BYOD Enrollment Geblokkeerd

<# .SYNOPSIS BYOD Enrollment Blocked .DESCRIPTION Device enrollment restrictions in Intune must block personal device enrollment for all platforms. .NOTES Filename: byod-enrollment-blocked.ps1 Author: Nederlandse Baseline voor Veilige Cloud Version: 2.0 Related JSON: content/m365/device-compliance/byod-enrollment-blocked.json #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()]param([switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "BYOD Enrollment Blocked" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Monitoring:" -ForegroundColor Yellow Connect-MgGraph -Scopes "DeviceManagementServiceConfig.Read.All" -ErrorAction Stop $restrictions = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations" -ErrorAction Stop $result = @{ isCompliant = $false totalRestrictions = $restrictions.value.Count byodBlockedCount = 0 restrictionDetails = @() } if ($restrictions.value.Count -eq 0) { Write-Host " No enrollment restrictions found" -ForegroundColor Red } else { Write-Host "`n Enrollment Restrictions:" -ForegroundColor Cyan foreach ($restriction in $restrictions.value) { if ($restriction.'@odata.type' -eq '#microsoft.graph.deviceEnrollmentPlatformRestrictionsConfiguration') { $platformRestrictions = $restriction.platformRestriction # Check if personal devices are blocked for key platforms $iosPersonalBlocked = $platformRestrictions.iosRestriction.personalDeviceEnrollmentBlocked -eq $true $androidPersonalBlocked = $platformRestrictions.androidRestriction.personalDeviceEnrollmentBlocked -eq $true $windowsPersonalBlocked = $platformRestrictions.windowsRestriction.personalDeviceEnrollmentBlocked -eq $true if ($iosPersonalBlocked -and $androidPersonalBlocked -and $windowsPersonalBlocked) { $result.byodBlockedCount++ $result.isCompliant = $true Write-Host " COMPLIANT: $($restriction.displayName)" -ForegroundColor Green Write-Host " iOS Personal: Blocked" -ForegroundColor Gray Write-Host " Android Personal: Blocked" -ForegroundColor Gray Write-Host " Windows Personal: Blocked" -ForegroundColor Gray } else { Write-Host " NOT FULLY RESTRICTED: $($restriction.displayName)" -ForegroundColor Yellow Write-Host " iOS Personal: $(if($iosPersonalBlocked){'Blocked'}else{'Allowed'})" -ForegroundColor Gray Write-Host " Android Personal: $(if($androidPersonalBlocked){'Blocked'}else{'Allowed'})" -ForegroundColor Gray Write-Host " Windows Personal: $(if($windowsPersonalBlocked){'Blocked'}else{'Allowed'})" -ForegroundColor Gray } } } } Write-Host "`n Summary: $($result.totalRestrictions) restrictions | $($result.byodBlockedCount) fully blocking BYOD" -ForegroundColor Cyan if ($result.isCompliant) { Write-Host "`nCOMPLIANT: BYOD enrollment blocked" -ForegroundColor Green exit 0 } else { Write-Host "`nNON-COMPLIANT: BYOD enrollment not fully blocked" -ForegroundColor Red exit 1 } } catch { Write-Host "`nERROR: $_" -ForegroundColor Red Write-Host " Configure in: Intune > Devices > Enroll devices > Enrollment restrictions" -ForegroundColor Yellow exit 2 } } function Invoke-Remediation { try { Write-Host "Remediation:" -ForegroundColor Yellow Write-Host " Manual configuration required in Microsoft Endpoint Manager:" -ForegroundColor Yellow Write-Host " 1. Go to Endpoint Manager > Devices > Enroll devices > Enrollment restrictions" -ForegroundColor Gray Write-Host " 2. Select or create Device type restrictions" -ForegroundColor Gray Write-Host " 3. For iOS, Android, Windows: Set 'Allow personally owned' to Block" -ForegroundColor Gray Write-Host " 4. Assign to All Users" -ForegroundColor Gray exit 0 } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { try { Write-Host "Revert:" -ForegroundColor Yellow Write-Host " Manual configuration required in Microsoft Endpoint Manager" -ForegroundColor Yellow Write-Host " Set 'Allow personally owned' to Allow for platforms" -ForegroundColor Gray exit 0 } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Revert) { Invoke-Revert } elseif ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring | -Remediation | -Revert" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }