Access Reviews Design

<# .SYNOPSIS Access Reviews Design .DESCRIPTION Access reviews: Guests (quarterly by resource owners), privileged roles (monthly by Security + Manager), sensitive groups (quarterly by group owners), app assignments (yearly by app owners), auto-remove if not approved. .NOTES Filename: access-reviews.ps1 Author: Nederlandse Baseline voor Veilige Cloud Created: 2025-10-15 Last Modified: 2025-10-15 Version: 1.0 Related JSON: content/design/identity/access-reviews.json Category: identity Workload: design .LINK https://github.com/m365-tenant-best-practise .EXAMPLE .\access-reviews.ps1 -Monitoring Check compliance status .EXAMPLE .\access-reviews.ps1 -Remediation Apply configuration #> #Requires -Version 5.1 [CmdletBinding()] param( [Parameter()] [switch]$Monitoring, [Parameter()] [switch]$Remediation, [Parameter()] [switch]$Revert, [Parameter()] [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host " ========================================" -ForegroundColor Cyan Write-Host "Access Reviews Design" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "======================================== " -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Test-Compliance { <# .SYNOPSIS Tests if current configuration is compliant #> [CmdletBinding()] param() return Invoke-Monitoring } function Invoke-Monitoring { <# .SYNOPSIS Monitors current configuration status #> [CmdletBinding()] param() Write-Host " Monitoring:" -ForegroundColor Yellow # Design document - no API calls # Use global customer name set by Run-Controls.ps1 $modulesPath = Join-Path (Split-Path (Split-Path (Split-Path $global:PSScriptRoot -Parent) -Parent) -Parent) "Customers\$global:CustomerName\modules.json" if (Test-Path $modulesPath) { $modules = Get-Content $modulesPath -Raw | ConvertFrom-Json $breakGlassIds = $modules.'customer-settings'.'break-glass-accounts'.objectID $foundAccounts = @() foreach ($id in $breakGlassIds) { try { $user = Get-MgUser -UserId $id -ErrorAction SilentlyContinue if ($user) { $foundAccounts += $user } } catch {} } @{ isCompliant = ($foundAccounts.Count -ge 2) definedAccounts = $breakGlassIds.Count foundAccounts = $foundAccounts.Count accounts = $foundAccounts.UserPrincipalName } } else { @{ isCompliant = $false message = "modules.json not found at: $modulesPath" } } } function Invoke-Remediation { <# .SYNOPSIS Applies recommended configuration #> [CmdletBinding()] param() Write-Host " Remediation:" -ForegroundColor Yellow # Design document - no API calls # Manual: Create 2 emergency access accounts and add ObjectIDs to modules.json under customer-settings.break-glass-accounts.objectID } function Invoke-Revert { <# .SYNOPSIS Reverts configuration to previous state #> [CmdletBinding()] param() Write-Host " Revert:" -ForegroundColor Yellow Write-Host "Reverting configuration..." -ForegroundColor Yellow Write-Host "Manual revert required - see JSON documentation" -ForegroundColor Gray } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Revert) { if ($WhatIf) { Write-Host "WhatIf: Would revert configuration" -ForegroundColor Yellow } else { Invoke-Revert } } elseif ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { if ($WhatIf) { Write-Host "WhatIf: Would apply remediation" -ForegroundColor Yellow } else { Invoke-Remediation } } else { Write-Host "Available parameters:" -ForegroundColor Yellow Write-Host " -Monitoring : Check current status" -ForegroundColor Gray Write-Host " -Remediation : Apply configuration" -ForegroundColor Gray Write-Host " -Revert : Revert changes" -ForegroundColor Gray Write-Host " -WhatIf : Show what would happen" -ForegroundColor Gray } } catch { Write-Error "Error: $_" throw } finally { Write-Host " ======================================== " -ForegroundColor Cyan }