Emergency Access Monitoring

<# .SYNOPSIS Emergency Access Account Monitoring .DESCRIPTION Monitors emergency/break-glass accounts for suspicious activity .NOTES NL Baseline v2.0 #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Emergency Access Monitoring" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Searching for emergency access accounts..." -ForegroundColor Gray $breakGlassAccounts = Get-MgUser -Filter "startswith(displayName,'Break Glass') or startswith(displayName,'Emergency')" -ErrorAction Stop $result = @{ isCompliant = ($breakGlassAccounts.Count -gt 0) emergencyAccounts = $breakGlassAccounts.Count accounts = @() } if ($breakGlassAccounts.Count -eq 0) { Write-Host " ⚠️ No emergency access accounts found" -ForegroundColor Yellow Write-Host " Recommendation: Create 2 emergency access accounts" -ForegroundColor Cyan } else { Write-Host " Emergency Access Accounts found: $($breakGlassAccounts.Count)" -ForegroundColor Green foreach ($acc in $breakGlassAccounts) { Write-Host " - $($acc.UserPrincipalName)" -ForegroundColor Gray $result.accounts += $acc.UserPrincipalName } } Write-Host "`n Best Practices:" -ForegroundColor Cyan Write-Host " • Have 2 break-glass accounts" -ForegroundColor Gray Write-Host " • Store credentials in secure location" -ForegroundColor Gray Write-Host " • Exclude from Conditional Access policies" -ForegroundColor Gray Write-Host " • Monitor for any usage (should be rare!)" -ForegroundColor Gray Write-Host " • Test quarterly to ensure they work" -ForegroundColor Gray if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Create emergency access accounts!" -ForegroundColor Red exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Note: This is a monitoring-only control, remediation delegates to monitoring #> [CmdletBinding()] param() Write-Host "[INFO] This is a monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check instead..." -ForegroundColor Cyan Invoke-Monitoring }