Globale Beheerder Rechten Approval Required

<# .SYNOPSIS Global Admin Approval Required for App Consent .DESCRIPTION Ensures users cannot consent to apps - admin approval required .NOTES NL Baseline v2.0 #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Admin Approval Required" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome $consentPolicy = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" $usersCanConsent = $consentPolicy.defaultUserRolePermissions.permissionGrantPoliciesAssigned $isRestricted = ($usersCanConsent.Count -eq 0 -or $usersCanConsent -notcontains 'ManagePermissionGrantsForSelf.microsoft-user-default-legacy') Write-Host " User Consent Setting: $(if($isRestricted){'RESTRICTED'}else{'ALLOWED'})" -ForegroundColor $( if ($isRestricted) { 'Green' }else { 'Red' } ) Write-Host " Consent policies: $($usersCanConsent -join ', ')" -ForegroundColor Gray Write-Host "`n Impact:" -ForegroundColor Cyan Write-Host " • Admins must approve all app permissions" -ForegroundColor Gray Write-Host " • Prevents malicious app consent" -ForegroundColor Gray Write-Host " • IT has full oversight" -ForegroundColor Gray if ($isRestricted) { Write-Host "`n[OK] COMPLIANT - Admin approval required" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Users can consent to apps!" -ForegroundColor Red exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }