Idle Sessie Timeout Unmanaged

<# .SYNOPSIS Idle Session Timeout for Unmanaged Devices .DESCRIPTION Checks for Conditional Access policies with session timeouts for unmanaged devices .NOTES NL Baseline v2.0 #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Idle Session Timeout (Unmanaged)" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ policiesWithTimeout = 0; compliantPolicies = @() } foreach ($policy in $policies.value) { if ($policy.state -eq 'enabled' -and $policy.sessionControls.signInFrequency) { $result.policiesWithTimeout++ $result.compliantPolicies += $policy.displayName Write-Host " [OK] $($policy.displayName)" -ForegroundColor Green Write-Host " Frequency: $($policy.sessionControls.signInFrequency.value) $($policy.sessionControls.signInFrequency.type)" -ForegroundColor Cyan } } Write-Host "`n Policies with session timeout: $($result.policiesWithTimeout)" -ForegroundColor Cyan if ($result.policiesWithTimeout -eq 0) { Write-Host "`n ⚠️ Recommendation:" -ForegroundColor Yellow Write-Host " Create CA policy targeting unmanaged devices" -ForegroundColor Gray Write-Host " with sign-in frequency of 1-8 hours" -ForegroundColor Gray } Write-Host "`n Note: Configure via Conditional Access" -ForegroundColor Gray if ($result.policiesWithTimeout -gt 0) { Write-Host "`n[OK] COMPLIANT - Session timeouts configured" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ RECOMMENDED - Configure session timeouts" -ForegroundColor Yellow exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }