Phishing-Resistant MFA Voor Geprivilegieerd Accounts (M365)

<# .SYNOPSIS Phishing-Resistant MFA .DESCRIPTION Ensures phishing-resistant MFA methods are enabled (FIDO2, Windows Hello, Certificate-based). SMS and voice call are NOT phishing-resistant. .NOTES Filename: phishing-resistant-mfa.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\phishing-resistant-mfa.ps1 -Monitoring Check if phishing-resistant MFA is configured #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Phishing-Resistant MFA" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Phishing-Resistant MFA .DESCRIPTION Ensures phishing-resistant MFA methods are enabled (FIDO2, Windows Hello, Certificate-based). SMS and voice call are NOT phishing-resistant. .NOTES Filename: phishing-resistant-mfa.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\phishing-resistant-mfa.ps1 -Monitoring Check if phishing-resistant MFA is configured #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Phishing-Resistant MFA" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authentication methods policy..." -ForegroundColor Gray $authMethods = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy" $result = @{ isCompliant = $false fido2Enabled = $false windowsHelloEnabled = $false certificateEnabled = $false } # Check FIDO2 Security Keys $fido2 = $authMethods.authenticationMethodConfigurations | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.fido2AuthenticationMethodConfiguration' } if ($fido2 -and $fido2.state -eq 'enabled') { Write-Host " [OK] FIDO2 Security Keys: ENABLED" -ForegroundColor Green $result.fido2Enabled = $true $result.isCompliant = $true } else { Write-Host " [FAIL] FIDO2 Security Keys: DISABLED" -ForegroundColor Red } # Check Windows Hello for Business $windowsHello = $authMethods.authenticationMethodConfigurations | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration' } if ($windowsHello -and $windowsHello.state -eq 'enabled') { Write-Host " [OK] Windows Hello / Authenticator: ENABLED" -ForegroundColor Green $result.windowsHelloEnabled = $true } else { Write-Host " ⚠️ Windows Hello / Authenticator: DISABLED" -ForegroundColor Yellow } Write-Host "`nPhishing-resistant methods:" -ForegroundColor Cyan Write-Host " • FIDO2 Security Keys (YubiKey, etc.)" -ForegroundColor Gray Write-Host " • Windows Hello for Business" -ForegroundColor Gray Write-Host " • Certificate-based authentication" -ForegroundColor Gray Write-Host "`n⚠️ NOT phishing-resistant:" -ForegroundColor Yellow Write-Host " • SMS / Text message" -ForegroundColor Red Write-Host " • Voice call" -ForegroundColor Red Write-Host " • Email OTP" -ForegroundColor Red if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Phishing-resistant MFA available" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Enable phishing-resistant methods" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod" -ErrorAction Stop -NoWelcome Write-Host "Enabling FIDO2 security keys..." -ForegroundColor Gray $fido2Config = @{ "@odata.type" = "#microsoft.graph.fido2AuthenticationMethodConfiguration" state = "enabled" includeTargets = @( @{ targetType = "group" id = "all_users" isRegistrationRequired = $false } ) isAttestationEnforced = $true isSelfServiceRegistrationAllowed = $true keyRestrictions = @{ isEnforced = $false enforcementType = "allow" aaGuids = @() } } Invoke-MgGraphRequest -Method PATCH ` -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/Fido2" ` -Body ($fido2Config | ConvertTo-Json -Depth 10) Write-Host "`n[OK] FIDO2 security keys enabled" -ForegroundColor Green Write-Host "`nNext steps:" -ForegroundColor Cyan Write-Host " 1. Users can register FIDO2 keys at https://aka.ms/mysecurityinfo" -ForegroundColor Gray Write-Host " 2. Consider enabling Windows Hello for Business" -ForegroundColor Gray Write-Host " 3. Create CA policy requiring phishing-resistant MFA for admins" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authentication methods policy..." -ForegroundColor Gray $authMethods = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy" $result = @{ isCompliant = $false fido2Enabled = $false windowsHelloEnabled = $false certificateEnabled = $false } # Check FIDO2 Security Keys $fido2 = $authMethods.authenticationMethodConfigurations | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.fido2AuthenticationMethodConfiguration' } if ($fido2 -and $fido2.state -eq 'enabled') { Write-Host " [OK] FIDO2 Security Keys: ENABLED" -ForegroundColor Green $result.fido2Enabled = $true $result.isCompliant = $true } else { Write-Host " [FAIL] FIDO2 Security Keys: DISABLED" -ForegroundColor Red } # Check Windows Hello for Business $windowsHello = $authMethods.authenticationMethodConfigurations | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration' } if ($windowsHello -and $windowsHello.state -eq 'enabled') { Write-Host " [OK] Windows Hello / Authenticator: ENABLED" -ForegroundColor Green $result.windowsHelloEnabled = $true } else { Write-Host " ⚠️ Windows Hello / Authenticator: DISABLED" -ForegroundColor Yellow } Write-Host "`nPhishing-resistant methods:" -ForegroundColor Cyan Write-Host " • FIDO2 Security Keys (YubiKey, etc.)" -ForegroundColor Gray Write-Host " • Windows Hello for Business" -ForegroundColor Gray Write-Host " • Certificate-based authentication" -ForegroundColor Gray Write-Host "`n⚠️ NOT phishing-resistant:" -ForegroundColor Yellow Write-Host " • SMS / Text message" -ForegroundColor Red Write-Host " • Voice call" -ForegroundColor Red Write-Host " • Email OTP" -ForegroundColor Red if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Phishing-resistant MFA available" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Enable phishing-resistant methods" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Phishing-Resistant MFA .DESCRIPTION Ensures phishing-resistant MFA methods are enabled (FIDO2, Windows Hello, Certificate-based). SMS and voice call are NOT phishing-resistant. .NOTES Filename: phishing-resistant-mfa.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\phishing-resistant-mfa.ps1 -Monitoring Check if phishing-resistant MFA is configured #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Phishing-Resistant MFA" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authentication methods policy..." -ForegroundColor Gray $authMethods = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy" $result = @{ isCompliant = $false fido2Enabled = $false windowsHelloEnabled = $false certificateEnabled = $false } # Check FIDO2 Security Keys $fido2 = $authMethods.authenticationMethodConfigurations | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.fido2AuthenticationMethodConfiguration' } if ($fido2 -and $fido2.state -eq 'enabled') { Write-Host " [OK] FIDO2 Security Keys: ENABLED" -ForegroundColor Green $result.fido2Enabled = $true $result.isCompliant = $true } else { Write-Host " [FAIL] FIDO2 Security Keys: DISABLED" -ForegroundColor Red } # Check Windows Hello for Business $windowsHello = $authMethods.authenticationMethodConfigurations | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration' } if ($windowsHello -and $windowsHello.state -eq 'enabled') { Write-Host " [OK] Windows Hello / Authenticator: ENABLED" -ForegroundColor Green $result.windowsHelloEnabled = $true } else { Write-Host " ⚠️ Windows Hello / Authenticator: DISABLED" -ForegroundColor Yellow } Write-Host "`nPhishing-resistant methods:" -ForegroundColor Cyan Write-Host " • FIDO2 Security Keys (YubiKey, etc.)" -ForegroundColor Gray Write-Host " • Windows Hello for Business" -ForegroundColor Gray Write-Host " • Certificate-based authentication" -ForegroundColor Gray Write-Host "`n⚠️ NOT phishing-resistant:" -ForegroundColor Yellow Write-Host " • SMS / Text message" -ForegroundColor Red Write-Host " • Voice call" -ForegroundColor Red Write-Host " • Email OTP" -ForegroundColor Red if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Phishing-resistant MFA available" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Enable phishing-resistant methods" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod" -ErrorAction Stop -NoWelcome Write-Host "Enabling FIDO2 security keys..." -ForegroundColor Gray $fido2Config = @{ "@odata.type" = "#microsoft.graph.fido2AuthenticationMethodConfiguration" state = "enabled" includeTargets = @( @{ targetType = "group" id = "all_users" isRegistrationRequired = $false } ) isAttestationEnforced = $true isSelfServiceRegistrationAllowed = $true keyRestrictions = @{ isEnforced = $false enforcementType = "allow" aaGuids = @() } } Invoke-MgGraphRequest -Method PATCH ` -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/Fido2" ` -Body ($fido2Config | ConvertTo-Json -Depth 10) Write-Host "`n[OK] FIDO2 security keys enabled" -ForegroundColor Green Write-Host "`nNext steps:" -ForegroundColor Cyan Write-Host " 1. Users can register FIDO2 keys at https://aka.ms/mysecurityinfo" -ForegroundColor Gray Write-Host " 2. Consider enabling Windows Hello for Business" -ForegroundColor Gray Write-Host " 3. Create CA policy requiring phishing-resistant MFA for admins" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod" -ErrorAction Stop -NoWelcome Write-Host "Enabling FIDO2 security keys..." -ForegroundColor Gray $fido2Config = @{ "@odata.type" = "#microsoft.graph.fido2AuthenticationMethodConfiguration" state = "enabled" includeTargets = @( @{ targetType = "group" id = "all_users" isRegistrationRequired = $false } ) isAttestationEnforced = $true isSelfServiceRegistrationAllowed = $true keyRestrictions = @{ isEnforced = $false enforcementType = "allow" aaGuids = @() } } Invoke-MgGraphRequest -Method PATCH ` -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/Fido2" ` -Body ($fido2Config | ConvertTo-Json -Depth 10) Write-Host "`n[OK] FIDO2 security keys enabled" -ForegroundColor Green Write-Host "`nNext steps:" -ForegroundColor Cyan Write-Host " 1. Users can register FIDO2 keys at https://aka.ms/mysecurityinfo" -ForegroundColor Gray Write-Host " 2. Consider enabling Windows Hello for Business" -ForegroundColor Gray Write-Host " 3. Create CA policy requiring phishing-resistant MFA for admins" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Phishing-Resistant MFA .DESCRIPTION Ensures phishing-resistant MFA methods are enabled (FIDO2, Windows Hello, Certificate-based). SMS and voice call are NOT phishing-resistant. .NOTES Filename: phishing-resistant-mfa.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\phishing-resistant-mfa.ps1 -Monitoring Check if phishing-resistant MFA is configured #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Phishing-Resistant MFA" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking authentication methods policy..." -ForegroundColor Gray $authMethods = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy" $result = @{ isCompliant = $false fido2Enabled = $false windowsHelloEnabled = $false certificateEnabled = $false } # Check FIDO2 Security Keys $fido2 = $authMethods.authenticationMethodConfigurations | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.fido2AuthenticationMethodConfiguration' } if ($fido2 -and $fido2.state -eq 'enabled') { Write-Host " [OK] FIDO2 Security Keys: ENABLED" -ForegroundColor Green $result.fido2Enabled = $true $result.isCompliant = $true } else { Write-Host " [FAIL] FIDO2 Security Keys: DISABLED" -ForegroundColor Red } # Check Windows Hello for Business $windowsHello = $authMethods.authenticationMethodConfigurations | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration' } if ($windowsHello -and $windowsHello.state -eq 'enabled') { Write-Host " [OK] Windows Hello / Authenticator: ENABLED" -ForegroundColor Green $result.windowsHelloEnabled = $true } else { Write-Host " ⚠️ Windows Hello / Authenticator: DISABLED" -ForegroundColor Yellow } Write-Host "`nPhishing-resistant methods:" -ForegroundColor Cyan Write-Host " • FIDO2 Security Keys (YubiKey, etc.)" -ForegroundColor Gray Write-Host " • Windows Hello for Business" -ForegroundColor Gray Write-Host " • Certificate-based authentication" -ForegroundColor Gray Write-Host "`n⚠️ NOT phishing-resistant:" -ForegroundColor Yellow Write-Host " • SMS / Text message" -ForegroundColor Red Write-Host " • Voice call" -ForegroundColor Red Write-Host " • Email OTP" -ForegroundColor Red if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Phishing-resistant MFA available" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Enable phishing-resistant methods" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod" -ErrorAction Stop -NoWelcome Write-Host "Enabling FIDO2 security keys..." -ForegroundColor Gray $fido2Config = @{ "@odata.type" = "#microsoft.graph.fido2AuthenticationMethodConfiguration" state = "enabled" includeTargets = @( @{ targetType = "group" id = "all_users" isRegistrationRequired = $false } ) isAttestationEnforced = $true isSelfServiceRegistrationAllowed = $true keyRestrictions = @{ isEnforced = $false enforcementType = "allow" aaGuids = @() } } Invoke-MgGraphRequest -Method PATCH ` -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/Fido2" ` -Body ($fido2Config | ConvertTo-Json -Depth 10) Write-Host "`n[OK] FIDO2 security keys enabled" -ForegroundColor Green Write-Host "`nNext steps:" -ForegroundColor Cyan Write-Host " 1. Users can register FIDO2 keys at https://aka.ms/mysecurityinfo" -ForegroundColor Gray Write-Host " 2. Consider enabling Windows Hello for Business" -ForegroundColor Gray Write-Host " 3. Create CA policy requiring phishing-resistant MFA for admins" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }