Priority Account Bescherming

<# .SYNOPSIS Priority Account Protection Configuration .DESCRIPTION Ensures VIP/priority accounts are tagged and receive enhanced protection. Priority accounts (executives, board) are high-value targets. .NOTES Filename: priority-account-protection.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Microsoft Defender for Office 365 Plan 2 .EXAMPLE .\priority-account-protection.ps1 -Monitoring Check priority account configuration #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Priority Account Protection" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "⚠️ Priority accounts require manual verification in Security Portal" -ForegroundColor Yellow Write-Host "`nTo check:" -ForegroundColor Cyan Write-Host " 1. Microsoft 365 Defender Portal (security.microsoft.com)" -ForegroundColor Gray Write-Host " 2. Email & collaboration > Policies & rules" -ForegroundColor Gray Write-Host " 3. Threat policies > Priority accounts" -ForegroundColor Gray Write-Host "`nWho should be priority accounts?" -ForegroundColor Cyan Write-Host " • C-level executives (CEO, CFO, CISO)" -ForegroundColor Gray Write-Host " • Board of directors" -ForegroundColor Gray Write-Host " • Executive assistants" -ForegroundColor Gray Write-Host " • Legal team leads" -ForegroundColor Gray Write-Host " • Anyone regularly targeted by attackers" -ForegroundColor Gray Write-Host "`nBenefits:" -ForegroundColor Cyan Write-Host " • Enhanced visibility in security dashboards" -ForegroundColor Gray Write-Host " • Priority in threat investigation" -ForegroundColor Gray Write-Host " • Additional protection policies" -ForegroundColor Gray Write-Host " • Alert aggregation for VIPs" -ForegroundColor Gray Write-Host "`nBest practice: 10-50 priority accounts" -ForegroundColor Cyan Write-Host "`n⚠️ Manual verification required" -ForegroundColor Yellow exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow Write-Host "`nNote: Priority accounts tagged in Microsoft 365 Defender Portal" -ForegroundColor Cyan } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Note: This is a monitoring-only control, remediation delegates to monitoring #> [CmdletBinding()] param() Write-Host "[INFO] This is a monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check instead..." -ForegroundColor Cyan Invoke-Monitoring }