Weak Auth Methods Disabled

<# .SYNOPSIS Weak Authentication Methods Disabled .DESCRIPTION Ensures weak authentication methods (SMS, Voice) are disabled .NOTES NL Baseline v2.0 Modern security: Use strong methods like Authenticator app or FIDO2 #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' $weakMethods = @('sms', 'voice') Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Weak Authentication Methods Disabled" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome $authMethods = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy" $result = @{ isCompliant = $true; smsEnabled = $false; voiceEnabled = $false; weakMethodsEnabled = @() } foreach ($method in $authMethods.authenticationMethodConfigurations) { if ($method.id -eq 'Sms' -and $method.state -eq 'enabled') { $result.smsEnabled = $true $result.isCompliant = $false $result.weakMethodsEnabled += 'SMS' } if ($method.id -eq 'Voice' -and $method.state -eq 'enabled') { $result.voiceEnabled = $true $result.isCompliant = $false $result.weakMethodsEnabled += 'Voice' } } Write-Host " SMS Authentication: $(if($result.smsEnabled){'ENABLED (Weak)'}else{'DISABLED'})" -ForegroundColor $( if (-not $result.smsEnabled) { 'Green' }else { 'Red' } ) Write-Host " Voice Authentication: $(if($result.voiceEnabled){'ENABLED (Weak)'}else{'DISABLED'})" -ForegroundColor $( if (-not $result.voiceEnabled) { 'Green' }else { 'Red' } ) Write-Host "`n Why SMS/Voice are weak:" -ForegroundColor Cyan Write-Host " • SMS can be intercepted (SIM swapping)" -ForegroundColor Gray Write-Host " • Voice calls can be redirected" -ForegroundColor Gray Write-Host " • No phishing protection" -ForegroundColor Gray Write-Host " • Easier to compromise" -ForegroundColor Gray Write-Host "`n Recommended strong methods:" -ForegroundColor Cyan Write-Host " • Microsoft Authenticator app" -ForegroundColor Gray Write-Host " • FIDO2 security keys" -ForegroundColor Gray Write-Host " • Windows Hello" -ForegroundColor Gray Write-Host " • Certificate-based authentication" -ForegroundColor Gray if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - No weak authentication methods" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Weak methods enabled!" -ForegroundColor Red Write-Host "Disabled methods: $($result.weakMethodsEnabled -join ', ')" -ForegroundColor Yellow exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }