Data Loss Prevention Policies In Microsoft 365: Afdwinging En Borging

<# .SYNOPSIS Controleert en configureert Data Loss Prevention (DLP) policies in Microsoft 365. .DESCRIPTION Dit script ondersteunt Nederlandse overheidsorganisaties bij het borgen van de Nederlandse Baseline voor Veilige Cloud. Het script kan DLP-policies monitoren, baseline policies configureren en indien nodig verwijderen. De focus ligt op Exchange, SharePoint, OneDrive, Teams en Power Platform-workloads die worden beheerd via Microsoft Purview (Security & Compliance PowerShell). .NOTES Filename: dlp-policies-enabled.ps1 Author: Nederlandse Baseline voor Veilige Cloud Created: 2025-01-10 Last Modified: 2025-01-10 Version: 1.0 Related JSON: content/m365/information-protection/dlp-policies-enabled.json Category: information-protection Workload: m365 .LINK https://github.com/m365-tenant-best-practise .EXAMPLE .\dlp-policies-enabled.ps1 -Monitoring Toont de status van alle DLP-policies en controleert of baseline policies actief zijn. .EXAMPLE .\dlp-policies-enabled.ps1 -Remediation Maakt of herconfigureert baseline DLP-policies en rules. .EXAMPLE .\dlp-policies-enabled.ps1 -Monitoring -DebugMode Voert een lokale test uit zonder verbinding te maken met Microsoft 365. #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(HelpMessage = "Monitor huidige DLP-configuratie")] [switch]$Monitoring, [Parameter(HelpMessage = "Configureer of herstel baseline DLP-policies")] [switch]$Remediation, [Parameter(HelpMessage = "Verwijder baseline DLP-policies (voorzichtig)")] [switch]$Revert, [Parameter(HelpMessage = "Toon welke acties zouden worden uitgevoerd")] [switch]$WhatIf, [Parameter(HelpMessage = "Lokale debugmodus zonder verbinding")] [switch]$DebugMode ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Microsoft 365 DLP Policies" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # GLOBAL SETTINGS # ============================================================================ $script:BaselinePolicyName = "Baseline - Overheid DLP All Workloads" $script:BaselineRuleName = "$($script:BaselinePolicyName) - Hoog Risico" $script:PolicyComment = "Baseline DLP policy geconfigureerd door Nederlandse Baseline voor Veilige Cloud" $script:SensitiveInformationTypes = @( @{ Name = "Netherlands Citizen Service Number (BSN)" minCount = 1 maxCount = 9 minConfidence = 75 }, @{ Name = "IBAN" minCount = 1 maxCount = 9 minConfidence = 80 }, @{ Name = "EU PII Data" minCount = 1 maxCount = 9 minConfidence = 85 } ) # ============================================================================ # FUNCTIONS # ============================================================================ function Connect-ComplianceService { <# .SYNOPSIS Maakt verbinding met Microsoft Purview (Security & Compliance PowerShell). #> [CmdletBinding()] param() try { Write-Host "Verbinden met Microsoft Purview..." -ForegroundColor Gray $existingSession = Get-PSSession | Where-Object { $_.ConfigurationName -eq "Microsoft.Exchange" -and $_.State -eq "Opened" -and $_.Name -like "*IPPSSession*" } if ($existingSession) { Write-Host " [OK] Bestaande Security & Compliance-sessie gevonden" -ForegroundColor Green return } Connect-IPPSSession -ShowBanner:$false -ErrorAction Stop | Out-Null Write-Host " [OK] Verbonden met Security & Compliance PowerShell" -ForegroundColor Green } catch { Write-Error "Kon niet verbinden met Security & Compliance PowerShell: $_" throw } } function Get-DlpPolicyStatus { <# .SYNOPSIS Haalt de status van alle DLP-policies op. .OUTPUTS PSCustomObject met kerngegevens van de policy. #> [CmdletBinding()] param() try { Write-Host "Ophalen van DLP-policies..." -ForegroundColor Gray $policies = Get-DlpCompliancePolicy -ErrorAction Stop $results = @() foreach ($policy in $policies) { $rules = Get-DlpComplianceRule -Policy $policy.Name -ErrorAction SilentlyContinue $workloads = @() if ($policy.ExchangeLocation -or $policy.ExchangeLocationException) { $workloads += "Exchange" } if ($policy.SharePointLocation -or $policy.SharePointLocationException) { $workloads += "SharePoint" } if ($policy.OneDriveLocation -or $policy.OneDriveLocationException) { $workloads += "OneDrive" } if ($policy.TeamsLocation -or $policy.TeamsLocationException) { $workloads += "Teams" } if ($policy.PowerPlatformLocation -or $policy.PowerPlatformLocationException) { $workloads += "PowerPlatform" } $hasRules = $rules -and $rules.Count -gt 0 $blocksAccess = $false $severity = "Niet ingesteld" if ($hasRules) { $firstRule = $rules | Select-Object -First 1 $blocksAccess = [bool]$firstRule.BlockAccess if ($firstRule.ReportSeverity) { $severity = $firstRule.ReportSeverity } } $results += [PSCustomObject]@{ Name = $policy.Name Mode = if ($policy.Mode) { $policy.Mode } else { "Onbekend" } Workloads = if ($workloads) { $workloads -join ", " } else { "Geen locaties" } HasRules = $hasRules BlocksAccess = $blocksAccess Severity = $severity Comment = $policy.Comment IsBaseline = ($policy.Name -eq $script:BaselinePolicyName) } } Write-Host " [OK] $($results.Count) DLP-policies gevonden" -ForegroundColor Green return $results } catch { Write-Error "Fout bij ophalen van DLP-policies: $_" throw } } function Invoke-Monitoring { <# .SYNOPSIS Controleert of DLP-policies volgens de baseline actief zijn. #> [CmdletBinding()] param() if ($DebugMode) { Write-Host "`n[MODE] Debug Mode - Lokale test" -ForegroundColor Yellow $mock = [PSCustomObject]@{ Name = $script:BaselinePolicyName Mode = "Enforce" Workloads = "Exchange, SharePoint, OneDrive, Teams" HasRules = $true BlocksAccess = $true Severity = "High" Comment = $script:PolicyComment IsBaseline = $true } $mock | Format-Table -AutoSize return [PSCustomObject]@{ TotalPolicies = 1 BaselinePolicies = 1 Enforced = $true Policies = @($mock) } } try { Write-Host "`nMonitoring: DLP Policies" -ForegroundColor Cyan Write-Host "=========================" -ForegroundColor Cyan Connect-ComplianceService $policies = Get-DlpPolicyStatus if (-not $policies -or $policies.Count -eq 0) { Write-Host " ⚠️ Geen DLP-policies gevonden" -ForegroundColor Yellow return [PSCustomObject]@{ TotalPolicies = 0 BaselinePolicies = 0 Enforced = $false Policies = @() } } Write-Host "`nOverzicht:" -ForegroundColor Cyan $policies | Format-Table -AutoSize Name, Mode, Workloads, HasRules, BlocksAccess $baseline = $policies | Where-Object { $_.IsBaseline } $enforced = ($baseline.Count -gt 0) -and ($baseline | Where-Object { $_.Mode -eq "Enforce" -and $_.HasRules -and $_.BlocksAccess }).Count -eq $baseline.Count if ($enforced) { Write-Host "`n ✅ Baseline DLP-policies zijn actief en afdwingend" -ForegroundColor Green } else { Write-Host "`n ⚠️ Baseline DLP-policies ontbreken of staan niet in Enforce-modus" -ForegroundColor Yellow } return [PSCustomObject]@{ TotalPolicies = $policies.Count BaselinePolicies = $baseline.Count Enforced = $enforced Policies = $policies } } catch { Write-Error "Fout bij monitoring: $_" throw } } function New-OrUpdateDlpPolicy { <# .SYNOPSIS Creëert of actualiseert de baseline DLP-policy. #> [CmdletBinding(SupportsShouldProcess)] param() $policy = Get-DlpCompliancePolicy -Identity $script:BaselinePolicyName -ErrorAction SilentlyContinue if ($policy) { Write-Host " ℹ️ Baseline DLP-policy bestaat al" -ForegroundColor Yellow if ($policy.Mode -ne "Enforce") { Write-Host " - Policy staat in modus '$($policy.Mode)'. Bijwerken naar 'Enforce'..." -ForegroundColor Yellow if ($PSCmdlet.ShouldProcess($script:BaselinePolicyName, "Set-DlpCompliancePolicy naar Enforce")) { Set-DlpCompliancePolicy -Identity $script:BaselinePolicyName -Mode Enforce -ErrorAction Stop } } return $policy } if ($PSCmdlet.ShouldProcess($script:BaselinePolicyName, "Create DLP policy")) { Write-Host " Aanmaken van baseline DLP-policy..." -ForegroundColor Gray $policy = New-DlpCompliancePolicy ` -Name $script:BaselinePolicyName ` -Comment $script:PolicyComment ` -Mode Enforce ` -ExchangeLocation All ` -SharePointLocation All ` -OneDriveLocation All ` -TeamsLocation All ` -ErrorAction Stop Write-Host " [OK] DLP-policy aangemaakt" -ForegroundColor Green } return $policy } function New-OrUpdateDlpRule { <# .SYNOPSIS Creëert of actualiseert de baseline DLP-rule. #> [CmdletBinding(SupportsShouldProcess)] param() $existingRule = Get-DlpComplianceRule -Policy $script:BaselinePolicyName -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq $script:BaselineRuleName } if ($existingRule) { Write-Host " ℹ️ Baseline DLP-rule bestaat al" -ForegroundColor Yellow $requiresUpdate = (-not $existingRule.BlockAccess) -or ($existingRule.ReportSeverity -ne "High") if ($requiresUpdate -and $PSCmdlet.ShouldProcess($script:BaselineRuleName, "Update DLP rule")) { Write-Host " - Bijwerken van bestaande regel zodat blokkade en High severity actief zijn" -ForegroundColor Yellow Set-DlpComplianceRule ` -Identity $script:BaselineRuleName ` -BlockAccess $true ` -ReportSeverity High ` -NotifyUser $true ` -NotifyPolicyTip $true ` -Mode Enforce ` -ErrorAction Stop } return } if ($PSCmdlet.ShouldProcess($script:BaselineRuleName, "Create DLP rule")) { Write-Host " Aanmaken van baseline DLP-rule..." -ForegroundColor Gray New-DlpComplianceRule ` -Name $script:BaselineRuleName ` -Policy $script:BaselinePolicyName ` -BlockAccess $true ` -ContentContainsSensitiveInformation $script:SensitiveInformationTypes ` -NotifyUser $true ` -NotifyPolicyTip $true ` -ReportSeverity High ` -Mode Enforce ` -ErrorAction Stop | Out-Null Write-Host " [OK] DLP-rule aangemaakt" -ForegroundColor Green } } function Invoke-Remediation { <# .SYNOPSIS Configureert baseline DLP-policies. #> [CmdletBinding()] param() if ($DebugMode) { Write-Host "`n[MODE] Debug Mode - Remediation preview" -ForegroundColor Yellow Write-Host " Zou policy '$script:BaselinePolicyName' aanmaken of bijwerken in Enforce-modus" -ForegroundColor Gray Write-Host " Zou rule '$script:BaselineRuleName' configureren met blokkade en meldingen" -ForegroundColor Gray return } try { Write-Host "`nRemediatie: DLP Policies" -ForegroundColor Cyan Write-Host "==========================" -ForegroundColor Cyan Connect-ComplianceService New-OrUpdateDlpPolicy Start-Sleep -Seconds 3 New-OrUpdateDlpRule Write-Host "`n ✅ Baseline DLP-policies zijn geconfigureerd" -ForegroundColor Green } catch { Write-Error "Fout bij remediatie: $_" throw } } function Invoke-Revert { <# .SYNOPSIS Verwijdert baseline DLP-policies. #> [CmdletBinding(SupportsShouldProcess)] param() if ($DebugMode) { Write-Host "`n[MODE] Debug Mode - Revert preview" -ForegroundColor Yellow Write-Host " Zou policy '$script:BaselinePolicyName' en gekoppelde rules verwijderen" -ForegroundColor Gray return } try { Write-Host "`nRevert: Baseline DLP Policies" -ForegroundColor Cyan Write-Host "==============================" -ForegroundColor Cyan Write-Host " ⚠️ Gebruik uitsluitend wanneer een alternatief beleid aanwezig is" -ForegroundColor Red if (-not $WhatIf) { $confirmation = Read-Host "Typ 'ja' om te bevestigen" if ($confirmation -ne "ja") { Write-Host " Operatie geannuleerd" -ForegroundColor Yellow return } } Connect-ComplianceService $rules = Get-DlpComplianceRule -Policy $script:BaselinePolicyName -ErrorAction SilentlyContinue foreach ($rule in $rules) { if ($PSCmdlet.ShouldProcess($rule.Name, "Remove DLP rule")) { Remove-DlpComplianceRule -Identity $rule.Name -Confirm:$false -ErrorAction SilentlyContinue Write-Host " [OK] Rule '$($rule.Name)' verwijderd" -ForegroundColor Green } } $policy = Get-DlpCompliancePolicy -Identity $script:BaselinePolicyName -ErrorAction SilentlyContinue if ($policy -and $PSCmdlet.ShouldProcess($script:BaselinePolicyName, "Remove DLP policy")) { Remove-DlpCompliancePolicy -Identity $script:BaselinePolicyName -Confirm:$false -ErrorAction Stop Write-Host " [OK] DLP-policy verwijderd" -ForegroundColor Green } } catch { Write-Error "Fout bij revert: $_" throw } } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Monitoring) { $result = Invoke-Monitoring if ($result) { Write-Host "`nSamenvatting:" -ForegroundColor Cyan Write-Host " Totaal policies : $($result.TotalPolicies)" -ForegroundColor Gray Write-Host " Baseline actief : $($result.BaselinePolicies)" -ForegroundColor Gray Write-Host " Enforce status : $(if ($result.Enforced) { 'Ja' } else { 'Nee' })" -ForegroundColor $(if ($result.Enforced) { 'Green' } else { 'Yellow' }) } } elseif ($Remediation) { Invoke-Remediation } elseif ($Revert) { Invoke-Revert } else { Write-Host "Geen modus opgegeven. Kies een van de volgende opties:" -ForegroundColor Yellow Write-Host " -Monitoring Controleer huidige DLP-configuratie" -ForegroundColor Yellow Write-Host " -Remediation Configureer baseline DLP-policies" -ForegroundColor Yellow Write-Host " -Revert Verwijder baseline DLP-policies (voorzichtig)" -ForegroundColor Yellow Write-Host " -DebugMode Voer controles uit zonder verbinding" -ForegroundColor Yellow } } catch { Write-Error "Fout in dlp-policies-enabled.ps1: $_" throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }