Privileged Access Reviews

<# .SYNOPSIS Privileged Access Reviews .DESCRIPTION Verifies access reviews are configured for privileged roles .NOTES NL Baseline v2.0 Requires: Azure AD Premium P2 #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Privileged Access Reviews" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "AccessReview.Read.All" -ErrorAction Stop -NoWelcome try { $accessReviews = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions" -ErrorAction Stop $result = @{ totalReviews = 0; privilegedReviews = 0; reviews = @() } if ($accessReviews -and $accessReviews.value) { $result.totalReviews = $accessReviews.value.Count foreach ($review in $accessReviews.value) { if ($review.scope.query -match 'roleAssignment' -or $review.displayName -match 'admin|privileged') { $result.privilegedReviews++ $result.reviews += $review.displayName Write-Host " [OK] PRIVILEGED REVIEW: $($review.displayName)" -ForegroundColor Green Write-Host " Recurrence: $($review.recurrence.pattern.type)" -ForegroundColor Cyan } } } Write-Host "`n Summary:" -ForegroundColor Cyan Write-Host " Total Access Reviews: $($result.totalReviews)" -ForegroundColor White Write-Host " Privileged Role Reviews: $($result.privilegedReviews)" -ForegroundColor $( if ($result.privilegedReviews -gt 0) { 'Green' }else { 'Red' } ) Write-Host "`n Access Review Benefits:" -ForegroundColor Cyan Write-Host " • Regular review of admin access" -ForegroundColor Gray Write-Host " • Reduces privilege creep" -ForegroundColor Gray Write-Host " • Improves security posture" -ForegroundColor Gray Write-Host "`n ⚠️ Requires: Azure AD Premium P2" -ForegroundColor Yellow if ($result.privilegedReviews -gt 0) { Write-Host "`n[OK] COMPLIANT - Privileged access reviews configured" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - No privileged access reviews!" -ForegroundColor Red Write-Host "Configure in: Azure AD > Identity Governance > Access reviews" -ForegroundColor Yellow exit 1 } } catch { Write-Host " ⚠️ Access Reviews not available (requires Premium P2)" -ForegroundColor Yellow exit 0 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }