Blokkeer Legacy Authenticatie Voor Microsoft 365

<# .SYNOPSIS Block Legacy Authentication .DESCRIPTION Blocks legacy authentication protocols in Microsoft 365 using Conditional Access. Legacy authentication doesn't support MFA and is a major security risk. .NOTES Filename: legacy-authentication-block.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection .EXAMPLE .\legacy-authentication-block.ps1 -Monitoring Check if legacy authentication is blocked #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Block Legacy Authentication" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if legacy authentication is blocked via Conditional Access #> function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Block Legacy Authentication .DESCRIPTION Blocks legacy authentication protocols in Microsoft 365 using Conditional Access. Legacy authentication doesn't support MFA and is a major security risk. .NOTES Filename: legacy-authentication-block.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection .EXAMPLE .\legacy-authentication-block.ps1 -Monitoring Check if legacy authentication is blocked #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Block Legacy Authentication" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if legacy authentication is blocked via Conditional Access #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Conditional Access policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false blockingPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if it applies to all users or a broad scope $appliesToAll = $policy.conditions.users.includeUsers -contains 'All' # Check if it blocks legacy authentication $blocksLegacyAuth = $policy.conditions.clientAppTypes -contains 'exchangeActiveSync' -or $policy.conditions.clientAppTypes -contains 'other' # Check if grant control is to block $hasBlockControl = $policy.grantControls.builtInControls -contains 'block' if ($appliesToAll -and $blocksLegacyAuth -and $hasBlockControl) { $result.blockingPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] BLOCKING POLICY: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n Policies blocking legacy auth: $($result.blockingPolicies)" -ForegroundColor $(if ($result.blockingPolicies -gt 0) { 'Green' } else { 'Red' }) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Legacy authentication is blocked" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Legacy authentication not blocked" -ForegroundColor Red Write-Host "Create a Conditional Access policy to block legacy authentication!" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to block legacy authentication #> try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating policy to block legacy authentication..." -ForegroundColor Gray $policyBody = @{ displayName = "Block Legacy Authentication - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() excludeGroups = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @( "exchangeActiveSync", "other" ) } grantControls = @{ operator = "OR" builtInControls = @("block") } } $newPolicy = Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "Review impact before enabling!" -ForegroundColor Yellow Write-Host "`nTo enable: Change state to 'enabled' in Azure Portal" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Conditional Access policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false blockingPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if it applies to all users or a broad scope $appliesToAll = $policy.conditions.users.includeUsers -contains 'All' # Check if it blocks legacy authentication $blocksLegacyAuth = $policy.conditions.clientAppTypes -contains 'exchangeActiveSync' -or $policy.conditions.clientAppTypes -contains 'other' # Check if grant control is to block $hasBlockControl = $policy.grantControls.builtInControls -contains 'block' if ($appliesToAll -and $blocksLegacyAuth -and $hasBlockControl) { $result.blockingPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] BLOCKING POLICY: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n Policies blocking legacy auth: $($result.blockingPolicies)" -ForegroundColor $(if ($result.blockingPolicies -gt 0) { 'Green' } else { 'Red' }) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Legacy authentication is blocked" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Legacy authentication not blocked" -ForegroundColor Red Write-Host "Create a Conditional Access policy to block legacy authentication!" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to block legacy authentication #> function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Block Legacy Authentication .DESCRIPTION Blocks legacy authentication protocols in Microsoft 365 using Conditional Access. Legacy authentication doesn't support MFA and is a major security risk. .NOTES Filename: legacy-authentication-block.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection .EXAMPLE .\legacy-authentication-block.ps1 -Monitoring Check if legacy authentication is blocked #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Block Legacy Authentication" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if legacy authentication is blocked via Conditional Access #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Conditional Access policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false blockingPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if it applies to all users or a broad scope $appliesToAll = $policy.conditions.users.includeUsers -contains 'All' # Check if it blocks legacy authentication $blocksLegacyAuth = $policy.conditions.clientAppTypes -contains 'exchangeActiveSync' -or $policy.conditions.clientAppTypes -contains 'other' # Check if grant control is to block $hasBlockControl = $policy.grantControls.builtInControls -contains 'block' if ($appliesToAll -and $blocksLegacyAuth -and $hasBlockControl) { $result.blockingPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] BLOCKING POLICY: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n Policies blocking legacy auth: $($result.blockingPolicies)" -ForegroundColor $(if ($result.blockingPolicies -gt 0) { 'Green' } else { 'Red' }) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Legacy authentication is blocked" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Legacy authentication not blocked" -ForegroundColor Red Write-Host "Create a Conditional Access policy to block legacy authentication!" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to block legacy authentication #> try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating policy to block legacy authentication..." -ForegroundColor Gray $policyBody = @{ displayName = "Block Legacy Authentication - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() excludeGroups = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @( "exchangeActiveSync", "other" ) } grantControls = @{ operator = "OR" builtInControls = @("block") } } $newPolicy = Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "Review impact before enabling!" -ForegroundColor Yellow Write-Host "`nTo enable: Change state to 'enabled' in Azure Portal" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating policy to block legacy authentication..." -ForegroundColor Gray $policyBody = @{ displayName = "Block Legacy Authentication - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() excludeGroups = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @( "exchangeActiveSync", "other" ) } grantControls = @{ operator = "OR" builtInControls = @("block") } } $newPolicy = Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "Review impact before enabling!" -ForegroundColor Yellow Write-Host "`nTo enable: Change state to 'enabled' in Azure Portal" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Block Legacy Authentication .DESCRIPTION Blocks legacy authentication protocols in Microsoft 365 using Conditional Access. Legacy authentication doesn't support MFA and is a major security risk. .NOTES Filename: legacy-authentication-block.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection .EXAMPLE .\legacy-authentication-block.ps1 -Monitoring Check if legacy authentication is blocked #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Block Legacy Authentication" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if legacy authentication is blocked via Conditional Access #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Conditional Access policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false blockingPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if it applies to all users or a broad scope $appliesToAll = $policy.conditions.users.includeUsers -contains 'All' # Check if it blocks legacy authentication $blocksLegacyAuth = $policy.conditions.clientAppTypes -contains 'exchangeActiveSync' -or $policy.conditions.clientAppTypes -contains 'other' # Check if grant control is to block $hasBlockControl = $policy.grantControls.builtInControls -contains 'block' if ($appliesToAll -and $blocksLegacyAuth -and $hasBlockControl) { $result.blockingPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] BLOCKING POLICY: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n Policies blocking legacy auth: $($result.blockingPolicies)" -ForegroundColor $(if ($result.blockingPolicies -gt 0) { 'Green' } else { 'Red' }) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Legacy authentication is blocked" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Legacy authentication not blocked" -ForegroundColor Red Write-Host "Create a Conditional Access policy to block legacy authentication!" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to block legacy authentication #> try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating policy to block legacy authentication..." -ForegroundColor Gray $policyBody = @{ displayName = "Block Legacy Authentication - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() excludeGroups = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @( "exchangeActiveSync", "other" ) } grantControls = @{ operator = "OR" builtInControls = @("block") } } $newPolicy = Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "Review impact before enabling!" -ForegroundColor Yellow Write-Host "`nTo enable: Change state to 'enabled' in Azure Portal" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }