Voorwaardelijke Toegang Insider Risk

<# .SYNOPSIS Conditional Access - Insider Risk Integration .DESCRIPTION Checks if Conditional Access policies use risk-based conditions (sign-in risk, user risk). Leverages Azure AD Identity Protection for insider threat detection. .NOTES Filename: conditional-access-insider-risk.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Azure AD Premium P2 .EXAMPLE .\conditional-access-insider-risk.ps1 -Monitoring Check if risk-based CA policies exist #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Conditional Access - Insider Risk" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { <# .SYNOPSIS Checks for risk-based Conditional Access policies #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking for risk-based CA policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false totalPolicies = $policies.value.Count signInRiskPolicies = 0 userRiskPolicies = 0 policyDetails = @() } foreach ($policy in $policies.value) { if ($policy.state -ne 'enabled') { continue } $hasSignInRisk = $policy.conditions.signInRiskLevels.Count -gt 0 $hasUserRisk = $policy.conditions.userRiskLevels.Count -gt 0 if ($hasSignInRisk) { $result.signInRiskPolicies++ $result.isCompliant = $true Write-Host " [OK] SIGN-IN RISK POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Risk levels: $($policy.conditions.signInRiskLevels -join ', ')" -ForegroundColor Cyan Write-Host " Action: $($policy.grantControls.builtInControls -join ', ')" -ForegroundColor Cyan } if ($hasUserRisk) { $result.userRiskPolicies++ $result.isCompliant = $true Write-Host " [OK] USER RISK POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Risk levels: $($policy.conditions.userRiskLevels -join ', ')" -ForegroundColor Cyan Write-Host " Action: $($policy.grantControls.builtInControls -join ', ')" -ForegroundColor Cyan } } Write-Host "`n Summary:" -ForegroundColor Cyan Write-Host " Total CA policies: $($result.totalPolicies)" -ForegroundColor White Write-Host " Sign-in risk policies: $($result.signInRiskPolicies)" -ForegroundColor $( if ($result.signInRiskPolicies -gt 0) { 'Green' } else { 'Yellow' } ) Write-Host " User risk policies: $($result.userRiskPolicies)" -ForegroundColor $( if ($result.userRiskPolicies -gt 0) { 'Green' } else { 'Yellow' } ) Write-Host "`n ⚠️ Requires Azure AD Premium P2 license" -ForegroundColor Yellow Write-Host " Identity Protection provides risk detection" -ForegroundColor Cyan if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Risk-based policies configured" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO RISK-BASED POLICIES FOUND" -ForegroundColor Yellow Write-Host "Consider implementing Identity Protection policies" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow Write-Host "`nRisk-based Conditional Access:" -ForegroundColor Cyan Write-Host " • Detects anomalous sign-ins" -ForegroundColor Gray Write-Host " • Detects leaked credentials" -ForegroundColor Gray Write-Host " • Detects impossible travel" -ForegroundColor Gray Write-Host " • Automatically blocks or requires MFA" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }