SharePoint External Sharing Controls En Veilige Gasttoegang

<# .SYNOPSIS External sharing controls voor SharePoint Online beoordelen en monitoren. .DESCRIPTION Voert controles uit op external sharing-configuraties op tenant-, site collection- en siteniveau voor SharePoint Online. Het script kan een referentieconfiguratie genereren, monitoringrapporten schrijven en ondersteunt DebugMode voor lokale tests. .NOTES Filename: external-sharing-controls.ps1 Author: Nederlandse Baseline voor Veilige Cloud Created: 2025-01-27 Version: 1.0 Gerelateerd JSON: content/m365/sharepoint/external-sharing-controls.json Workload: m365 Category: sharepoint .EXAMPLE .\external-sharing-controls.ps1 -Assessment -ReportPath .\rapporten\external-sharing-check.json Voert een external sharing-beoordeling uit en slaat het resultaat op. .EXAMPLE .\external-sharing-controls.ps1 -Monitoring -ReportPath .\rapporten\external-sharing-monitoring.json Combineert een actuele meting met de configuratie voor auditgebruik. .EXAMPLE .\external-sharing-controls.ps1 -PublishBaseline Genereert of actualiseert het external sharing-referentieconfiguratiebestand. #> #Requires -Version 5.1 [CmdletBinding()] param( [switch]$Assessment, [switch]$PublishBaseline, [switch]$Monitoring, [string]$ReportPath, [switch]$DebugMode, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' $VerbosePreference = 'Continue' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "External Sharing Controls Toolkit" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Get-SharingConfigPath { [CmdletBinding()] param() $scriptDir = Split-Path -Parent $PSCommandPath return (Join-Path -Path $scriptDir -ChildPath "external-sharing-controls.config.json") } function Test-RequiredModules { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string[]]$ModuleNames ) foreach ($moduleName in $ModuleNames) { if (-not (Get-Module -ListAvailable -Name $moduleName -ErrorAction SilentlyContinue)) { throw "Vereiste module '$moduleName' is niet gevonden. Installeer de module en voer het script opnieuw uit." } } } function Ensure-SPOnlineConnection { [CmdletBinding()] param() if ($DebugMode) { Write-Host "[DEBUG] DebugMode: SharePoint Online verbinding overgeslagen" -ForegroundColor Gray return $true } Test-RequiredModules -ModuleNames @('Microsoft.Online.SharePoint.PowerShell') Import-Module Microsoft.Online.SharePoint.PowerShell -ErrorAction Stop | Out-Null try { $tenantUrl = Get-SPOAdminUrl -ErrorAction SilentlyContinue if ($tenantUrl) { Write-Host "SharePoint Online verbinding actief" -ForegroundColor Gray return $true } else { Write-Host "Verbinding maken met SharePoint Online..." -ForegroundColor Gray $domain = (Get-MgDomain -ErrorAction SilentlyContinue | Where-Object { $_.IsDefault }).Id if (-not $domain) { throw "Kan Azure AD domain niet ophalen. Zorg dat u bent verbonden met Microsoft Graph." } $tenantName = $domain.Split('.')[0] $adminUrl = "https://$tenantName-admin.sharepoint.com" Connect-SPOService -Url $adminUrl -ErrorAction Stop | Out-Null return $true } } catch { throw "Kon niet verbinden met SharePoint Online. Zorg dat de Microsoft.Online.SharePoint.PowerShell module is geïnstalleerd en dat u de juiste rechten heeft." } } function Ensure-GraphConnection { [CmdletBinding()] param() if ($DebugMode) { Write-Host "[DEBUG] DebugMode: Microsoft Graph verbinding overgeslagen" -ForegroundColor Gray return $true } Test-RequiredModules -ModuleNames @('Microsoft.Graph.Authentication') Import-Module Microsoft.Graph.Authentication -ErrorAction Stop | Out-Null $requiredScopes = @( 'Directory.Read.All', 'Sites.Read.All', 'AuditLog.Read.All' ) $context = Get-MgContext -ErrorAction SilentlyContinue $needsConnect = $true if ($context) { $scopeDifference = Compare-Object -ReferenceObject $requiredScopes -DifferenceObject $context.Scopes if ($scopeDifference.Count -eq 0 -and $context.ExpirationTime -gt (Get-Date)) { $needsConnect = $false } } if ($needsConnect) { Write-Host "Verbinding maken met Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes $requiredScopes -NoWelcome | Out-Null } return $true } function Get-TenantSharingSnapshot { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return [PSCustomObject]@{ SharingCapability = 'ExternalUserSharingOnly' SharingDomainRestrictionMode = 'None' BlockGuestsAsSiteAdmin = $true FileAnonymousLinkType = 'None' FolderAnonymousLinkType = 'None' RequireAnonymousLinksExpireInDays = 0 } } Ensure-SPOnlineConnection | Out-Null $tenant = Get-SPOTenant return [PSCustomObject]@{ SharingCapability = $tenant.SharingCapability SharingDomainRestrictionMode = $tenant.SharingDomainRestrictionMode BlockGuestsAsSiteAdmin = $tenant.BlockGuestsAsSiteAdmin FileAnonymousLinkType = $tenant.FileAnonymousLinkType FolderAnonymousLinkType = $tenant.FolderAnonymousLinkType RequireAnonymousLinksExpireInDays = $tenant.RequireAnonymousLinksExpireInDays } } function Get-SiteCollectionSharingSnapshot { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ Url = 'https://contoso.sharepoint.com/sites/public' SharingCapability = 'ExternalUserSharingOnly' SharingAllowedDomainList = @() ShowPeoplePickerSuggestionsForGuests = $false }, [PSCustomObject]@{ Url = 'https://contoso.sharepoint.com/sites/confidential' SharingCapability = 'Disabled' SharingAllowedDomainList = @() ShowPeoplePickerSuggestionsForGuests = $false } ) } Ensure-SPOnlineConnection | Out-Null $siteCollections = Get-SPOSite -Limit All | Select-Object -First 50 $snapshots = @() foreach ($site in $siteCollections) { $siteProps = Get-SPOSite -Identity $site.Url -Detailed $snapshots += [PSCustomObject]@{ Url = $site.Url SharingCapability = $siteProps.SharingCapability SharingAllowedDomainList = $siteProps.SharingAllowedDomainList ShowPeoplePickerSuggestionsForGuests = $siteProps.ShowPeoplePickerSuggestionsForGuests } } return $snapshots } function Get-GuestAccountsSnapshot { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ UserPrincipalName = 'guest@external.com' DisplayName = 'External User' UserType = 'Guest' CreatedDateTime = (Get-Date).AddDays(-90) LastSignIn = (Get-Date).AddDays(-10) } ) } Ensure-GraphConnection | Out-Null Import-Module Microsoft.Graph.Users -ErrorAction Stop | Out-Null $guests = Get-MgUser -Filter "userType eq 'Guest'" -All -ErrorAction SilentlyContinue $snapshots = @() foreach ($guest in $guests) { $lastSignIn = $null try { $signIns = Get-MgUserSignInActivity -UserId $guest.Id -ErrorAction SilentlyContinue if ($signIns) { $lastSignIn = $signIns[0].LastSignInDateTime } } catch { # Ignore errors retrieving sign-in data } $snapshots += [PSCustomObject]@{ UserPrincipalName = $guest.UserPrincipalName DisplayName = $guest.DisplayName UserType = $guest.UserType CreatedDateTime = $guest.CreatedDateTime LastSignIn = $lastSignIn } } return $snapshots } function Invoke-ExternalSharingAssessment { [CmdletBinding()] param( [switch]$DebugMode ) $tenantSharing = Get-TenantSharingSnapshot -DebugMode:$DebugMode $siteCollections = Get-SiteCollectionSharingSnapshot -DebugMode:$DebugMode $guestAccounts = Get-GuestAccountsSnapshot -DebugMode:$DebugMode $issues = [System.Collections.Generic.List[string]]::new() # Check tenant-level settings if ($tenantSharing.SharingCapability -eq 'ExternalUserAndGuestSharing') { $issues.Add("Tenant-level sharing is te permissief (ExternalUserAndGuestSharing). Overweeg ExternalUserSharingOnly of ExistingExternalUserSharingOnly.") } if ($tenantSharing.FileAnonymousLinkType -ne 'None' -or $tenantSharing.FolderAnonymousLinkType -ne 'None') { $issues.Add("Anonieme links zijn ingeschakeld op tenant-niveau. Dit vormt een beveiligingsrisico voor Nederlandse overheidsorganisaties.") if ($tenantSharing.RequireAnonymousLinksExpireInDays -eq 0) { $issues.Add("Anonieme links hebben geen vervaldatum als deze zijn ingeschakeld.") } } if (-not $tenantSharing.BlockGuestsAsSiteAdmin) { $issues.Add("Gasten kunnen site administrator worden. Dit moet worden geblokkeerd voor beveiliging.") } # Check site collection overrides $sitesWithOpenSharing = $siteCollections | Where-Object { $_.SharingCapability -eq 'ExternalUserAndGuestSharing' } if ($sitesWithOpenSharing) { $issues.Add("Er zijn $($sitesWithOpenSharing.Count) site collection(s) met te permissieve sharing-instellingen (ExternalUserAndGuestSharing).") } $sitesWithAnonymous = $siteCollections | Where-Object { $_.SharingCapability -eq 'Anyone' } if ($sitesWithAnonymous) { $issues.Add("Er zijn $($sitesWithAnonymous.Count) site collection(s) met anonieme sharing ingeschakeld. Dit moet worden geblokkeerd.") } # Check guest accounts $inactiveGuests = $guestAccounts | Where-Object { $_.LastSignIn -and ((Get-Date) - $_.LastSignIn).TotalDays -gt 90 } if ($inactiveGuests) { $issues.Add("Er zijn $($inactiveGuests.Count) gastaccount(s) die meer dan 90 dagen niet actief zijn geweest. Overweeg deze te verwijderen.") } $oldGuests = $guestAccounts | Where-Object { -not $_.LastSignIn -and ((Get-Date) - $_.CreatedDateTime).TotalDays -gt 180 } if ($oldGuests) { $issues.Add("Er zijn $($oldGuests.Count) gastaccount(s) die nooit zijn ingelogd en ouder zijn dan 180 dagen. Overweeg deze te verwijderen.") } $assessment = [PSCustomObject]@{ Script = 'external-sharing-controls.ps1' Timestamp = Get-Date TenantSharing = $tenantSharing SiteCollections = $siteCollections GuestAccounts = $guestAccounts Issues = $issues IsHealthy = ($issues.Count -eq 0) } return $assessment } function Initialize-SharingConfig { [CmdletBinding()] param( [Parameter(Mandatory = $true)] $Assessment ) $config = [ordered]@{ version = "1.0" lastUpdated = (Get-Date).ToString("yyyy-MM-dd") owner = "CISO / SharePoint Administrator" governance = @( "External sharing moet worden beperkt tot geverifieerde externe gebruikers (geen anonieme links).", "Site collection-level overrides moeten worden gedocumenteerd en gerechtvaardigd.", "Gastaccounts moeten periodiek worden beoordeeld en opgeruimd wanneer niet meer nodig." ) tenantSharing = [ordered]@{ sharingCapability = $Assessment.TenantSharing.SharingCapability fileAnonymousLinkType = $Assessment.TenantSharing.FileAnonymousLinkType folderAnonymousLinkType = $Assessment.TenantSharing.FolderAnonymousLinkType blockGuestsAsSiteAdmin = $Assessment.TenantSharing.BlockGuestsAsSiteAdmin } siteCollections = @() guestAccounts = @() } if ($Assessment.SiteCollections) { foreach ($site in $Assessment.SiteCollections) { $config.siteCollections += [ordered]@{ url = $site.Url sharingCapability = $site.SharingCapability allowedDomains = $site.SharingAllowedDomainList } } } if ($Assessment.GuestAccounts) { foreach ($guest in $Assessment.GuestAccounts | Select-Object -First 100) { $config.guestAccounts += [ordered]@{ userPrincipalName = $guest.UserPrincipalName displayName = $guest.DisplayName createdDateTime = $guest.CreatedDateTime lastSignIn = $guest.LastSignIn } } } return $config } function Invoke-ExternalSharingBaselinePublish { [CmdletBinding()] param( [switch]$DebugMode ) $assessment = Invoke-ExternalSharingAssessment -DebugMode:$DebugMode $config = Initialize-SharingConfig -Assessment $assessment $configPath = Get-SharingConfigPath if ($WhatIf) { Write-Host "[WhatIf] Configuratie zou worden opgeslagen op $configPath" -ForegroundColor Yellow } else { $config | ConvertTo-Json -Depth 6 | Out-File -FilePath $configPath -Encoding UTF8 -Force Write-Host "[OK] External sharing-configuratie opgeslagen: $configPath" -ForegroundColor Green } return $config } function Invoke-ExternalSharingMonitoring { [CmdletBinding()] param( [switch]$DebugMode ) $assessment = Invoke-ExternalSharingAssessment -DebugMode:$DebugMode $configPath = Get-SharingConfigPath $config = $null if (Test-Path -Path $configPath) { $config = Get-Content -Path $configPath -Raw | ConvertFrom-Json } else { Write-Host "[WARN] Geen external sharing-configuratiebestand gevonden (verwacht: $configPath)." -ForegroundColor Yellow } $monitoring = [PSCustomObject]@{ Script = 'external-sharing-controls.ps1' Timestamp = Get-Date ConfigPath = $configPath ConfigDetected = [bool]$config ConfigVersion = if ($config) { $config.version } else { "not-found" } LastConfigUpdate = if ($config) { $config.lastUpdated } else { $null } Assessment = $assessment } return $monitoring } function Write-SharingReport { [CmdletBinding()] param( [Parameter(Mandatory = $true)] $Payload, [Parameter(Mandatory = $true)] [string]$Path ) if (-not $Path) { return } $directory = Split-Path -Parent $Path if ($directory -and -not (Test-Path -Path $directory)) { New-Item -ItemType Directory -Path $directory -Force | Out-Null } $Payload | ConvertTo-Json -Depth 6 | Out-File -FilePath $Path -Encoding UTF8 -Force Write-Host "[OK] Rapport geschreven naar $Path" -ForegroundColor Green } $executed = $false if ($PublishBaseline) { $config = Invoke-ExternalSharingBaselinePublish -DebugMode:$DebugMode if ($ReportPath) { Write-SharingReport -Payload $config -Path $ReportPath } $executed = $true $config } if ($Assessment) { $result = Invoke-ExternalSharingAssessment -DebugMode:$DebugMode if ($ReportPath) { Write-SharingReport -Payload $result -Path $ReportPath } $executed = $true Write-Host "`nAssessment Resultaten:" -ForegroundColor Cyan Write-Host (" Status: {0}" -f ($(if ($result.IsHealthy) { "GEZOND" } else { "ISSUES GEVONDEN" }))) -ForegroundColor $(if ($result.IsHealthy) { 'Green' } else { 'Yellow' }) Write-Host (" Aantal issues: {0}" -f $result.Issues.Count) -ForegroundColor White if ($result.Issues.Count -gt 0) { Write-Host "`n Gevonden issues:" -ForegroundColor Yellow foreach ($issue in $result.Issues) { Write-Host (" - {0}" -f $issue) -ForegroundColor Yellow } } $result } if ($Monitoring) { $monitoringResult = Invoke-ExternalSharingMonitoring -DebugMode:$DebugMode if ($ReportPath) { Write-SharingReport -Payload $monitoringResult -Path $ReportPath } $executed = $true Write-Host "`nMonitoring Resultaten:" -ForegroundColor Cyan Write-Host (" Configuratie gevonden: {0}" -f $(if ($monitoringResult.ConfigDetected) { "JA" } else { "NEE" })) -ForegroundColor White if ($monitoringResult.Assessment.Issues.Count -gt 0) { Write-Host (" Aantal issues: {0}" -f $monitoringResult.Assessment.Issues.Count) -ForegroundColor Yellow } else { Write-Host " Status: GEEN ISSUES GEVONDEN" -ForegroundColor Green } $monitoringResult } if (-not $executed) { Write-Host "Geen modus opgegeven. Gebruik ten minste een van de volgende opties:" -ForegroundColor Yellow Write-Host " -Assessment Voer een external sharing-gezondheidsscan uit." -ForegroundColor Yellow Write-Host " -PublishBaseline Genereer of vernieuw het configuratiebestand." -ForegroundColor Yellow Write-Host " -Monitoring Combineer assessmentgegevens met het configuratiebestand." -ForegroundColor Yellow Write-Host "Optioneel: -DebugMode voor lokale tests, -ReportPath voor JSON-rapportage." -ForegroundColor Yellow } Write-Host "`n========================================`n" -ForegroundColor Cyan