BYOD-beleid Voor Microsoft 365 En Intune

<# .SYNOPSIS BYOD-beleid beoordelen, borgen en rapporteren voor Microsoft 365 en Intune. .DESCRIPTION Voert een controle uit op app protection policies, compliancebeleid en Conditional Access regels rond Bring Your Own Device (BYOD). Het script kan een referentieconfiguratie genereren, monitoringrapporten schrijven en ondersteunt DebugMode voor lokale tests. .NOTES Filename: byod-policies.ps1 Author: Nederlandse Baseline voor Veilige Cloud Created: 2025-11-27 Version: 1.0 Gerelateerd JSON: content/m365/mobile/byod-policies.json Workload: m365 Category: mobile .EXAMPLE .\byod-policies.ps1 -Assessment -ReportPath .\rapporten\byod-check.json Voert een BYOD-beoordeling uit en slaat het resultaat op. .EXAMPLE .\byod-policies.ps1 -PublishBaseline Genereert of actualiseert het BYOD-referentieconfiguratiebestand. .EXAMPLE .\byod-policies.ps1 -Monitoring -ReportPath .\rapporten\byod-monitoring.json Combineert een actuele meting met de configuratie voor auditgebruik. #> #Requires -Version 5.1 [CmdletBinding()] param( [switch]$Assessment, [switch]$PublishBaseline, [switch]$Monitoring, [string]$ReportPath, [switch]$DebugMode, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' $VerbosePreference = 'Continue' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "BYOD Policy Toolkit" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Get-ByodConfigPath { [CmdletBinding()] param() $scriptDir = Split-Path -Parent $PSCommandPath return (Join-Path -Path $scriptDir -ChildPath "byod-policies.config.json") } function Test-RequiredModules { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string[]]$ModuleNames ) foreach ($moduleName in $ModuleNames) { if (-not (Get-Module -ListAvailable -Name $moduleName -ErrorAction SilentlyContinue)) { throw "Vereiste module '$moduleName' is niet gevonden. Installeer de module en voer het script opnieuw uit." } } } function Ensure-GraphConnection { [CmdletBinding()] param() Test-RequiredModules -ModuleNames @('Microsoft.Graph.Authentication') Import-Module Microsoft.Graph.Authentication -ErrorAction Stop | Out-Null $requiredScopes = @( 'DeviceManagementApps.Read.All', 'DeviceManagementConfiguration.Read.All', 'Policy.Read.All' ) $context = Get-MgContext -ErrorAction SilentlyContinue $needsConnect = $true if ($context) { $scopeDifference = Compare-Object -ReferenceObject $requiredScopes -DifferenceObject $context.Scopes if ($scopeDifference.Count -eq 0 -and $context.ExpirationTime -gt (Get-Date)) { $needsConnect = $false } } if ($needsConnect) { Write-Host "Verbinding maken met Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes $requiredScopes -NoWelcome | Out-Null } try { Select-MgProfile -Name beta } catch { throw "Het Microsoft Graph-profiel 'beta' kan niet worden geselecteerd. Update de Microsoft.Graph modules." } } function Invoke-GraphPagedRequest { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string]$Uri ) $results = @() $nextLink = $Uri while ($nextLink) { $response = Invoke-MgGraphRequest -Method GET -Uri $nextLink -OutputType PSObject if ($response.value) { $results += $response.value } $nextLink = $response.'@odata.nextLink' } return $results } function Get-ByodAppProtectionSnapshot { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ PolicyId = 'debug-ios' Name = 'iOS BYOD-beleid' Platform = 'iOS/iPadOS' MinPinLength = 6 EncryptionRequired = $true OfflineHours = 8 CopyPasteLevel = 'managedApps' Assignments = @('Raad van State', 'Inspecties') }, [PSCustomObject]@{ PolicyId = 'debug-android' Name = 'Android BYOD-beleid' Platform = 'Android' MinPinLength = 6 EncryptionRequired = $true OfflineHours = 6 CopyPasteLevel = 'policyManagedWithPasteIn' Assignments = @('Gemeenten', 'Rijksbreed BYOD') } ) } Ensure-GraphConnection $uri = "https://graph.microsoft.com/beta/deviceAppManagement/managedAppPolicies?`$expand=assignments" $policies = Invoke-GraphPagedRequest -Uri $uri $snapshots = @() foreach ($policy in $policies) { $odataType = $policy.'@odata.type' if ($odataType -notmatch 'managedAppProtection') { continue } $platform = switch ($odataType) { '#microsoft.graph.iosManagedAppProtection' { 'iOS/iPadOS' } '#microsoft.graph.androidManagedAppProtection' { 'Android' } default { 'Onbekend' } } $assignments = @() if ($policy.assignments) { foreach ($assignment in $policy.assignments) { if ($assignment.target -and $assignment.target.displayName) { $assignments += $assignment.target.displayName } elseif ($assignment.target -and $assignment.target.'@odata.type') { $assignments += $assignment.target.'@odata.type' } } } $snapshots += [PSCustomObject]@{ PolicyId = $policy.id Name = $policy.displayName Platform = $platform MinPinLength = $policy.minimumPinLength EncryptionRequired = ($policy.appDataEncryptionType -and $policy.appDataEncryptionType -ne 'whenDeviceLocked') OfflineHours = $policy.periodOfflineBeforeAccessCheck CopyPasteLevel = $policy.allowedOutboundClipboardSharingLevel Assignments = $assignments } } return $snapshots } function Get-ByodComplianceSnapshot { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ PolicyId = 'cmp-ios' Platform = 'iOS/iPadOS' RequireEncryption = $true RequireJailbreak = $true MinOSVersion = '17.0' DeviceOwnership = 'personal' }, [PSCustomObject]@{ PolicyId = 'cmp-android' Platform = 'Android' RequireEncryption = $true RequireJailbreak = $true MinOSVersion = '14' DeviceOwnership = 'personal' } ) } Ensure-GraphConnection $uri = "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies?`$select=id,displayName,platformType,deviceThreatProtectionEnabled,minOsVersion,roleScopeTagIds,passwordRequired" $policies = Invoke-GraphPagedRequest -Uri $uri $snapshots = @() foreach ($policy in $policies) { $platform = switch ($policy.platformType) { 'androidForWork' { 'Android' } 'android' { 'Android' } 'iOS' { 'iOS/iPadOS' } 'macOS' { 'macOS' } default { $policy.platformType } } $deviceOwnership = if ($policy.roleScopeTagIds -and ($policy.roleScopeTagIds -contains 'Personal')) { 'personal' } else { 'universal' } $snapshots += [PSCustomObject]@{ PolicyId = $policy.id Name = $policy.displayName Platform = $platform RequireEncryption = [bool]$policy.passwordRequired RequireJailbreak = [bool]$policy.deviceThreatProtectionEnabled MinOSVersion = $policy.minOsVersion DeviceOwnership = $deviceOwnership } } return $snapshots } function Get-ByodConditionalAccessSnapshot { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ PolicyId = 'ca-mobile' Name = 'CA - mobiele toegang' State = 'enabled' RequiresCompliantDevice = $true RequiresApprovedApps = $true DeviceFilter = 'device.trustType -eq "Personal"' } ) } Ensure-GraphConnection $uri = "https://graph.microsoft.com/beta/identity/conditionalAccess/policies?`$select=id,displayName,state,conditions,grantControls" $policies = Invoke-GraphPagedRequest -Uri $uri $snapshots = @() foreach ($policy in $policies) { $grantControls = $policy.grantControls $requiresCompliantDevice = $false $requiresApprovedApps = $false if ($grantControls -and $grantControls.builtInControls) { $requiresCompliantDevice = $grantControls.builtInControls -contains 'compliantDevice' $requiresApprovedApps = $grantControls.builtInControls -contains 'approvedApplication' } $deviceFilter = $null if ($policy.conditions -and $policy.conditions.devices -and $policy.conditions.devices.deviceFilter) { $deviceFilter = $policy.conditions.devices.deviceFilter.rule } $snapshots += [PSCustomObject]@{ PolicyId = $policy.id Name = $policy.displayName State = $policy.state RequiresCompliantDevice = $requiresCompliantDevice RequiresApprovedApps = $requiresApprovedApps DeviceFilter = $deviceFilter } } return $snapshots } function Invoke-ByodPolicyAssessment { [CmdletBinding()] param( [switch]$DebugMode ) $appProtection = Get-ByodAppProtectionSnapshot -DebugMode:$DebugMode $compliance = Get-ByodComplianceSnapshot -DebugMode:$DebugMode $conditional = Get-ByodConditionalAccessSnapshot -DebugMode:$DebugMode $issues = [System.Collections.Generic.List[string]]::new() if (-not $appProtection -or $appProtection.Count -lt 2) { $issues.Add("Er zijn minder dan twee app protection policies gevonden. Configureer minimaal iOS en Android.") } else { foreach ($policy in $appProtection) { if (-not $policy.EncryptionRequired) { $issues.Add("Policy '$($policy.Name)' vereist geen volledige versleuteling voor $($policy.Platform).") } if ($policy.MinPinLength -lt 6) { $issues.Add("Policy '$($policy.Name)' hanteert een te korte pinlengte. Verhoog naar minimaal 6 cijfers.") } if ($policy.OfflineHours -gt 12) { $issues.Add("Policy '$($policy.Name)' staat offline toegang langer dan 12 uur toe. Beperk dit voor BYOD.") } if ($policy.CopyPasteLevel -notin @('managedApps', 'policyManagedWithPasteIn')) { $issues.Add("Policy '$($policy.Name)' blokkeert gegevenskopiëren niet voldoende.") } } } if (-not $compliance -or $compliance.Count -eq 0) { $issues.Add("Er zijn geen compliance policies voor BYOD gevonden.") } else { foreach ($policy in $compliance) { if ($policy.DeviceOwnership -ne 'personal') { $issues.Add("Policy '$($policy.Name)' is niet specifiek toegewezen aan persoonlijke apparaten.") } if (-not $policy.RequireEncryption) { $issues.Add("Policy '$($policy.Name)' vereist geen versleuteling.") } if (-not $policy.RequireJailbreak) { $issues.Add("Policy '$($policy.Name)' controleert jailbreak of rooting niet.") } if ([string]::IsNullOrWhiteSpace($policy.MinOSVersion)) { $issues.Add("Policy '$($policy.Name)' kent geen minimale OS-versie.") } } } $caPolicy = $conditional | Where-Object { $_.RequiresCompliantDevice -and $_.RequiresApprovedApps } if (-not $caPolicy) { $issues.Add("Er is geen Conditional Access-beleid gevonden dat zowel compliant devices als goedgekeurde apps vereist.") } $assessment = [PSCustomObject]@{ Script = 'byod-policies.ps1' Timestamp = Get-Date AppProtection = $appProtection Compliance = $compliance ConditionalAccess = $conditional Issues = $issues IsHealthy = ($issues.Count -eq 0) } return $assessment } function Initialize-ByodConfig { [CmdletBinding()] param( [Parameter(Mandatory = $true)] $Assessment ) $config = [ordered]@{ version = "1.0" lastUpdated = (Get-Date).ToString("yyyy-MM-dd") owner = "BYOD-stuurgroep" governance = @( "Dwing copy/paste-beperkingen af via Intune MAM voor alle mobiele platforms.", "Combineer BYOD-beleid altijd met Conditional Access regels met device filters.", "Actualiseer DPIA en communicatiepakketten bij iedere beleidswijziging." ) appProtection = @() compliance = @() conditionalAccess = @() } if ($Assessment.AppProtection) { foreach ($policy in $Assessment.AppProtection) { $config.appProtection += [ordered]@{ id = $policy.PolicyId name = $policy.Name platform = $policy.Platform minPinLength = $policy.MinPinLength encryption = $policy.EncryptionRequired offlineHours = $policy.OfflineHours } } } if ($Assessment.Compliance) { foreach ($policy in $Assessment.Compliance) { $config.compliance += [ordered]@{ id = $policy.PolicyId platform = $policy.Platform minOsVersion = $policy.MinOSVersion requireEncryption = $policy.RequireEncryption requireJailbreak = $policy.RequireJailbreak } } } if ($Assessment.ConditionalAccess) { foreach ($policy in $Assessment.ConditionalAccess) { $config.conditionalAccess += [ordered]@{ id = $policy.PolicyId name = $policy.Name requiresCompliantDevice = $policy.RequiresCompliantDevice requiresApprovedApps = $policy.RequiresApprovedApps deviceFilter = $policy.DeviceFilter } } } return $config } function Invoke-ByodBaselinePublish { [CmdletBinding()] param( [switch]$DebugMode ) $assessment = Invoke-ByodPolicyAssessment -DebugMode:$DebugMode $config = Initialize-ByodConfig -Assessment $assessment $configPath = Get-ByodConfigPath if ($WhatIf) { Write-Host "[WhatIf] Configuratie zou worden opgeslagen op $configPath" -ForegroundColor Yellow } else { $config | ConvertTo-Json -Depth 6 | Out-File -FilePath $configPath -Encoding UTF8 -Force Write-Host "[OK] BYOD-configuratie opgeslagen: $configPath" -ForegroundColor Green } return $config } function Invoke-ByodMonitoring { [CmdletBinding()] param( [switch]$DebugMode ) $assessment = Invoke-ByodPolicyAssessment -DebugMode:$DebugMode $configPath = Get-ByodConfigPath $config = $null if (Test-Path -Path $configPath) { $config = Get-Content -Path $configPath -Raw | ConvertFrom-Json } else { Write-Host "[WARN] Geen BYOD-configuratiebestand gevonden (verwacht: $configPath)." -ForegroundColor Yellow } $monitoring = [PSCustomObject]@{ Script = 'byod-policies.ps1' Timestamp = Get-Date ConfigPath = $configPath ConfigDetected = [bool]$config ConfigVersion = if ($config) { $config.version } else { "not-found" } LastConfigUpdate = if ($config) { $config.lastUpdated } else { $null } Assessment = $assessment } return $monitoring } function Write-ByodReport { [CmdletBinding()] param( [Parameter(Mandatory = $true)] $Payload, [Parameter(Mandatory = $true)] [string]$Path ) if (-not $Path) { return } $directory = Split-Path -Parent $Path if ($directory -and -not (Test-Path -Path $directory)) { New-Item -ItemType Directory -Path $directory -Force | Out-Null } $Payload | ConvertTo-Json -Depth 6 | Out-File -FilePath $Path -Encoding UTF8 -Force Write-Host "[OK] Rapport geschreven naar $Path" -ForegroundColor Green } $executed = $false if ($PublishBaseline) { $config = Invoke-ByodBaselinePublish -DebugMode:$DebugMode if ($ReportPath) { Write-ByodReport -Payload $config -Path $ReportPath } $executed = $true $config } if ($Assessment) { $result = Invoke-ByodPolicyAssessment -DebugMode:$DebugMode if ($ReportPath) { Write-ByodReport -Payload $result -Path $ReportPath } $executed = $true $result } if ($Monitoring) { $monitoringResult = Invoke-ByodMonitoring -DebugMode:$DebugMode if ($ReportPath) { Write-ByodReport -Payload $monitoringResult -Path $ReportPath } $executed = $true $monitoringResult } if (-not $executed) { Write-Host "Geen modus opgegeven. Gebruik ten minste een van de volgende opties:" -ForegroundColor Yellow Write-Host " -Assessment Voer een BYOD-gezondheidsscan uit." -ForegroundColor Yellow Write-Host " -PublishBaseline Genereer of vernieuw het configuratiebestand." -ForegroundColor Yellow Write-Host " -Monitoring Combineer assessmentgegevens met het configuratiebestand." -ForegroundColor Yellow Write-Host "Optioneel: -DebugMode voor lokale tests, -ReportPath voor JSON-rapportage." -ForegroundColor Yellow } Write-Host "`n========================================`n" -ForegroundColor Cyan