Public Groups Managed

<# .SYNOPSIS Public Groups Managed .DESCRIPTION Identifies public M365 groups that may expose sensitive information .NOTES NL Baseline v2.0 #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Public Groups Management" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "Group.Read.All" -ErrorAction Stop -NoWelcome $publicGroups = Get-MgGroup -All -Filter "visibility eq 'Public'" -ErrorAction Stop $result = @{ isCompliant = ($publicGroups.Count -eq 0) totalPublicGroups = $publicGroups.Count groups = @() } Write-Host " Total Public Groups: $($result.totalPublicGroups)" -ForegroundColor $( if ($result.totalPublicGroups -eq 0) { 'Green' }else { 'Yellow' } ) if ($publicGroups.Count -gt 0) { Write-Host "`n Public Groups Found:" -ForegroundColor Yellow $publicGroups | Select-Object -First 20 | ForEach-Object { Write-Host " • $($_.DisplayName)" -ForegroundColor Gray Write-Host " Members: $($_.MembersCount) | Type: $($_.GroupTypes -join ', ')" -ForegroundColor Cyan $result.groups += $_.DisplayName } if ($publicGroups.Count -gt 20) { Write-Host " ... and $($publicGroups.Count - 20) more" -ForegroundColor Gray } } Write-Host "`n Security Recommendations:" -ForegroundColor Cyan Write-Host " • Review all public groups" -ForegroundColor Gray Write-Host " • Set to Private if sensitive data exists" -ForegroundColor Gray Write-Host " • Public = anyone in org can discover and join" -ForegroundColor Gray if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - No public groups" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ REVIEW REQUIRED - Public groups exist" -ForegroundColor Yellow Write-Host "Change to Private in: Azure AD > Groups > Settings" -ForegroundColor Gray exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }