 7.2.10 (L1) Ensure reauthentication with verification code is restricted
|
||||
|
||||
# Retrieve reauthentication settings for SharePoint Online
|
||||
$SPOTenantReauthentication = Get-SPOTenant | Select-Object EmailAttestationRequired, EmailAttestationReAuthDays
|
||||
$SPOTenantReauthentication = Get-CISSpoOutput -Rec $recnum
|
||||
$isReauthenticationRestricted = $SPOTenantReauthentication.EmailAttestationRequired -and $SPOTenantReauthentication.EmailAttestationReAuthDays -le 15
|
||||
|
||||
# Prepare failure reasons and details based on compliance
|
||||
|
||||
@@ -32,7 +32,7 @@ function Test-RestrictCustomScripts {
|
||||
# - Condition C: Verification using the SharePoint Admin Center indicates that the `DenyAddAndCustomizePages` setting is not enforced.
|
||||
|
||||
# Retrieve all site collections and select necessary properties
|
||||
$SPOSitesCustomScript = Get-SPOSite -Limit All | Select-Object Title, Url, DenyAddAndCustomizePages
|
||||
$SPOSitesCustomScript = Get-CISSpoOutput -Rec $recnum
|
||||
|
||||
# Process URLs to replace 'sharepoint.com' with '<SPUrl>'
|
||||
$processedUrls = $SPOSitesCustomScript | ForEach-Object {
|
||||
|
||||
@@ -36,7 +36,7 @@ function Test-RestrictExternalSharing {
|
||||
# 7.2.3 (L1) Ensure external content sharing is restricted
|
||||
|
||||
# Retrieve the SharingCapability setting for the SharePoint tenant
|
||||
$SPOTenantSharingCapability = Get-SPOTenant | Select-Object SharingCapability
|
||||
$SPOTenantSharingCapability = Get-CISSpoOutput -Rec $recnum
|
||||
$isRestricted = $SPOTenantSharingCapability.SharingCapability -in @('ExternalUserSharingOnly', 'ExistingExternalUserSharingOnly', 'Disabled')
|
||||
|
||||
# Prepare failure reasons and details based on compliance
|
||||
|
||||
@@ -33,7 +33,7 @@ function Test-SharePointAADB2B {
|
||||
process {
|
||||
try {
|
||||
# 7.2.2 (L1) Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled
|
||||
$SPOTenantAzureADB2B = Get-SPOTenant | Select-Object EnableAzureADB2BIntegration
|
||||
$SPOTenantAzureADB2B = Get-CISSpoOutput -Rec $recnum
|
||||
|
||||
# Populate the auditResult object with the required properties
|
||||
$params = @{
|
||||
|
||||
@@ -33,7 +33,7 @@ function Test-SharePointExternalSharingDomains {
|
||||
process {
|
||||
try {
|
||||
# 7.2.6 (L2) Ensure SharePoint external sharing is managed through domain whitelist/blacklists
|
||||
$SPOTenant = Get-SPOTenant | Select-Object SharingDomainRestrictionMode, SharingAllowedDomainList
|
||||
$SPOTenant = Get-CISSpoOutput -Rec $recnum
|
||||
$isDomainRestrictionConfigured = $SPOTenant.SharingDomainRestrictionMode -eq 'AllowList'
|
||||
|
||||
# Populate the auditResult object with the required properties
|
||||
|
||||
@@ -33,7 +33,7 @@ function Test-SharePointGuestsItemSharing {
|
||||
process {
|
||||
try {
|
||||
# 7.2.5 (L2) Ensure that SharePoint guest users cannot share items they don't own
|
||||
$SPOTenant = Get-SPOTenant | Select-Object PreventExternalUsersFromResharing
|
||||
$SPOTenant = Get-CISSpoOutput -Rec $recnum
|
||||
$isGuestResharingPrevented = $SPOTenant.PreventExternalUsersFromResharing
|
||||
|
||||
# Populate the auditResult object with the required properties
|
||||
|
||||
Reference in New Issue
Block a user