53 lines
1.4 KiB
Markdown
53 lines
1.4 KiB
Markdown
# Automation Candidates
|
|
|
|
## 5.1.1.1 (L1) Ensure Security Defaults is disabled on Azure Active Directory
|
|
|
|
- `Connect-MgGraph -Scopes "Policy.Read.All"`
|
|
- `Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy | ft IsEnabled`
|
|
|
|
## 5.1.2.1 (L1) Ensure 'Per-user MFA' is disabled
|
|
|
|
- `Connect-MsolService`
|
|
- Commands:
|
|
|
|
```powershell
|
|
$UserList = Get-MsolUser -All | Where-Object { $_.UserType -eq 'Member' }
|
|
$Report = @()
|
|
foreach ($user in $UserList) {
|
|
$PerUserMFAState = $null
|
|
if ($user.StrongAuthenticationRequirements) {
|
|
$PerUserMFAState = $user.StrongAuthenticationRequirements.State
|
|
}
|
|
else {
|
|
$PerUserMFAState = 'Disabled'
|
|
}
|
|
$obj = [pscustomobject][ordered]@{
|
|
UserPrincipalName = $User.UserPrincipalName
|
|
DisplayName = $User.DisplayName
|
|
PerUserMFAState = $PerUserMFAState
|
|
}
|
|
$Report += $obj
|
|
}
|
|
$Report
|
|
```
|
|
|
|
## 5.1.3.1 (L1) Ensure a dynamic group for guest users is created
|
|
|
|
- `Connect-MgGraph -Scopes "Group.Read.All"`
|
|
- Commands:
|
|
|
|
```powershell
|
|
$groups = Get-MgGroup | Where-Object { $_.GroupTypes -contains "DynamicMembership" }
|
|
$groups | ft DisplayName,GroupTypes,MembershipRule
|
|
```
|
|
|
|
## 6.1.4 (L1) Ensure 'AuditBypassEnabled' is not enabled on mailboxes
|
|
|
|
- `Connect-ExchangeOnline`
|
|
- Commands:
|
|
|
|
```powershell
|
|
$MBX = Get-MailboxAuditBypassAssociation -ResultSize unlimited
|
|
$MBX | where {$_.AuditBypassEnabled -eq $true} | Format-Table Name,AuditBypassEnabled
|
|
```
|