Quick Start: Data Retentie Policies - Week 3

<# .SYNOPSIS Quick Start: Data Retentie .DESCRIPTION Configureert retention policies voor Microsoft 365 data (Email, SharePoint, OneDrive, Teams). VOLLEDIG GEAUTOMATISEERD via Security & Compliance PowerShell. CREATES: - Retention policy voor Email (7 jaar) - Retention policy voor SharePoint/OneDrive (7 jaar) - Retention policy voor Teams (7 jaar) - Optional: Litigation Hold voor specifieke mailboxes .NOTES Filename: 07-data-retentie.ps1 Author: Nederlandse Baseline voor Veilige Cloud Created: 2025-10-16 Related JSON: content/quick-start/07-data-retentie.json Requirement: Microsoft 365 E3/E5 Priority: Week 3 #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(HelpMessage = "Monitor retention policies")] [switch]$Monitoring, [Parameter(HelpMessage = "Create basic 7-year retention policy")] [switch]$Remediation, [Parameter(HelpMessage = "Full implementation (Email + SharePoint + Teams + Litigation Hold)")] [switch]$Implementation, [Parameter(HelpMessage = "Revert (remove policies)")] [switch]$Revert, [Parameter(HelpMessage = "Retention period in days (default: 2555 = 7 years)")] [int]$RetentionDays = 2555, [Parameter(HelpMessage = "Preview changes")] [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Quick Start: Data Retentie" -ForegroundColor Cyan Write-Host "WEEK 3" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Test-Compliance { [CmdletBinding()] param() $result = Invoke-Monitoring return $result.isCompliant } function Invoke-Monitoring { <# .SYNOPSIS Monitors retention policies #> [CmdletBinding()] param() try { Write-Host "`nMonitoring:" -ForegroundColor Yellow Connect-IPPSSession -ShowBanner:$false $result = @{ isCompliant = $false timestamp = Get-Date retentionPolicies = 0 retentionRules = 0 litigationHoldMailboxes = 0 totalMailboxes = 0 policies = @() } # Check retention policies Write-Host "Checking retention policies..." -ForegroundColor Gray $policies = Get-RetentionCompliancePolicy $result.retentionPolicies = $policies.Count foreach ($policy in $policies) { Write-Host " [OK] $($policy.Name)" -ForegroundColor Green Write-Host " Enabled: $($policy.Enabled)" -ForegroundColor Gray Write-Host " Workloads: $($policy.Workload -join ', ')" -ForegroundColor Gray $policyInfo = @{ name = $policy.Name enabled = $policy.Enabled workloads = $policy.Workload } $result.policies += $policyInfo } # Check retention rules Write-Host "`nChecking retention rules..." -ForegroundColor Gray $rules = Get-RetentionComplianceRule $result.retentionRules = $rules.Count foreach ($rule in $rules) { Write-Host " • $($rule.Name)" -ForegroundColor Cyan Write-Host " Duration: $($rule.RetentionDuration) days" -ForegroundColor Gray Write-Host " Action: $($rule.RetentionComplianceAction)" -ForegroundColor Gray } # Check litigation hold mailboxes Write-Host "`nChecking Litigation Hold status..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false $mailboxes = Get-EXOMailbox -ResultSize Unlimited -Properties LitigationHoldEnabled $result.totalMailboxes = $mailboxes.Count $result.litigationHoldMailboxes = ($mailboxes | Where-Object { $_.LitigationHoldEnabled -eq $true }).Count if ($result.litigationHoldMailboxes -gt 0) { Write-Host " ℹ️ Litigation Hold: $($result.litigationHoldMailboxes)/$($result.totalMailboxes) mailboxes" -ForegroundColor Cyan } else { Write-Host " ℹ️ Litigation Hold: Not configured" -ForegroundColor Yellow } # Determine compliance if ($result.retentionPolicies -gt 0 -and $result.retentionRules -gt 0) { $result.isCompliant = $true } # Summary Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "SUMMARY:" -ForegroundColor Cyan Write-Host " Retention Policies: $($result.retentionPolicies)" -ForegroundColor $(if ($result.retentionPolicies -gt 0) { 'Green' } else { 'Red' }) Write-Host " Retention Rules: $($result.retentionRules)" -ForegroundColor $(if ($result.retentionRules -gt 0) { 'Green' } else { 'Red' }) Write-Host " Litigation Hold: $($result.litigationHoldMailboxes)/$($result.totalMailboxes)" -ForegroundColor White if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT: Retention policies configured" -ForegroundColor Green } else { Write-Host "`n[FAIL] NON-COMPLIANT: No retention policies" -ForegroundColor Red } return $result } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red throw } } function Invoke-Remediation { <# .SYNOPSIS Creates basic 7-year retention policy for all workloads #> [CmdletBinding(SupportsShouldProcess)] param() try { Write-Host "`nRemediation:" -ForegroundColor Yellow Connect-IPPSSession -ShowBanner:$false $policyName = "Baseline: 7-Year Retention - All Workloads" $ruleName = "Baseline: 7-Year Retention Rule" Write-Host "Creating retention policy..." -ForegroundColor Gray Write-Host " Name: $policyName" -ForegroundColor Gray Write-Host " Duration: $RetentionDays days (~7 years)" -ForegroundColor Gray if ($PSCmdlet.ShouldProcess($policyName, "Create retention policy")) { # Check if policy exists $existingPolicy = Get-RetentionCompliancePolicy -Identity $policyName -ErrorAction SilentlyContinue if (-not $existingPolicy) { # Create retention policy $newPolicy = New-RetentionCompliancePolicy ` -Name $policyName ` -Comment "Nederlandse Baseline voor Veilige Cloud - 7 jaar retentie voor alle workloads" ` -Enabled $true ` -ExchangeLocation All ` -SharePointLocation All ` -OneDriveLocation All ` -ModernGroupLocation All ` -TeamsChannelLocation All ` -TeamsChatLocation All Write-Host " [OK] Policy created: $policyName" -ForegroundColor Green # Wait for policy to propagate Start-Sleep -Seconds 5 # Create retention rule $newRule = New-RetentionComplianceRule ` -Name $ruleName ` -Policy $policyName ` -RetentionDuration $RetentionDays ` -RetentionComplianceAction Keep ` -Comment "Keep all content for 7 years" Write-Host " [OK] Rule created: $ruleName" -ForegroundColor Green Write-Host " Duration: $RetentionDays days" -ForegroundColor Gray Write-Host " Action: Keep" -ForegroundColor Gray } else { Write-Host " ℹ️ Policy already exists: $policyName" -ForegroundColor Yellow } } Write-Host "`n[OK] Remediation completed" -ForegroundColor Green Write-Host "`nNote: Retention policy takes 24-48 hours to fully propagate" -ForegroundColor Yellow } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red throw } } function Invoke-Implementation { <# .SYNOPSIS Full implementation: Separate policies per workload + Litigation Hold #> [CmdletBinding(SupportsShouldProcess)] param() try { Write-Host "`nImplementation: COMPLETE Retention Setup..." -ForegroundColor Yellow Connect-IPPSSession -ShowBanner:$false Connect-ExchangeOnline -ShowBanner:$false # STEP 1: Email retention (7 years) Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "STEP 1: Email Retention Policy" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan if ($PSCmdlet.ShouldProcess("Email Retention", "Create")) { $emailPolicyName = "Baseline: Email Retention (7 Years)" $existingEmail = Get-RetentionCompliancePolicy -Identity $emailPolicyName -ErrorAction SilentlyContinue if (-not $existingEmail) { $emailPolicy = New-RetentionCompliancePolicy ` -Name $emailPolicyName ` -Comment "Email retention: 7 years" ` -Enabled $true ` -ExchangeLocation All Start-Sleep -Seconds 3 New-RetentionComplianceRule ` -Name "$emailPolicyName Rule" ` -Policy $emailPolicyName ` -RetentionDuration $RetentionDays ` -RetentionComplianceAction Keep Write-Host " [OK] Email retention policy created" -ForegroundColor Green } else { Write-Host " ℹ️ Email policy already exists" -ForegroundColor Yellow } } # STEP 2: SharePoint/OneDrive retention (7 years) Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "STEP 2: SharePoint/OneDrive Retention" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan if ($PSCmdlet.ShouldProcess("SharePoint Retention", "Create")) { $spPolicyName = "Baseline: SharePoint/OneDrive Retention (7 Years)" $existingSP = Get-RetentionCompliancePolicy -Identity $spPolicyName -ErrorAction SilentlyContinue if (-not $existingSP) { $spPolicy = New-RetentionCompliancePolicy ` -Name $spPolicyName ` -Comment "SharePoint and OneDrive retention: 7 years" ` -Enabled $true ` -SharePointLocation All ` -OneDriveLocation All Start-Sleep -Seconds 3 New-RetentionComplianceRule ` -Name "$spPolicyName Rule" ` -Policy $spPolicyName ` -RetentionDuration $RetentionDays ` -RetentionComplianceAction Keep Write-Host " [OK] SharePoint/OneDrive retention policy created" -ForegroundColor Green } else { Write-Host " ℹ️ SharePoint policy already exists" -ForegroundColor Yellow } } # STEP 3: Teams retention (7 years) Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "STEP 3: Teams Retention Policy" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan if ($PSCmdlet.ShouldProcess("Teams Retention", "Create")) { $teamsPolicyName = "Baseline: Teams Retention (7 Years)" $existingTeams = Get-RetentionCompliancePolicy -Identity $teamsPolicyName -ErrorAction SilentlyContinue if (-not $existingTeams) { $teamsPolicy = New-RetentionCompliancePolicy ` -Name $teamsPolicyName ` -Comment "Teams channels and chats retention: 7 years" ` -Enabled $true ` -TeamsChannelLocation All ` -TeamsChatLocation All Start-Sleep -Seconds 3 New-RetentionComplianceRule ` -Name "$teamsPolicyName Rule" ` -Policy $teamsPolicyName ` -RetentionDuration $RetentionDays ` -RetentionComplianceAction Keep Write-Host " [OK] Teams retention policy created" -ForegroundColor Green } else { Write-Host " ℹ️ Teams policy already exists" -ForegroundColor Yellow } } # STEP 4: Optional: Litigation Hold for executives/high-risk users Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "STEP 4: Litigation Hold (Optional)" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host " ℹ️ Litigation Hold not automatically enabled" -ForegroundColor Yellow Write-Host " To enable for specific users:" -ForegroundColor Gray Write-Host " Set-Mailbox -Identity user@domain.com -LitigationHoldEnabled `$true -LitigationHoldDuration 2555" -ForegroundColor Gray Write-Host "`n========================================" -ForegroundColor Green Write-Host "[OK] IMPLEMENTATION COMPLETED!" -ForegroundColor Green Write-Host "========================================" -ForegroundColor Green Write-Host "`nCreated retention policies:" -ForegroundColor Cyan Write-Host " [OK] Email (7 years)" -ForegroundColor White Write-Host " [OK] SharePoint/OneDrive (7 years)" -ForegroundColor White Write-Host " [OK] Teams (7 years)" -ForegroundColor White Write-Host "`nNext steps:" -ForegroundColor Yellow Write-Host " 1. Wait 24-48h for policies to propagate" -ForegroundColor White Write-Host " 2. Test: Get-RetentionCompliancePolicy | fl" -ForegroundColor Gray Write-Host " 3. Monitor compliance in M365 Compliance Center" -ForegroundColor White Write-Host " 4. Consider Litigation Hold for high-risk users" -ForegroundColor White } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red throw } } function Invoke-Revert { <# .SYNOPSIS Removes retention policies #> [CmdletBinding(SupportsShouldProcess)] param() try { Write-Host "`nRevert:" -ForegroundColor Yellow Connect-IPPSSession -ShowBanner:$false $policiesToRemove = @( 'Baseline: 7-Year Retention - All Workloads', 'Baseline: Email Retention (7 Years)', 'Baseline: SharePoint/OneDrive Retention (7 Years)', 'Baseline: Teams Retention (7 Years)' ) foreach ($policyName in $policiesToRemove) { try { $policy = Get-RetentionCompliancePolicy -Identity $policyName -ErrorAction SilentlyContinue if ($policy) { Write-Host " Removing: $policyName" -ForegroundColor Gray # First remove associated rules $rules = Get-RetentionComplianceRule -Policy $policyName -ErrorAction SilentlyContinue foreach ($rule in $rules) { if ($PSCmdlet.ShouldProcess($rule.Name, "Remove rule")) { Remove-RetentionComplianceRule -Identity $rule.Name -Confirm:$false } } # Then remove policy if ($PSCmdlet.ShouldProcess($policyName, "Remove policy")) { Remove-RetentionCompliancePolicy -Identity $policyName -Confirm:$false Write-Host " [OK] Removed" -ForegroundColor Green } } } catch { Write-Host " ⚠️ Error: $_" -ForegroundColor Yellow } } Write-Host "`n[OK] Revert completed" -ForegroundColor Green } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red throw } } # MAIN EXECUTION try { if ($Implementation) { if ($WhatIf) { Write-Host "WhatIf: Would create retention policies for all workloads" -ForegroundColor Yellow } else { Invoke-Implementation } } elseif ($Remediation) { if ($WhatIf) { Write-Host "WhatIf: Would create basic 7-year retention policy" -ForegroundColor Yellow } else { Invoke-Remediation } } elseif ($Revert) { if ($WhatIf) { Write-Host "WhatIf: Would remove retention policies" -ForegroundColor Yellow } else { Invoke-Revert } } elseif ($Monitoring) { $result = Invoke-Monitoring exit $(if ($result.isCompliant) { 0 } else { 1 }) } else { Write-Host "Available parameters:" -ForegroundColor Yellow Write-Host " -Monitoring : Check retention policies status" -ForegroundColor Gray Write-Host " -Remediation : Create 7-year retention policy (all workloads)" -ForegroundColor Gray Write-Host " -Implementation : Full setup (separate policies per workload)" -ForegroundColor Gray Write-Host " -Revert : Remove retention policies" -ForegroundColor Gray Write-Host " -RetentionDays : Custom retention period (default: 2555 = 7 years)" -ForegroundColor Gray Write-Host " -WhatIf : Preview changes" -ForegroundColor Gray } } catch { Write-Error "Script execution failed: $_" exit 2 } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }