B2b Collaboration Restricted Domains

<# .SYNOPSIS B2B Collaboration Restricted to Approved Domains .DESCRIPTION Ensures B2B guest invitations are restricted to specific approved domains or require admin approval. Prevents unrestricted external collaboration that could lead to data exposure. .NOTES Filename: b2b-collaboration-restricted-domains.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\b2b-collaboration-restricted-domains.ps1 -Monitoring Check B2B collaboration settings .EXAMPLE .\b2b-collaboration-restricted-domains.ps1 -Remediation Restrict B2B invitations to admins only #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "B2B Collaboration Restricted" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { <# .SYNOPSIS Checks who can invite external users #> function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS B2B Collaboration Restricted to Approved Domains .DESCRIPTION Ensures B2B guest invitations are restricted to specific approved domains or require admin approval. Prevents unrestricted external collaboration that could lead to data exposure. .NOTES Filename: b2b-collaboration-restricted-domains.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\b2b-collaboration-restricted-domains.ps1 -Monitoring Check B2B collaboration settings .EXAMPLE .\b2b-collaboration-restricted-domains.ps1 -Remediation Restrict B2B invitations to admins only #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "B2B Collaboration Restricted" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { <# .SYNOPSIS Checks who can invite external users #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authorization policy..." -ForegroundColor Gray $policy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" $allowInvitesFrom = $policy.allowInvitesFrom $allowEmailSubscriptions = $policy.defaultUserRolePermissions.allowedToSignUpEmailBasedSubscriptions $result = @{ isCompliant = $true allowInvitesFrom = $allowInvitesFrom allowEmailSubscriptions = $allowEmailSubscriptions } Write-Host "`n B2B Invitation Settings:" -ForegroundColor Cyan Write-Host " Who can invite guests: $allowInvitesFrom" -ForegroundColor $( switch ($allowInvitesFrom) { 'none' { 'Green' } # Most restrictive 'adminsAndGuestInviters' { 'Green' } # Admins only 'adminsGuestInvitersAndAllMembers' { 'Yellow' } # All members 'everyone' { 'Red' } # Everyone including guests default { 'Gray' } } ) Write-Host "`n Settings explanation:" -ForegroundColor Cyan Write-Host " • none = No B2B invitations" -ForegroundColor Gray Write-Host " • adminsAndGuestInviters = Admins only [OK]" -ForegroundColor Gray Write-Host " • adminsGuestInvitersAndAllMembers = All members ⚠️" -ForegroundColor Gray Write-Host " • everyone = Everyone (guests too) [FAIL]" -ForegroundColor Gray Write-Host "`n Email-based Subscriptions: $( if ($allowEmailSubscriptions) { 'ALLOWED ⚠️' } else { 'BLOCKED [OK]' } )" -ForegroundColor $( if (-not $allowEmailSubscriptions) { 'Green' } else { 'Yellow' } ) # Check if setting is secure if ($allowInvitesFrom -eq 'everyone') { $result.isCompliant = $false Write-Host "`n [FAIL] Security Risk: Everyone can invite guests!" -ForegroundColor Red } elseif ($allowInvitesFrom -in @('none', 'adminsAndGuestInviters')) { Write-Host "`n [OK] Secure: Only admins can invite" -ForegroundColor Green } else { Write-Host "`n ⚠️ All members can invite guests" -ForegroundColor Yellow } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Restrict guest invitations!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Restricts B2B invitations to admins only #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" -ErrorAction Stop -NoWelcome Write-Host "Restricting guest invitations to admins only..." -ForegroundColor Gray $policyUpdate = @{ allowInvitesFrom = 'adminsAndGuestInviters' # Only admins defaultUserRolePermissions = @{ allowedToSignUpEmailBasedSubscriptions = $false } } Invoke-MgGraphRequest -Method PATCH ` -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy" ` -Body ($policyUpdate | ConvertTo-Json -Depth 10) Write-Host "`n[OK] B2B invitations restricted" -ForegroundColor Green Write-Host "`nNew settings:" -ForegroundColor Cyan Write-Host " • Only admins can invite guests" -ForegroundColor Gray Write-Host " • Email-based subscriptions blocked" -ForegroundColor Gray Write-Host " • All guest invitations require admin approval" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check B2B settings" -ForegroundColor Gray Write-Host " -Remediation Restrict to admins only" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authorization policy..." -ForegroundColor Gray $policy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" $allowInvitesFrom = $policy.allowInvitesFrom $allowEmailSubscriptions = $policy.defaultUserRolePermissions.allowedToSignUpEmailBasedSubscriptions $result = @{ isCompliant = $true allowInvitesFrom = $allowInvitesFrom allowEmailSubscriptions = $allowEmailSubscriptions } Write-Host "`n B2B Invitation Settings:" -ForegroundColor Cyan Write-Host " Who can invite guests: $allowInvitesFrom" -ForegroundColor $( switch ($allowInvitesFrom) { 'none' { 'Green' } # Most restrictive 'adminsAndGuestInviters' { 'Green' } # Admins only 'adminsGuestInvitersAndAllMembers' { 'Yellow' } # All members 'everyone' { 'Red' } # Everyone including guests default { 'Gray' } } ) Write-Host "`n Settings explanation:" -ForegroundColor Cyan Write-Host " • none = No B2B invitations" -ForegroundColor Gray Write-Host " • adminsAndGuestInviters = Admins only [OK]" -ForegroundColor Gray Write-Host " • adminsGuestInvitersAndAllMembers = All members ⚠️" -ForegroundColor Gray Write-Host " • everyone = Everyone (guests too) [FAIL]" -ForegroundColor Gray Write-Host "`n Email-based Subscriptions: $( if ($allowEmailSubscriptions) { 'ALLOWED ⚠️' } else { 'BLOCKED [OK]' } )" -ForegroundColor $( if (-not $allowEmailSubscriptions) { 'Green' } else { 'Yellow' } ) # Check if setting is secure if ($allowInvitesFrom -eq 'everyone') { $result.isCompliant = $false Write-Host "`n [FAIL] Security Risk: Everyone can invite guests!" -ForegroundColor Red } elseif ($allowInvitesFrom -in @('none', 'adminsAndGuestInviters')) { Write-Host "`n [OK] Secure: Only admins can invite" -ForegroundColor Green } else { Write-Host "`n ⚠️ All members can invite guests" -ForegroundColor Yellow } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Restrict guest invitations!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Restricts B2B invitations to admins only #> function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS B2B Collaboration Restricted to Approved Domains .DESCRIPTION Ensures B2B guest invitations are restricted to specific approved domains or require admin approval. Prevents unrestricted external collaboration that could lead to data exposure. .NOTES Filename: b2b-collaboration-restricted-domains.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\b2b-collaboration-restricted-domains.ps1 -Monitoring Check B2B collaboration settings .EXAMPLE .\b2b-collaboration-restricted-domains.ps1 -Remediation Restrict B2B invitations to admins only #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "B2B Collaboration Restricted" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { <# .SYNOPSIS Checks who can invite external users #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authorization policy..." -ForegroundColor Gray $policy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" $allowInvitesFrom = $policy.allowInvitesFrom $allowEmailSubscriptions = $policy.defaultUserRolePermissions.allowedToSignUpEmailBasedSubscriptions $result = @{ isCompliant = $true allowInvitesFrom = $allowInvitesFrom allowEmailSubscriptions = $allowEmailSubscriptions } Write-Host "`n B2B Invitation Settings:" -ForegroundColor Cyan Write-Host " Who can invite guests: $allowInvitesFrom" -ForegroundColor $( switch ($allowInvitesFrom) { 'none' { 'Green' } # Most restrictive 'adminsAndGuestInviters' { 'Green' } # Admins only 'adminsGuestInvitersAndAllMembers' { 'Yellow' } # All members 'everyone' { 'Red' } # Everyone including guests default { 'Gray' } } ) Write-Host "`n Settings explanation:" -ForegroundColor Cyan Write-Host " • none = No B2B invitations" -ForegroundColor Gray Write-Host " • adminsAndGuestInviters = Admins only [OK]" -ForegroundColor Gray Write-Host " • adminsGuestInvitersAndAllMembers = All members ⚠️" -ForegroundColor Gray Write-Host " • everyone = Everyone (guests too) [FAIL]" -ForegroundColor Gray Write-Host "`n Email-based Subscriptions: $( if ($allowEmailSubscriptions) { 'ALLOWED ⚠️' } else { 'BLOCKED [OK]' } )" -ForegroundColor $( if (-not $allowEmailSubscriptions) { 'Green' } else { 'Yellow' } ) # Check if setting is secure if ($allowInvitesFrom -eq 'everyone') { $result.isCompliant = $false Write-Host "`n [FAIL] Security Risk: Everyone can invite guests!" -ForegroundColor Red } elseif ($allowInvitesFrom -in @('none', 'adminsAndGuestInviters')) { Write-Host "`n [OK] Secure: Only admins can invite" -ForegroundColor Green } else { Write-Host "`n ⚠️ All members can invite guests" -ForegroundColor Yellow } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Restrict guest invitations!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Restricts B2B invitations to admins only #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" -ErrorAction Stop -NoWelcome Write-Host "Restricting guest invitations to admins only..." -ForegroundColor Gray $policyUpdate = @{ allowInvitesFrom = 'adminsAndGuestInviters' # Only admins defaultUserRolePermissions = @{ allowedToSignUpEmailBasedSubscriptions = $false } } Invoke-MgGraphRequest -Method PATCH ` -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy" ` -Body ($policyUpdate | ConvertTo-Json -Depth 10) Write-Host "`n[OK] B2B invitations restricted" -ForegroundColor Green Write-Host "`nNew settings:" -ForegroundColor Cyan Write-Host " • Only admins can invite guests" -ForegroundColor Gray Write-Host " • Email-based subscriptions blocked" -ForegroundColor Gray Write-Host " • All guest invitations require admin approval" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check B2B settings" -ForegroundColor Gray Write-Host " -Remediation Restrict to admins only" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" -ErrorAction Stop -NoWelcome Write-Host "Restricting guest invitations to admins only..." -ForegroundColor Gray $policyUpdate = @{ allowInvitesFrom = 'adminsAndGuestInviters' # Only admins defaultUserRolePermissions = @{ allowedToSignUpEmailBasedSubscriptions = $false } } Invoke-MgGraphRequest -Method PATCH ` -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy" ` -Body ($policyUpdate | ConvertTo-Json -Depth 10) Write-Host "`n[OK] B2B invitations restricted" -ForegroundColor Green Write-Host "`nNew settings:" -ForegroundColor Cyan Write-Host " • Only admins can invite guests" -ForegroundColor Gray Write-Host " • Email-based subscriptions blocked" -ForegroundColor Gray Write-Host " • All guest invitations require admin approval" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS B2B Collaboration Restricted to Approved Domains .DESCRIPTION Ensures B2B guest invitations are restricted to specific approved domains or require admin approval. Prevents unrestricted external collaboration that could lead to data exposure. .NOTES Filename: b2b-collaboration-restricted-domains.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\b2b-collaboration-restricted-domains.ps1 -Monitoring Check B2B collaboration settings .EXAMPLE .\b2b-collaboration-restricted-domains.ps1 -Remediation Restrict B2B invitations to admins only #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "B2B Collaboration Restricted" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { <# .SYNOPSIS Checks who can invite external users #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authorization policy..." -ForegroundColor Gray $policy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" $allowInvitesFrom = $policy.allowInvitesFrom $allowEmailSubscriptions = $policy.defaultUserRolePermissions.allowedToSignUpEmailBasedSubscriptions $result = @{ isCompliant = $true allowInvitesFrom = $allowInvitesFrom allowEmailSubscriptions = $allowEmailSubscriptions } Write-Host "`n B2B Invitation Settings:" -ForegroundColor Cyan Write-Host " Who can invite guests: $allowInvitesFrom" -ForegroundColor $( switch ($allowInvitesFrom) { 'none' { 'Green' } # Most restrictive 'adminsAndGuestInviters' { 'Green' } # Admins only 'adminsGuestInvitersAndAllMembers' { 'Yellow' } # All members 'everyone' { 'Red' } # Everyone including guests default { 'Gray' } } ) Write-Host "`n Settings explanation:" -ForegroundColor Cyan Write-Host " • none = No B2B invitations" -ForegroundColor Gray Write-Host " • adminsAndGuestInviters = Admins only [OK]" -ForegroundColor Gray Write-Host " • adminsGuestInvitersAndAllMembers = All members ⚠️" -ForegroundColor Gray Write-Host " • everyone = Everyone (guests too) [FAIL]" -ForegroundColor Gray Write-Host "`n Email-based Subscriptions: $( if ($allowEmailSubscriptions) { 'ALLOWED ⚠️' } else { 'BLOCKED [OK]' } )" -ForegroundColor $( if (-not $allowEmailSubscriptions) { 'Green' } else { 'Yellow' } ) # Check if setting is secure if ($allowInvitesFrom -eq 'everyone') { $result.isCompliant = $false Write-Host "`n [FAIL] Security Risk: Everyone can invite guests!" -ForegroundColor Red } elseif ($allowInvitesFrom -in @('none', 'adminsAndGuestInviters')) { Write-Host "`n [OK] Secure: Only admins can invite" -ForegroundColor Green } else { Write-Host "`n ⚠️ All members can invite guests" -ForegroundColor Yellow } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Restrict guest invitations!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Restricts B2B invitations to admins only #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" -ErrorAction Stop -NoWelcome Write-Host "Restricting guest invitations to admins only..." -ForegroundColor Gray $policyUpdate = @{ allowInvitesFrom = 'adminsAndGuestInviters' # Only admins defaultUserRolePermissions = @{ allowedToSignUpEmailBasedSubscriptions = $false } } Invoke-MgGraphRequest -Method PATCH ` -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy" ` -Body ($policyUpdate | ConvertTo-Json -Depth 10) Write-Host "`n[OK] B2B invitations restricted" -ForegroundColor Green Write-Host "`nNew settings:" -ForegroundColor Cyan Write-Host " • Only admins can invite guests" -ForegroundColor Gray Write-Host " • Email-based subscriptions blocked" -ForegroundColor Gray Write-Host " • All guest invitations require admin approval" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check B2B settings" -ForegroundColor Gray Write-Host " -Remediation Restrict to admins only" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check B2B settings" -ForegroundColor Gray Write-Host " -Remediation Restrict to admins only" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }