Admin Consent Workflow Ingeschakeld

<# .SYNOPSIS Admin Consent Workflow Enabled .DESCRIPTION Ensures admin consent workflow is enabled so users can request admin approval for apps. Provides visibility and control over app permissions. .NOTES Filename: admin-consent-workflow-enabled.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\admin-consent-workflow-enabled.ps1 -Monitoring Check if admin consent workflow is enabled #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Admin Consent Workflow" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Admin Consent Workflow Enabled .DESCRIPTION Ensures admin consent workflow is enabled so users can request admin approval for apps. Provides visibility and control over app permissions. .NOTES Filename: admin-consent-workflow-enabled.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\admin-consent-workflow-enabled.ps1 -Monitoring Check if admin consent workflow is enabled #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Admin Consent Workflow" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking admin consent request policy..." -ForegroundColor Gray $consentPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/adminConsentRequestPolicy" $isEnabled = $consentPolicy.isEnabled -eq $true if ($isEnabled) { Write-Host " [OK] Admin Consent Workflow: ENABLED" -ForegroundColor Green if ($consentPolicy.notifyReviewers) { Write-Host " Reviewers notified: YES" -ForegroundColor Cyan } if ($consentPolicy.reviewers) { Write-Host " Number of reviewers configured: $($consentPolicy.reviewers.Count)" -ForegroundColor Cyan } Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host " [FAIL] Admin Consent Workflow: DISABLED" -ForegroundColor Red Write-Host " Users cannot request admin approval" -ForegroundColor Red Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red exit 1 } } catch { Write-Host "`n⚠️ Admin consent workflow may need manual configuration" -ForegroundColor Yellow Write-Host "Configure in: Azure AD > Enterprise applications > Consent and permissions" -ForegroundColor Gray exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Admin consent workflow configuration via API has limitations" -ForegroundColor Yellow Write-Host "`nManual steps to enable:" -ForegroundColor Cyan Write-Host " 1. Azure Portal > Azure Active Directory" -ForegroundColor Gray Write-Host " 2. Enterprise applications > Consent and permissions" -ForegroundColor Gray Write-Host " 3. Admin consent requests > Click 'Users can request...' = Yes" -ForegroundColor Gray Write-Host " 4. Select reviewers (Global Admins or specific users)" -ForegroundColor Gray Write-Host " 5. Set request expiration (default: 30 days)" -ForegroundColor Gray Write-Host " 6. Enable email notifications" -ForegroundColor Gray Write-Host " 7. Save changes" -ForegroundColor Gray Write-Host "`n📝 Benefits:" -ForegroundColor Cyan Write-Host " • Visibility into app permission requests" -ForegroundColor Gray Write-Host " • Controlled approval process" -ForegroundColor Gray Write-Host " • Reduces shadow IT" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking admin consent request policy..." -ForegroundColor Gray $consentPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/adminConsentRequestPolicy" $isEnabled = $consentPolicy.isEnabled -eq $true if ($isEnabled) { Write-Host " [OK] Admin Consent Workflow: ENABLED" -ForegroundColor Green if ($consentPolicy.notifyReviewers) { Write-Host " Reviewers notified: YES" -ForegroundColor Cyan } if ($consentPolicy.reviewers) { Write-Host " Number of reviewers configured: $($consentPolicy.reviewers.Count)" -ForegroundColor Cyan } Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host " [FAIL] Admin Consent Workflow: DISABLED" -ForegroundColor Red Write-Host " Users cannot request admin approval" -ForegroundColor Red Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red exit 1 } } catch { Write-Host "`n⚠️ Admin consent workflow may need manual configuration" -ForegroundColor Yellow Write-Host "Configure in: Azure AD > Enterprise applications > Consent and permissions" -ForegroundColor Gray exit 2 } } function Invoke-Remediation { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Admin Consent Workflow Enabled .DESCRIPTION Ensures admin consent workflow is enabled so users can request admin approval for apps. Provides visibility and control over app permissions. .NOTES Filename: admin-consent-workflow-enabled.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\admin-consent-workflow-enabled.ps1 -Monitoring Check if admin consent workflow is enabled #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Admin Consent Workflow" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking admin consent request policy..." -ForegroundColor Gray $consentPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/adminConsentRequestPolicy" $isEnabled = $consentPolicy.isEnabled -eq $true if ($isEnabled) { Write-Host " [OK] Admin Consent Workflow: ENABLED" -ForegroundColor Green if ($consentPolicy.notifyReviewers) { Write-Host " Reviewers notified: YES" -ForegroundColor Cyan } if ($consentPolicy.reviewers) { Write-Host " Number of reviewers configured: $($consentPolicy.reviewers.Count)" -ForegroundColor Cyan } Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host " [FAIL] Admin Consent Workflow: DISABLED" -ForegroundColor Red Write-Host " Users cannot request admin approval" -ForegroundColor Red Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red exit 1 } } catch { Write-Host "`n⚠️ Admin consent workflow may need manual configuration" -ForegroundColor Yellow Write-Host "Configure in: Azure AD > Enterprise applications > Consent and permissions" -ForegroundColor Gray exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Admin consent workflow configuration via API has limitations" -ForegroundColor Yellow Write-Host "`nManual steps to enable:" -ForegroundColor Cyan Write-Host " 1. Azure Portal > Azure Active Directory" -ForegroundColor Gray Write-Host " 2. Enterprise applications > Consent and permissions" -ForegroundColor Gray Write-Host " 3. Admin consent requests > Click 'Users can request...' = Yes" -ForegroundColor Gray Write-Host " 4. Select reviewers (Global Admins or specific users)" -ForegroundColor Gray Write-Host " 5. Set request expiration (default: 30 days)" -ForegroundColor Gray Write-Host " 6. Enable email notifications" -ForegroundColor Gray Write-Host " 7. Save changes" -ForegroundColor Gray Write-Host "`n📝 Benefits:" -ForegroundColor Cyan Write-Host " • Visibility into app permission requests" -ForegroundColor Gray Write-Host " • Controlled approval process" -ForegroundColor Gray Write-Host " • Reduces shadow IT" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ Admin consent workflow configuration via API has limitations" -ForegroundColor Yellow Write-Host "`nManual steps to enable:" -ForegroundColor Cyan Write-Host " 1. Azure Portal > Azure Active Directory" -ForegroundColor Gray Write-Host " 2. Enterprise applications > Consent and permissions" -ForegroundColor Gray Write-Host " 3. Admin consent requests > Click 'Users can request...' = Yes" -ForegroundColor Gray Write-Host " 4. Select reviewers (Global Admins or specific users)" -ForegroundColor Gray Write-Host " 5. Set request expiration (default: 30 days)" -ForegroundColor Gray Write-Host " 6. Enable email notifications" -ForegroundColor Gray Write-Host " 7. Save changes" -ForegroundColor Gray Write-Host "`n📝 Benefits:" -ForegroundColor Cyan Write-Host " • Visibility into app permission requests" -ForegroundColor Gray Write-Host " • Controlled approval process" -ForegroundColor Gray Write-Host " • Reduces shadow IT" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Admin Consent Workflow Enabled .DESCRIPTION Ensures admin consent workflow is enabled so users can request admin approval for apps. Provides visibility and control over app permissions. .NOTES Filename: admin-consent-workflow-enabled.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\admin-consent-workflow-enabled.ps1 -Monitoring Check if admin consent workflow is enabled #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Admin Consent Workflow" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking admin consent request policy..." -ForegroundColor Gray $consentPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/adminConsentRequestPolicy" $isEnabled = $consentPolicy.isEnabled -eq $true if ($isEnabled) { Write-Host " [OK] Admin Consent Workflow: ENABLED" -ForegroundColor Green if ($consentPolicy.notifyReviewers) { Write-Host " Reviewers notified: YES" -ForegroundColor Cyan } if ($consentPolicy.reviewers) { Write-Host " Number of reviewers configured: $($consentPolicy.reviewers.Count)" -ForegroundColor Cyan } Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host " [FAIL] Admin Consent Workflow: DISABLED" -ForegroundColor Red Write-Host " Users cannot request admin approval" -ForegroundColor Red Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red exit 1 } } catch { Write-Host "`n⚠️ Admin consent workflow may need manual configuration" -ForegroundColor Yellow Write-Host "Configure in: Azure AD > Enterprise applications > Consent and permissions" -ForegroundColor Gray exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Admin consent workflow configuration via API has limitations" -ForegroundColor Yellow Write-Host "`nManual steps to enable:" -ForegroundColor Cyan Write-Host " 1. Azure Portal > Azure Active Directory" -ForegroundColor Gray Write-Host " 2. Enterprise applications > Consent and permissions" -ForegroundColor Gray Write-Host " 3. Admin consent requests > Click 'Users can request...' = Yes" -ForegroundColor Gray Write-Host " 4. Select reviewers (Global Admins or specific users)" -ForegroundColor Gray Write-Host " 5. Set request expiration (default: 30 days)" -ForegroundColor Gray Write-Host " 6. Enable email notifications" -ForegroundColor Gray Write-Host " 7. Save changes" -ForegroundColor Gray Write-Host "`n📝 Benefits:" -ForegroundColor Cyan Write-Host " • Visibility into app permission requests" -ForegroundColor Gray Write-Host " • Controlled approval process" -ForegroundColor Gray Write-Host " • Reduces shadow IT" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }