Identiteitsbescherming Signin Risk

<# .SYNOPSIS Identity Protection - Sign-in Risk Policy .DESCRIPTION Ensures Azure AD Identity Protection sign-in risk policy is configured. Automatically blocks or requires MFA for risky sign-ins. .NOTES Filename: identity-protection-signin-risk.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Azure AD Premium P2 .EXAMPLE .\identity-protection-signin-risk.ps1 -Monitoring Check if sign-in risk policy is configured #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Identity Protection - Sign-in Risk" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Identity Protection - Sign-in Risk Policy .DESCRIPTION Ensures Azure AD Identity Protection sign-in risk policy is configured. Automatically blocks or requires MFA for risky sign-ins. .NOTES Filename: identity-protection-signin-risk.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Azure AD Premium P2 .EXAMPLE .\identity-protection-signin-risk.ps1 -Monitoring Check if sign-in risk policy is configured #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Identity Protection - Sign-in Risk" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking sign-in risk policies..." -ForegroundColor Gray try { $riskPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies" ` -ErrorAction Stop $result = @{ isCompliant = $false riskPolicies = 0 policyNames = @() } foreach ($policy in $riskPolicy.value) { if ($policy.state -ne 'enabled') { continue } # Check if policy responds to sign-in risk $hasRiskLevels = $policy.conditions.signInRiskLevels.Count -gt 0 if ($hasRiskLevels) { $result.riskPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true $riskLevels = $policy.conditions.signInRiskLevels -join ', ' Write-Host " [OK] RISK POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Risk levels: $riskLevels" -ForegroundColor Cyan } } Write-Host "`n Sign-in risk policies found: $($result.riskPolicies)" -ForegroundColor $( if ($result.riskPolicies -gt 0) { 'Green' } else { 'Yellow' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO SIGN-IN RISK POLICY FOUND" -ForegroundColor Yellow Write-Host "Recommendation: Block or require MFA for medium+ risk" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n⚠️ Identity Protection requires Azure AD Premium P2" -ForegroundColor Yellow Write-Host "Feature not available with current license" -ForegroundColor Gray exit 0 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Requires Azure AD Premium P2" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating sign-in risk policy..." -ForegroundColor Gray $policyBody = @{ displayName = "Block/MFA for Risky Sign-ins - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() } applications = @{ includeApplications = @("All") } signInRiskLevels = @("high", "medium") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Sign-in risk policy created" -ForegroundColor Green Write-Host "Policy: $($newPolicy.displayName)" -ForegroundColor Cyan Write-Host "Triggers on: High and Medium risk sign-ins" -ForegroundColor Cyan Write-Host "Action: Require MFA" -ForegroundColor Cyan Write-Host "⚠️ In REPORT-ONLY mode" -ForegroundColor Yellow exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow Write-Host "`nNote: Requires Azure AD Premium P2 license" -ForegroundColor Cyan } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking sign-in risk policies..." -ForegroundColor Gray function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Identity Protection - Sign-in Risk Policy .DESCRIPTION Ensures Azure AD Identity Protection sign-in risk policy is configured. Automatically blocks or requires MFA for risky sign-ins. .NOTES Filename: identity-protection-signin-risk.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Azure AD Premium P2 .EXAMPLE .\identity-protection-signin-risk.ps1 -Monitoring Check if sign-in risk policy is configured #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Identity Protection - Sign-in Risk" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking sign-in risk policies..." -ForegroundColor Gray try { $riskPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies" ` -ErrorAction Stop $result = @{ isCompliant = $false riskPolicies = 0 policyNames = @() } foreach ($policy in $riskPolicy.value) { if ($policy.state -ne 'enabled') { continue } # Check if policy responds to sign-in risk $hasRiskLevels = $policy.conditions.signInRiskLevels.Count -gt 0 if ($hasRiskLevels) { $result.riskPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true $riskLevels = $policy.conditions.signInRiskLevels -join ', ' Write-Host " [OK] RISK POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Risk levels: $riskLevels" -ForegroundColor Cyan } } Write-Host "`n Sign-in risk policies found: $($result.riskPolicies)" -ForegroundColor $( if ($result.riskPolicies -gt 0) { 'Green' } else { 'Yellow' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO SIGN-IN RISK POLICY FOUND" -ForegroundColor Yellow Write-Host "Recommendation: Block or require MFA for medium+ risk" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n⚠️ Identity Protection requires Azure AD Premium P2" -ForegroundColor Yellow Write-Host "Feature not available with current license" -ForegroundColor Gray exit 0 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Requires Azure AD Premium P2" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating sign-in risk policy..." -ForegroundColor Gray $policyBody = @{ displayName = "Block/MFA for Risky Sign-ins - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() } applications = @{ includeApplications = @("All") } signInRiskLevels = @("high", "medium") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Sign-in risk policy created" -ForegroundColor Green Write-Host "Policy: $($newPolicy.displayName)" -ForegroundColor Cyan Write-Host "Triggers on: High and Medium risk sign-ins" -ForegroundColor Cyan Write-Host "Action: Require MFA" -ForegroundColor Cyan Write-Host "⚠️ In REPORT-ONLY mode" -ForegroundColor Yellow exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow Write-Host "`nNote: Requires Azure AD Premium P2 license" -ForegroundColor Cyan } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { $riskPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies" ` -ErrorAction Stop $result = @{ isCompliant = $false riskPolicies = 0 policyNames = @() } foreach ($policy in $riskPolicy.value) { if ($policy.state -ne 'enabled') { continue } # Check if policy responds to sign-in risk $hasRiskLevels = $policy.conditions.signInRiskLevels.Count -gt 0 if ($hasRiskLevels) { $result.riskPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true $riskLevels = $policy.conditions.signInRiskLevels -join ', ' Write-Host " [OK] RISK POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Risk levels: $riskLevels" -ForegroundColor Cyan } } Write-Host "`n Sign-in risk policies found: $($result.riskPolicies)" -ForegroundColor $( if ($result.riskPolicies -gt 0) { 'Green' } else { 'Yellow' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO SIGN-IN RISK POLICY FOUND" -ForegroundColor Yellow Write-Host "Recommendation: Block or require MFA for medium+ risk" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n⚠️ Identity Protection requires Azure AD Premium P2" -ForegroundColor Yellow Write-Host "Feature not available with current license" -ForegroundColor Gray exit 0 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Identity Protection - Sign-in Risk Policy .DESCRIPTION Ensures Azure AD Identity Protection sign-in risk policy is configured. Automatically blocks or requires MFA for risky sign-ins. .NOTES Filename: identity-protection-signin-risk.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Azure AD Premium P2 .EXAMPLE .\identity-protection-signin-risk.ps1 -Monitoring Check if sign-in risk policy is configured #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Identity Protection - Sign-in Risk" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking sign-in risk policies..." -ForegroundColor Gray try { $riskPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies" ` -ErrorAction Stop $result = @{ isCompliant = $false riskPolicies = 0 policyNames = @() } foreach ($policy in $riskPolicy.value) { if ($policy.state -ne 'enabled') { continue } # Check if policy responds to sign-in risk $hasRiskLevels = $policy.conditions.signInRiskLevels.Count -gt 0 if ($hasRiskLevels) { $result.riskPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true $riskLevels = $policy.conditions.signInRiskLevels -join ', ' Write-Host " [OK] RISK POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Risk levels: $riskLevels" -ForegroundColor Cyan } } Write-Host "`n Sign-in risk policies found: $($result.riskPolicies)" -ForegroundColor $( if ($result.riskPolicies -gt 0) { 'Green' } else { 'Yellow' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO SIGN-IN RISK POLICY FOUND" -ForegroundColor Yellow Write-Host "Recommendation: Block or require MFA for medium+ risk" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n⚠️ Identity Protection requires Azure AD Premium P2" -ForegroundColor Yellow Write-Host "Feature not available with current license" -ForegroundColor Gray exit 0 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Requires Azure AD Premium P2" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating sign-in risk policy..." -ForegroundColor Gray $policyBody = @{ displayName = "Block/MFA for Risky Sign-ins - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() } applications = @{ includeApplications = @("All") } signInRiskLevels = @("high", "medium") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Sign-in risk policy created" -ForegroundColor Green Write-Host "Policy: $($newPolicy.displayName)" -ForegroundColor Cyan Write-Host "Triggers on: High and Medium risk sign-ins" -ForegroundColor Cyan Write-Host "Action: Require MFA" -ForegroundColor Cyan Write-Host "⚠️ In REPORT-ONLY mode" -ForegroundColor Yellow exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow Write-Host "`nNote: Requires Azure AD Premium P2 license" -ForegroundColor Cyan } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ Requires Azure AD Premium P2" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating sign-in risk policy..." -ForegroundColor Gray $policyBody = @{ displayName = "Block/MFA for Risky Sign-ins - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() } applications = @{ includeApplications = @("All") } signInRiskLevels = @("high", "medium") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Sign-in risk policy created" -ForegroundColor Green Write-Host "Policy: $($newPolicy.displayName)" -ForegroundColor Cyan Write-Host "Triggers on: High and Medium risk sign-ins" -ForegroundColor Cyan Write-Host "Action: Require MFA" -ForegroundColor Cyan Write-Host "⚠️ In REPORT-ONLY mode" -ForegroundColor Yellow exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Identity Protection - Sign-in Risk Policy .DESCRIPTION Ensures Azure AD Identity Protection sign-in risk policy is configured. Automatically blocks or requires MFA for risky sign-ins. .NOTES Filename: identity-protection-signin-risk.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Azure AD Premium P2 .EXAMPLE .\identity-protection-signin-risk.ps1 -Monitoring Check if sign-in risk policy is configured #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Identity Protection - Sign-in Risk" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking sign-in risk policies..." -ForegroundColor Gray try { $riskPolicy = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies" ` -ErrorAction Stop $result = @{ isCompliant = $false riskPolicies = 0 policyNames = @() } foreach ($policy in $riskPolicy.value) { if ($policy.state -ne 'enabled') { continue } # Check if policy responds to sign-in risk $hasRiskLevels = $policy.conditions.signInRiskLevels.Count -gt 0 if ($hasRiskLevels) { $result.riskPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true $riskLevels = $policy.conditions.signInRiskLevels -join ', ' Write-Host " [OK] RISK POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Risk levels: $riskLevels" -ForegroundColor Cyan } } Write-Host "`n Sign-in risk policies found: $($result.riskPolicies)" -ForegroundColor $( if ($result.riskPolicies -gt 0) { 'Green' } else { 'Yellow' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO SIGN-IN RISK POLICY FOUND" -ForegroundColor Yellow Write-Host "Recommendation: Block or require MFA for medium+ risk" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n⚠️ Identity Protection requires Azure AD Premium P2" -ForegroundColor Yellow Write-Host "Feature not available with current license" -ForegroundColor Gray exit 0 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Requires Azure AD Premium P2" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating sign-in risk policy..." -ForegroundColor Gray $policyBody = @{ displayName = "Block/MFA for Risky Sign-ins - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() } applications = @{ includeApplications = @("All") } signInRiskLevels = @("high", "medium") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Sign-in risk policy created" -ForegroundColor Green Write-Host "Policy: $($newPolicy.displayName)" -ForegroundColor Cyan Write-Host "Triggers on: High and Medium risk sign-ins" -ForegroundColor Cyan Write-Host "Action: Require MFA" -ForegroundColor Cyan Write-Host "⚠️ In REPORT-ONLY mode" -ForegroundColor Yellow exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow Write-Host "`nNote: Requires Azure AD Premium P2 license" -ForegroundColor Cyan } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow Write-Host "`nNote: Requires Azure AD Premium P2 license" -ForegroundColor Cyan } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }