Applicatiemodernisering Voor Microsoft 365

<# .SYNOPSIS Inventariseert en monitort applicatiemodernisering binnen Microsoft 365. .DESCRIPTION Het script hoort bij het artikel "Applicatiemodernisering voor Microsoft 365" en levert drie hoofdscenario's: - Invoke-AppModernizationAssessment : beoordeelt app-registraties, configuratie en pipelines - Invoke-AppModernizationMonitoring : combineert metingen met service health voor doorlopende rapportages - Publish-AppModernizationBlueprint : publiceert een blauwdruk met governance- en migratiegegevens DebugMode genereert voorbeelddata en slaat cloudverbindingen over zodat lokale tests binnen vijftien seconden kunnen worden uitgevoerd, conform de richtlijnen van de Nederlandse Baseline voor Veilige Cloud. .NOTES Bestandsnaam : application-modernization.ps1 Auteur : Nederlandse Baseline voor Veilige Cloud Created : 2025-11-27 Versie : 1.0 JSON : content/m365/modernization/application-modernization.json Workload : Microsoft 365 - Modernization .EXAMPLE .\application-modernization.ps1 -Assess -DebugMode Voert een beoordeling uit op basis van voorbeelddata zonder Microsoft Graph te raadplegen. .EXAMPLE .\application-modernization.ps1 -Monitoring -ReportPath .\reports\modernization-monitoring.json Combineert een actuele meting met service health en schrijft de output naar het opgegeven pad. .EXAMPLE .\application-modernization.ps1 -PublishBlueprint Actualiseert de moderniseringsblauwdruk en schrijft een auditeerbaar bestand weg. #> #Requires -Version 5.1 [CmdletBinding()] param( [switch]$Assess, [switch]$PublishBlueprint, [switch]$Monitoring, [string]$ReportPath, [switch]$DebugMode, [switch]$WhatIf ) Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' $VerbosePreference = 'Continue' if (-not ($Assess -or $PublishBlueprint -or $Monitoring)) { $Assess = $true } $operationCount = [int]([bool]$Assess) + [int]([bool]$PublishBlueprint) + [int]([bool]$Monitoring) Write-Host "`n============================================" -ForegroundColor Cyan Write-Host "Application Modernization Toolkit (M365)" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "============================================`n" -ForegroundColor Cyan function Resolve-ReportPath { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string]$Operation ) if ($ReportPath) { if ($operationCount -gt 1) { $dir = Split-Path -Parent $ReportPath if (-not $dir -or $dir -eq '') { $dir = Get-Location } $name = Split-Path -Leaf $ReportPath $baseName = [System.IO.Path]::GetFileNameWithoutExtension($name) $ext = [System.IO.Path]::GetExtension($name) if (-not $ext) { $ext = '.json' } return (Join-Path -Path $dir -ChildPath ("{0}-{1}{2}" -f $baseName, $Operation, $ext)) } return $ReportPath } return (Join-Path -Path (Get-Location) -ChildPath ("application-modernization-{0}.json" -f $Operation)) } function Get-AppModernizationConfigPath { [CmdletBinding()] param() $scriptDir = Split-Path -Parent $PSCommandPath return (Join-Path -Path $scriptDir -ChildPath 'application-modernization.config.json') } function Initialize-AppModernizationConfig { [CmdletBinding()] param() $configPath = Get-AppModernizationConfigPath if (Test-Path $configPath) { return } $baseline = [ordered]@{ version = '1.0' lastUpdated = (Get-Date).ToString('yyyy-MM-dd') owner = 'Modernization Board' modernizationKpis = @{ MaxLegacyShare = 0.25 TargetManagedIdentity = 0.8 PipelineComplianceRatio = 0.9 } legacyCriteria = @{ MaxAgeDays = 1825 RequireManagedIdentity = $true RequireCertificateAuth = $true } priorityApps = @( @{ Name = 'Zaakgericht Portaal' BusinessOwner = 'Directie Dienstverlening' Classification = 'Hoog' TargetPlatform = 'Power Platform + Dataverse' MigrationDue = (Get-Date).AddMonths(6).ToString('yyyy-MM-dd') }, @{ Name = 'Incidentmeldingen Openbare Ruimte' BusinessOwner = 'Afdeling Openbare Orde' Classification = 'Midden' TargetPlatform = 'Teams + Azure Functions' MigrationDue = (Get-Date).AddMonths(4).ToString('yyyy-MM-dd') }, @{ Name = 'Subsidiebeheer Cultuur' BusinessOwner = 'Directie Cultuur' Classification = 'Hoog' TargetPlatform = 'SharePoint Syntex + Power Automate' MigrationDue = (Get-Date).AddMonths(8).ToString('yyyy-MM-dd') } ) pipelines = @( @{ Name = 'Azure DevOps - Werkplek Platform' Environment = 'Productie' IaCLanguage = 'Bicep' QualityGates = @('SecurityScan', 'PolicyCompliance', 'ChangeApproval') LastAudit = (Get-Date).AddDays(-12).ToString('yyyy-MM-dd') Status = 'Compliant' }, @{ Name = 'GitHub Actions - Power Platform' Environment = 'Acceptatie' IaCLanguage = 'ALM Accelerator' QualityGates = @('SolutionChecker', 'StaticCodeAnalysis') LastAudit = (Get-Date).AddDays(-38).ToString('yyyy-MM-dd') Status = 'Attention' } ) } $baseline | ConvertTo-Json -Depth 6 | Set-Content -Path $configPath -Encoding UTF8 Write-Verbose "Baselineconfiguratie aangemaakt: $configPath" } function Get-AppModernizationConfig { [CmdletBinding()] param( [switch]$InitializeIfMissing ) $configPath = Get-AppModernizationConfigPath if (-not (Test-Path $configPath)) { if ($InitializeIfMissing -or $DebugMode) { Initialize-AppModernizationConfig } else { throw "Configuratiebestand ontbreekt ($configPath). Voer het script één keer met -DebugMode of -PublishBlueprint uit." } } $raw = Get-Content -Path $configPath -Raw -Encoding UTF8 return ($raw | ConvertFrom-Json -Depth 6) } function Test-RequiredModules { [CmdletBinding()] param( [string[]]$ModuleNames = @('Microsoft.Graph.Authentication') ) foreach ($moduleName in $ModuleNames) { if (-not (Get-Module -ListAvailable -Name $moduleName -ErrorAction SilentlyContinue)) { throw "Vereiste module '$moduleName' ontbreekt. Installeer deze voordat u het script zonder DebugMode gebruikt." } } } function Connect-AppModernizationGraph { [CmdletBinding()] param() if ($DebugMode) { Write-Verbose "DebugMode actief: Graph-verbinding niet nodig." return } Test-RequiredModules Import-Module Microsoft.Graph.Authentication -ErrorAction Stop | Out-Null $scopes = @( 'Application.Read.All', 'Policy.Read.All', 'ServiceHealth.Read.All' ) $context = Get-MgContext -ErrorAction SilentlyContinue $needsConnect = $true if ($context -and $context.Scopes) { $missing = Compare-Object -ReferenceObject $scopes -DifferenceObject $context.Scopes if ($missing.Count -eq 0 -and $context.ExpirationTime -gt (Get-Date)) { $needsConnect = $false } } if ($needsConnect) { Write-Host "Verbinding maken met Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes $scopes -NoWelcome | Out-Null } try { Select-MgProfile -Name beta } catch { throw "Kon Microsoft Graph-profiel 'beta' niet selecteren. Update de Microsoft.Graph modules." } } function Invoke-GraphPagedRequest { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string]$Uri ) $results = @() $nextLink = $Uri while ($nextLink) { $response = Invoke-MgGraphRequest -Method GET -Uri $nextLink -OutputType PSObject if ($response.value) { $results += $response.value } $nextLink = $response.'@odata.nextLink' } return $results } function Get-AppLifecycleInsights { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ AppId = 'debug-legacy-001' Name = 'Legacy Subsidieportaal' Created = (Get-Date).AddYears(-7) SignInAudience = 'AzureADMyOrg' SecretCount = 3 CertificateCount = 0 HasModernEndpoints= $false AgeDays = 2555 }, [PSCustomObject]@{ AppId = 'debug-modern-010' Name = 'Teams Process Hub' Created = (Get-Date).AddMonths(-8) SignInAudience = 'AzureADMultipleOrgs' SecretCount = 0 CertificateCount = 2 HasModernEndpoints= $true AgeDays = 240 }, [PSCustomObject]@{ AppId = 'debug-risk-021' Name = 'InspectieFormulieren' Created = (Get-Date).AddYears(-4) SignInAudience = 'AzureADMyOrg' SecretCount = 1 CertificateCount = 0 HasModernEndpoints= $true AgeDays = 1460 } ) } Connect-AppModernizationGraph $uri = "https://graph.microsoft.com/beta/applications?`$select=id,displayName,signInAudience,createdDateTime,passwordCredentials,keyCredentials,spa,web&`$top=50" $applications = Invoke-GraphPagedRequest -Uri $uri $insights = @() foreach ($app in $applications) { $spaEnabled = $false if ($app.spa -and $app.spa.redirectUris -and $app.spa.redirectUris.Count -gt 0) { $spaEnabled = $true } $webEnabled = $false if ($app.web -and $app.web.redirectUris -and $app.web.redirectUris.Count -gt 0) { $webEnabled = $true } $secretCount = if ($app.passwordCredentials) { $app.passwordCredentials.Count } else { 0 } $certificateCount = if ($app.keyCredentials) { $app.keyCredentials.Count } else { 0 } $created = Get-Date $app.createdDateTime $ageDays = [math]::Round(((Get-Date) - $created).TotalDays, 0) $insights += [PSCustomObject]@{ AppId = $app.id Name = $app.displayName Created = $created SignInAudience = $app.signInAudience SecretCount = $secretCount CertificateCount = $certificateCount HasModernEndpoints= ($spaEnabled -or $webEnabled) AgeDays = $ageDays } } return $insights } function Get-WorkloadHealthInsights { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return [PSCustomObject]@{ OpenIssues = 1 ImpactedServices = @('Teams', 'Azure DevOps') Notes = 'Teams incident TM987654 beïnvloedt custom app publishing.' GeneratedOn = (Get-Date).ToString('o') } } Connect-AppModernizationGraph try { $issues = Invoke-MgGraphRequest -Method GET -Uri 'https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues?$top=5' $open = @() if ($issues.value) { $open = $issues.value | Where-Object { $_.status -ne 'ServiceRestored' } } return [PSCustomObject]@{ OpenIssues = $open.Count ImpactedServices = ($open | Select-Object -ExpandProperty service -Unique) Notes = if ($open.Count -gt 0) { $open[0].summary } else { 'Geen actieve verstoringen' } GeneratedOn = (Get-Date).ToString('o') } } catch { Write-Warning "Service Health kon niet worden opgehaald: $_" return [PSCustomObject]@{ OpenIssues = 0 ImpactedServices = @() Notes = 'Geen data beschikbaar' GeneratedOn = (Get-Date).ToString('o') } } } function Get-PipelineSnapshots { [CmdletBinding()] param( [Parameter(Mandatory = $true)] $Configuration, [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ Name = 'Azure DevOps - Werkplek Platform' Environment = 'Productie' IaC = 'Bicep' QualityGates = @('SecurityScan', 'PolicyCompliance') LastAudit = (Get-Date).AddDays(-5).ToString('yyyy-MM-dd') Status = 'Compliant' IsCompliant = $true }, [PSCustomObject]@{ Name = 'GitHub Actions - Power Platform' Environment = 'Acceptatie' IaC = 'ALM Accelerator' QualityGates = @('SolutionChecker') LastAudit = (Get-Date).AddDays(-45).ToString('yyyy-MM-dd') Status = 'Attention' IsCompliant = $false } ) } $snapshots = @() if ($Configuration.pipelines) { foreach ($pipeline in $Configuration.pipelines) { $lastAudit = $pipeline.LastAudit $auditDate = $null $auditFresh = $false if ($lastAudit) { try { $auditDate = [datetime]::Parse($lastAudit) $auditFresh = ((Get-Date) - $auditDate).TotalDays -le 30 } catch { $auditFresh = $false } } $isCompliant = ($pipeline.Status -eq 'Compliant' -and $auditFresh) $snapshots += [PSCustomObject]@{ Name = $pipeline.Name Environment = $pipeline.Environment IaC = $pipeline.IaCLanguage QualityGates = $pipeline.QualityGates LastAudit = $pipeline.LastAudit Status = $pipeline.Status IsCompliant = $isCompliant } } } return $snapshots } function Invoke-AppModernizationAssessment { [CmdletBinding()] param( [switch]$DebugMode ) $config = Get-AppModernizationConfig -InitializeIfMissing $apps = Get-AppLifecycleInsights -DebugMode:$DebugMode $pipelines = Get-PipelineSnapshots -Configuration $config -DebugMode:$DebugMode $issues = [System.Collections.Generic.List[string]]::new() $legacyThreshold = [int]$config.legacyCriteria.MaxAgeDays $requireManagedIdentity = [bool]$config.legacyCriteria.RequireManagedIdentity $requireCertificateAuth = [bool]$config.legacyCriteria.RequireCertificateAuth $legacyApps = @() foreach ($app in $apps) { $isLegacy = $false if ($app.AgeDays -gt $legacyThreshold) { $isLegacy = $true } if ($requireCertificateAuth -and $app.SecretCount -gt 0 -and $app.CertificateCount -eq 0) { $isLegacy = $true } if ($requireManagedIdentity -and -not $app.HasModernEndpoints) { $isLegacy = $true } if ($isLegacy) { $legacyApps += $app } } $legacyRatio = if ($apps.Count -gt 0) { [math]::Round(($legacyApps.Count / $apps.Count), 2) } else { 0 } $managedCoverage = if ($apps.Count -gt 0) { [math]::Round((($apps | Where-Object { $_.CertificateCount -gt 0 }).Count / $apps.Count), 2) } else { 0 } $pipelineCompliance = if ($pipelines.Count -gt 0) { [math]::Round((($pipelines | Where-Object { $_.IsCompliant }).Count / $pipelines.Count), 2) } else { 0 } if ($legacyRatio -gt $config.modernizationKpis.MaxLegacyShare) { $issues.Add("Het percentage legacy-applicaties ($legacyRatio) overschrijdt de drempel van $($config.modernizationKpis.MaxLegacyShare).") } if ($managedCoverage -lt $config.modernizationKpis.TargetManagedIdentity) { $issues.Add("Managed identity dekking ($managedCoverage) is lager dan het doel van $($config.modernizationKpis.TargetManagedIdentity).") } if ($pipelineCompliance -lt $config.modernizationKpis.PipelineComplianceRatio) { $issues.Add("Slechts $pipelineCompliance van de pipelines is aantoonbaar compliant terwijl $($config.modernizationKpis.PipelineComplianceRatio) is vereist.") } if ($legacyApps.Count -eq 0) { $issues.Add("Er zijn geen legacy-applicaties gevonden. Bevestig of de configuratiecriteria correct zijn.") } return [PSCustomObject]@{ Script = 'application-modernization.ps1' Timestamp = Get-Date ConfigVersion = $config.version LegacyRatio = $legacyRatio ManagedIdentityShare = $managedCoverage PipelineCompliance = $pipelineCompliance LegacyApps = $legacyApps Pipelines = $pipelines PriorityApps = $config.priorityApps Issues = $issues IsHealthy = ($issues.Count -eq 0) } } function Get-ContentHash { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string]$InputObject ) $sha = [System.Security.Cryptography.SHA256]::Create() try { $bytes = [System.Text.Encoding]::UTF8.GetBytes($InputObject) $hashBytes = $sha.ComputeHash($bytes) return ($hashBytes | ForEach-Object { $_.ToString('x2') }) -join '' } finally { $sha.Dispose() } } function Publish-AppModernizationBlueprint { [CmdletBinding()] param() $config = Get-AppModernizationConfig -InitializeIfMissing $config.lastUpdated = (Get-Date).ToString('yyyy-MM-dd') $configPath = Get-AppModernizationConfigPath $config | ConvertTo-Json -Depth 6 | Set-Content -Path $configPath -Encoding UTF8 $raw = Get-Content -Path $configPath -Raw -Encoding UTF8 $hash = Get-ContentHash -InputObject $raw return [PSCustomObject]@{ Script = 'application-modernization.ps1' GeneratedOn = (Get-Date).ToString('o') ConfigVersion = $config.version Owner = $config.owner LegacyCriteria= $config.legacyCriteria ModernizationKpis = $config.modernizationKpis PriorityApps = $config.priorityApps Pipelines = $config.pipelines BlueprintHash = $hash SourceFile = $configPath } } function Invoke-AppModernizationMonitoring { [CmdletBinding()] param( [switch]$DebugMode ) $config = Get-AppModernizationConfig -InitializeIfMissing $assessment = Invoke-AppModernizationAssessment -DebugMode:$DebugMode $health = Get-WorkloadHealthInsights -DebugMode:$DebugMode return [PSCustomObject]@{ Script = 'application-modernization.ps1' Timestamp = Get-Date ConfigVersion = $config.version Assessment = $assessment ServiceHealth = $health Owner = $config.owner } } function Save-ModernizationReport { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [psobject]$Data, [Parameter(Mandatory = $true)] [string]$Path ) $directory = Split-Path -Parent $Path if ($directory -and -not (Test-Path $directory)) { New-Item -Path $directory -ItemType Directory -Force | Out-Null } $json = $Data | ConvertTo-Json -Depth 8 if ($WhatIf) { Write-Host "[WhatIf] Rapport zou worden opgeslagen op $Path" -ForegroundColor Yellow return } Set-Content -Path $Path -Value $json -Encoding UTF8 Write-Host "Resultaat opgeslagen op $Path" -ForegroundColor Green } if ($Assess) { $assessment = Invoke-AppModernizationAssessment -DebugMode:$DebugMode $path = Resolve-ReportPath -Operation 'assessment' Save-ModernizationReport -Data $assessment -Path $path } if ($Monitoring) { $monitoring = Invoke-AppModernizationMonitoring -DebugMode:$DebugMode $path = Resolve-ReportPath -Operation 'monitoring' Save-ModernizationReport -Data $monitoring -Path $path } if ($PublishBlueprint) { $blueprint = Publish-AppModernizationBlueprint $path = Resolve-ReportPath -Operation 'blueprint' Save-ModernizationReport -Data $blueprint -Path $path }