Microsoft 365: Multi-Factor Authentication Verplicht Stellen Voor Alle Gebruikers

<# .SYNOPSIS MFA voor Alle Gebruikers (All Users) .DESCRIPTION Ensures all users have MFA enforced via Conditional Access policy. This is a fundamental security control for Microsoft 365. .NOTES Filename: mfa-alle-gebruikers.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection BIO: Control 11.05.02 .EXAMPLE .\mfa-alle-gebruikers.ps1 -Monitoring Check if MFA is enforced for all users .EXAMPLE .\mfa-alle-gebruikers.ps1 -Remediation Create Conditional Access policy requiring MFA for all users #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "MFA voor Alle Gebruikers (All Users)" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if MFA is enforced for all users via Conditional Access #> function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS MFA voor Alle Gebruikers (All Users) .DESCRIPTION Ensures all users have MFA enforced via Conditional Access policy. This is a fundamental security control for Microsoft 365. .NOTES Filename: mfa-alle-gebruikers.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection BIO: Control 11.05.02 .EXAMPLE .\mfa-alle-gebruikers.ps1 -Monitoring Check if MFA is enforced for all users .EXAMPLE .\mfa-alle-gebruikers.ps1 -Remediation Create Conditional Access policy requiring MFA for all users #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "MFA voor Alle Gebruikers (All Users)" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if MFA is enforced for all users via Conditional Access #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Retrieving Conditional Access policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false mfaPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if policy applies to all users $includesAllUsers = $policy.conditions.users.includeUsers -contains 'All' # Check if policy requires MFA $requiresMFA = $policy.grantControls.builtInControls -contains 'mfa' if ($includesAllUsers -and $requiresMFA) { $result.mfaPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] MFA POLICY FOR ALL USERS: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n MFA policies for all users: $($result.mfaPolicies)" -ForegroundColor $( if ($result.mfaPolicies -gt 0) { 'Green' } else { 'Red' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - MFA is enforced for all users" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - MFA not enforced for all users" -ForegroundColor Red Write-Host "Recommendation: Create Conditional Access policy requiring MFA" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to enforce MFA for all users #> try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating MFA policy for all users..." -ForegroundColor Gray $policyBody = @{ displayName = "Require MFA for All Users - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() excludeGroups = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @("all") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode for safety" -ForegroundColor Yellow Write-Host "Steps to enable:" -ForegroundColor Cyan Write-Host " 1. Review impact in Azure Portal > Conditional Access" -ForegroundColor Gray Write-Host " 2. Check sign-in logs for potential issues" -ForegroundColor Gray Write-Host " 3. Exclude emergency access accounts if needed" -ForegroundColor Gray Write-Host " 4. Change state to 'enabled' when ready" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check current compliance status" -ForegroundColor Gray Write-Host " -Remediation Create MFA policy (report-only mode)" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Retrieving Conditional Access policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false mfaPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if policy applies to all users $includesAllUsers = $policy.conditions.users.includeUsers -contains 'All' # Check if policy requires MFA $requiresMFA = $policy.grantControls.builtInControls -contains 'mfa' if ($includesAllUsers -and $requiresMFA) { $result.mfaPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] MFA POLICY FOR ALL USERS: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n MFA policies for all users: $($result.mfaPolicies)" -ForegroundColor $( if ($result.mfaPolicies -gt 0) { 'Green' } else { 'Red' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - MFA is enforced for all users" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - MFA not enforced for all users" -ForegroundColor Red Write-Host "Recommendation: Create Conditional Access policy requiring MFA" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to enforce MFA for all users #> function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS MFA voor Alle Gebruikers (All Users) .DESCRIPTION Ensures all users have MFA enforced via Conditional Access policy. This is a fundamental security control for Microsoft 365. .NOTES Filename: mfa-alle-gebruikers.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection BIO: Control 11.05.02 .EXAMPLE .\mfa-alle-gebruikers.ps1 -Monitoring Check if MFA is enforced for all users .EXAMPLE .\mfa-alle-gebruikers.ps1 -Remediation Create Conditional Access policy requiring MFA for all users #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "MFA voor Alle Gebruikers (All Users)" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if MFA is enforced for all users via Conditional Access #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Retrieving Conditional Access policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false mfaPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if policy applies to all users $includesAllUsers = $policy.conditions.users.includeUsers -contains 'All' # Check if policy requires MFA $requiresMFA = $policy.grantControls.builtInControls -contains 'mfa' if ($includesAllUsers -and $requiresMFA) { $result.mfaPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] MFA POLICY FOR ALL USERS: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n MFA policies for all users: $($result.mfaPolicies)" -ForegroundColor $( if ($result.mfaPolicies -gt 0) { 'Green' } else { 'Red' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - MFA is enforced for all users" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - MFA not enforced for all users" -ForegroundColor Red Write-Host "Recommendation: Create Conditional Access policy requiring MFA" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to enforce MFA for all users #> try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating MFA policy for all users..." -ForegroundColor Gray $policyBody = @{ displayName = "Require MFA for All Users - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() excludeGroups = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @("all") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode for safety" -ForegroundColor Yellow Write-Host "Steps to enable:" -ForegroundColor Cyan Write-Host " 1. Review impact in Azure Portal > Conditional Access" -ForegroundColor Gray Write-Host " 2. Check sign-in logs for potential issues" -ForegroundColor Gray Write-Host " 3. Exclude emergency access accounts if needed" -ForegroundColor Gray Write-Host " 4. Change state to 'enabled' when ready" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check current compliance status" -ForegroundColor Gray Write-Host " -Remediation Create MFA policy (report-only mode)" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating MFA policy for all users..." -ForegroundColor Gray $policyBody = @{ displayName = "Require MFA for All Users - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() excludeGroups = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @("all") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode for safety" -ForegroundColor Yellow Write-Host "Steps to enable:" -ForegroundColor Cyan Write-Host " 1. Review impact in Azure Portal > Conditional Access" -ForegroundColor Gray Write-Host " 2. Check sign-in logs for potential issues" -ForegroundColor Gray Write-Host " 3. Exclude emergency access accounts if needed" -ForegroundColor Gray Write-Host " 4. Change state to 'enabled' when ready" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS MFA voor Alle Gebruikers (All Users) .DESCRIPTION Ensures all users have MFA enforced via Conditional Access policy. This is a fundamental security control for Microsoft 365. .NOTES Filename: mfa-alle-gebruikers.ps1 Author: Nederlandse Baseline voor Veilige Cloud CIS: Related to Identity Protection BIO: Control 11.05.02 .EXAMPLE .\mfa-alle-gebruikers.ps1 -Monitoring Check if MFA is enforced for all users .EXAMPLE .\mfa-alle-gebruikers.ps1 -Remediation Create Conditional Access policy requiring MFA for all users #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' # ============================================================================ # HEADER # ============================================================================ Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "MFA voor Alle Gebruikers (All Users)" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan # ============================================================================ # FUNCTIONS # ============================================================================ function Invoke-Monitoring { <# .SYNOPSIS Checks if MFA is enforced for all users via Conditional Access #> try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Retrieving Conditional Access policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false mfaPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { # Check if policy is enabled if ($policy.state -ne 'enabled') { continue } # Check if policy applies to all users $includesAllUsers = $policy.conditions.users.includeUsers -contains 'All' # Check if policy requires MFA $requiresMFA = $policy.grantControls.builtInControls -contains 'mfa' if ($includesAllUsers -and $requiresMFA) { $result.mfaPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] MFA POLICY FOR ALL USERS: $($policy.displayName)" -ForegroundColor Green } } Write-Host "`n MFA policies for all users: $($result.mfaPolicies)" -ForegroundColor $( if ($result.mfaPolicies -gt 0) { 'Green' } else { 'Red' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - MFA is enforced for all users" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - MFA not enforced for all users" -ForegroundColor Red Write-Host "Recommendation: Create Conditional Access policy requiring MFA" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates Conditional Access policy to enforce MFA for all users #> try { Write-Host "⚠️ Creating Conditional Access policy requires admin consent" -ForegroundColor Yellow Write-Host "`nConnecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Creating MFA policy for all users..." -ForegroundColor Gray $policyBody = @{ displayName = "Require MFA for All Users - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeUsers = @("All") excludeUsers = @() excludeGroups = @() } applications = @{ includeApplications = @("All") } clientAppTypes = @("all") } grantControls = @{ operator = "OR" builtInControls = @("mfa") } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Policy created: $($newPolicy.displayName)" -ForegroundColor Green Write-Host "⚠️ Policy is in REPORT-ONLY mode for safety" -ForegroundColor Yellow Write-Host "Steps to enable:" -ForegroundColor Cyan Write-Host " 1. Review impact in Azure Portal > Conditional Access" -ForegroundColor Gray Write-Host " 2. Check sign-in logs for potential issues" -ForegroundColor Gray Write-Host " 3. Exclude emergency access accounts if needed" -ForegroundColor Gray Write-Host " 4. Change state to 'enabled' when ready" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Error Details: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check current compliance status" -ForegroundColor Gray Write-Host " -Remediation Create MFA policy (report-only mode)" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check current compliance status" -ForegroundColor Gray Write-Host " -Remediation Create MFA policy (report-only mode)" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }