MFA Voor Beheerders (M365 Admins)

<# .SYNOPSIS MFA voor Beheerders (Administrators) .DESCRIPTION Ensures all administrator accounts have MFA enforced via Conditional Access. This is a critical security control for privileged accounts. .NOTES Filename: mfa-beheerders.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection .EXAMPLE .\mfa-beheerders.ps1 -Monitoring Check if MFA is enforced for administrators #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "MFA voor Beheerders (Administrators)" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if MFA is enforced for administrator accounts #> function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS MFA voor Beheerders (Administrators) .DESCRIPTION Ensures all administrator accounts have MFA enforced via Conditional Access. This is a critical security control for privileged accounts. .NOTES Filename: mfa-beheerders.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection .EXAMPLE .\mfa-beheerders.ps1 -Monitoring Check if MFA is enforced for administrators #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "MFA voor Beheerders (Administrators)" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if MFA is enforced for administrator accounts #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Conditional Access policies for admin MFA..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" # Get directory role IDs for admin roles Write-Host "Getting administrator role information..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $result = @{ isCompliant = $false mfaPoliciesForAdmins = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if it targets directory roles (admins) $targetsAdminRoles = $policy.conditions.users.includeRoles.Count -gt 0 $includesAllUsers = $policy.conditions.users.includeUsers -contains 'All' # Check if it requires MFA $requiresMFA = $policy.grantControls.builtInControls -contains 'mfa' if (($targetsAdminRoles -or $includesAllUsers) -and $requiresMFA) { $result.mfaPoliciesForAdmins++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] MFA POLICY FOR ADMINS: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n Policies enforcing admin MFA: $($result.mfaPoliciesForAdmins)" -ForegroundColor $(if ($result.mfaPoliciesForAdmins -gt 0) { 'Green' } else { 'Red' }) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - MFA is enforced for administrators" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - MFA not enforced for administrators" -ForegroundColor Red Write-Host "Create a Conditional Access policy requiring MFA for admin roles!" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to enforce MFA for administrators #> try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Getting administrator role IDs..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $adminRoleIds = $adminRoles.value | Select-Object -ExpandProperty id Write-Host "Creating MFA policy for administrators..." -ForegroundColor Gray $policyBody = @{ displayName = "Require MFA for Administrators - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeRoles = @($adminRoleIds) excludeUsers = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @("all") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "Review impact before enabling!" -ForegroundColor Yellow Write-Host "`nTo enable: Change state to 'enabled' in Azure Portal" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All", "Directory.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Conditional Access policies for admin MFA..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" # Get directory role IDs for admin roles Write-Host "Getting administrator role information..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $result = @{ isCompliant = $false mfaPoliciesForAdmins = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if it targets directory roles (admins) $targetsAdminRoles = $policy.conditions.users.includeRoles.Count -gt 0 $includesAllUsers = $policy.conditions.users.includeUsers -contains 'All' # Check if it requires MFA $requiresMFA = $policy.grantControls.builtInControls -contains 'mfa' if (($targetsAdminRoles -or $includesAllUsers) -and $requiresMFA) { $result.mfaPoliciesForAdmins++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] MFA POLICY FOR ADMINS: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n Policies enforcing admin MFA: $($result.mfaPoliciesForAdmins)" -ForegroundColor $(if ($result.mfaPoliciesForAdmins -gt 0) { 'Green' } else { 'Red' }) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - MFA is enforced for administrators" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - MFA not enforced for administrators" -ForegroundColor Red Write-Host "Create a Conditional Access policy requiring MFA for admin roles!" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to enforce MFA for administrators #> function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS MFA voor Beheerders (Administrators) .DESCRIPTION Ensures all administrator accounts have MFA enforced via Conditional Access. This is a critical security control for privileged accounts. .NOTES Filename: mfa-beheerders.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection .EXAMPLE .\mfa-beheerders.ps1 -Monitoring Check if MFA is enforced for administrators #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "MFA voor Beheerders (Administrators)" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if MFA is enforced for administrator accounts #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Conditional Access policies for admin MFA..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" # Get directory role IDs for admin roles Write-Host "Getting administrator role information..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $result = @{ isCompliant = $false mfaPoliciesForAdmins = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if it targets directory roles (admins) $targetsAdminRoles = $policy.conditions.users.includeRoles.Count -gt 0 $includesAllUsers = $policy.conditions.users.includeUsers -contains 'All' # Check if it requires MFA $requiresMFA = $policy.grantControls.builtInControls -contains 'mfa' if (($targetsAdminRoles -or $includesAllUsers) -and $requiresMFA) { $result.mfaPoliciesForAdmins++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] MFA POLICY FOR ADMINS: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n Policies enforcing admin MFA: $($result.mfaPoliciesForAdmins)" -ForegroundColor $(if ($result.mfaPoliciesForAdmins -gt 0) { 'Green' } else { 'Red' }) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - MFA is enforced for administrators" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - MFA not enforced for administrators" -ForegroundColor Red Write-Host "Create a Conditional Access policy requiring MFA for admin roles!" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to enforce MFA for administrators #> try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Getting administrator role IDs..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $adminRoleIds = $adminRoles.value | Select-Object -ExpandProperty id Write-Host "Creating MFA policy for administrators..." -ForegroundColor Gray $policyBody = @{ displayName = "Require MFA for Administrators - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeRoles = @($adminRoleIds) excludeUsers = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @("all") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "Review impact before enabling!" -ForegroundColor Yellow Write-Host "`nTo enable: Change state to 'enabled' in Azure Portal" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Getting administrator role IDs..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $adminRoleIds = $adminRoles.value | Select-Object -ExpandProperty id Write-Host "Creating MFA policy for administrators..." -ForegroundColor Gray $policyBody = @{ displayName = "Require MFA for Administrators - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeRoles = @($adminRoleIds) excludeUsers = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @("all") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "Review impact before enabling!" -ForegroundColor Yellow Write-Host "`nTo enable: Change state to 'enabled' in Azure Portal" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS MFA voor Beheerders (Administrators) .DESCRIPTION Ensures all administrator accounts have MFA enforced via Conditional Access. This is a critical security control for privileged accounts. .NOTES Filename: mfa-beheerders.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection .EXAMPLE .\mfa-beheerders.ps1 -Monitoring Check if MFA is enforced for administrators #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "MFA voor Beheerders (Administrators)" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if MFA is enforced for administrator accounts #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Conditional Access policies for admin MFA..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" # Get directory role IDs for admin roles Write-Host "Getting administrator role information..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $result = @{ isCompliant = $false mfaPoliciesForAdmins = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if it targets directory roles (admins) $targetsAdminRoles = $policy.conditions.users.includeRoles.Count -gt 0 $includesAllUsers = $policy.conditions.users.includeUsers -contains 'All' # Check if it requires MFA $requiresMFA = $policy.grantControls.builtInControls -contains 'mfa' if (($targetsAdminRoles -or $includesAllUsers) -and $requiresMFA) { $result.mfaPoliciesForAdmins++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] MFA POLICY FOR ADMINS: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n Policies enforcing admin MFA: $($result.mfaPoliciesForAdmins)" -ForegroundColor $(if ($result.mfaPoliciesForAdmins -gt 0) { 'Green' } else { 'Red' }) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - MFA is enforced for administrators" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - MFA not enforced for administrators" -ForegroundColor Red Write-Host "Create a Conditional Access policy requiring MFA for admin roles!" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to enforce MFA for administrators #> try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Getting administrator role IDs..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $adminRoleIds = $adminRoles.value | Select-Object -ExpandProperty id Write-Host "Creating MFA policy for administrators..." -ForegroundColor Gray $policyBody = @{ displayName = "Require MFA for Administrators - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeRoles = @($adminRoleIds) excludeUsers = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @("all") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "Review impact before enabling!" -ForegroundColor Yellow Write-Host "`nTo enable: Change state to 'enabled' in Azure Portal" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }