Signin Frequency Admins

<# .SYNOPSIS Sign-in Frequency for Administrators .DESCRIPTION Requires administrators to sign in more frequently (e.g., every 4 hours). Reduces the risk of session hijacking for privileged accounts. .NOTES Filename: signin-frequency-admins.ps1 Author: Nederlandse Baseline voor Veilige Cloud .PARAMETER FrequencyHours How often admins must re-authenticate (default: 4 hours) .EXAMPLE .\signin-frequency-admins.ps1 -Monitoring Check if sign-in frequency is enforced for admins #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf, [Parameter(Mandatory = $false)] [int]$FrequencyHours = 4 ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Sign-in Frequency for Administrators" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Sign-in Frequency for Administrators .DESCRIPTION Requires administrators to sign in more frequently (e.g., every 4 hours). Reduces the risk of session hijacking for privileged accounts. .NOTES Filename: signin-frequency-admins.ps1 Author: Nederlandse Baseline voor Veilige Cloud .PARAMETER FrequencyHours How often admins must re-authenticate (default: 4 hours) .EXAMPLE .\signin-frequency-admins.ps1 -Monitoring Check if sign-in frequency is enforced for admins #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf, [Parameter(Mandatory=$false)] [int]$FrequencyHours = 4 ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Sign-in Frequency for Administrators" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking sign-in frequency policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false frequencyPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { if ($policy.state -ne 'enabled') { continue } # Check if targets admin roles $targetsAdmins = $policy.conditions.users.includeRoles.Count -gt 0 # Check if has sign-in frequency control $hasFrequency = $null -ne $policy.sessionControls.signInFrequency if ($targetsAdmins -and $hasFrequency) { $freq = $policy.sessionControls.signInFrequency $result.frequencyPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] ADMIN FREQUENCY POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Re-auth every: $($freq.value) $($freq.type)" -ForegroundColor Cyan } } Write-Host "`n Admin sign-in frequency policies: $($result.frequencyPolicies)" -ForegroundColor $( if ($result.frequencyPolicies -gt 0) { 'Green' } else { 'Yellow' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO ADMIN SIGN-IN FREQUENCY FOUND" -ForegroundColor Yellow Write-Host "Recommend: Require admins to re-auth every 4 hours" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Getting admin roles..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $adminRoleIds = $adminRoles.value | Select-Object -ExpandProperty id Write-Host "Creating sign-in frequency policy for admins..." -ForegroundColor Gray Write-Host "Frequency: Every $FrequencyHours hours" -ForegroundColor Cyan $policyBody = @{ displayName = "Require Admin Re-authentication Every $FrequencyHours Hours - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeRoles = @($adminRoleIds) } applications = @{ includeApplications = @("All") } } sessionControls = @{ signInFrequency = @{ value = $FrequencyHours type = "hours" isEnabled = $true } } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Sign-in frequency policy created" -ForegroundColor Green Write-Host "Policy: $($newPolicy.displayName)" -ForegroundColor Cyan Write-Host "⚠️ In REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "`nAdmins will re-authenticate every $FrequencyHours hours" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check current policies" -ForegroundColor Gray Write-Host " -Remediation Create frequency policy" -ForegroundColor Gray Write-Host " -FrequencyHours <int> Hours between re-auth (default: 4)" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All", "Directory.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking sign-in frequency policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false frequencyPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { if ($policy.state -ne 'enabled') { continue } # Check if targets admin roles $targetsAdmins = $policy.conditions.users.includeRoles.Count -gt 0 # Check if has sign-in frequency control $hasFrequency = $null -ne $policy.sessionControls.signInFrequency if ($targetsAdmins -and $hasFrequency) { $freq = $policy.sessionControls.signInFrequency $result.frequencyPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] ADMIN FREQUENCY POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Re-auth every: $($freq.value) $($freq.type)" -ForegroundColor Cyan } } Write-Host "`n Admin sign-in frequency policies: $($result.frequencyPolicies)" -ForegroundColor $( if ($result.frequencyPolicies -gt 0) { 'Green' } else { 'Yellow' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO ADMIN SIGN-IN FREQUENCY FOUND" -ForegroundColor Yellow Write-Host "Recommend: Require admins to re-auth every 4 hours" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Sign-in Frequency for Administrators .DESCRIPTION Requires administrators to sign in more frequently (e.g., every 4 hours). Reduces the risk of session hijacking for privileged accounts. .NOTES Filename: signin-frequency-admins.ps1 Author: Nederlandse Baseline voor Veilige Cloud .PARAMETER FrequencyHours How often admins must re-authenticate (default: 4 hours) .EXAMPLE .\signin-frequency-admins.ps1 -Monitoring Check if sign-in frequency is enforced for admins #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf, [Parameter(Mandatory=$false)] [int]$FrequencyHours = 4 ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Sign-in Frequency for Administrators" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking sign-in frequency policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false frequencyPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { if ($policy.state -ne 'enabled') { continue } # Check if targets admin roles $targetsAdmins = $policy.conditions.users.includeRoles.Count -gt 0 # Check if has sign-in frequency control $hasFrequency = $null -ne $policy.sessionControls.signInFrequency if ($targetsAdmins -and $hasFrequency) { $freq = $policy.sessionControls.signInFrequency $result.frequencyPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] ADMIN FREQUENCY POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Re-auth every: $($freq.value) $($freq.type)" -ForegroundColor Cyan } } Write-Host "`n Admin sign-in frequency policies: $($result.frequencyPolicies)" -ForegroundColor $( if ($result.frequencyPolicies -gt 0) { 'Green' } else { 'Yellow' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO ADMIN SIGN-IN FREQUENCY FOUND" -ForegroundColor Yellow Write-Host "Recommend: Require admins to re-auth every 4 hours" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Getting admin roles..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $adminRoleIds = $adminRoles.value | Select-Object -ExpandProperty id Write-Host "Creating sign-in frequency policy for admins..." -ForegroundColor Gray Write-Host "Frequency: Every $FrequencyHours hours" -ForegroundColor Cyan $policyBody = @{ displayName = "Require Admin Re-authentication Every $FrequencyHours Hours - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeRoles = @($adminRoleIds) } applications = @{ includeApplications = @("All") } } sessionControls = @{ signInFrequency = @{ value = $FrequencyHours type = "hours" isEnabled = $true } } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Sign-in frequency policy created" -ForegroundColor Green Write-Host "Policy: $($newPolicy.displayName)" -ForegroundColor Cyan Write-Host "⚠️ In REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "`nAdmins will re-authenticate every $FrequencyHours hours" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check current policies" -ForegroundColor Gray Write-Host " -Remediation Create frequency policy" -ForegroundColor Gray Write-Host " -FrequencyHours <int> Hours between re-auth (default: 4)" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Getting admin roles..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $adminRoleIds = $adminRoles.value | Select-Object -ExpandProperty id Write-Host "Creating sign-in frequency policy for admins..." -ForegroundColor Gray Write-Host "Frequency: Every $FrequencyHours hours" -ForegroundColor Cyan $policyBody = @{ displayName = "Require Admin Re-authentication Every $FrequencyHours Hours - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeRoles = @($adminRoleIds) } applications = @{ includeApplications = @("All") } } sessionControls = @{ signInFrequency = @{ value = $FrequencyHours type = "hours" isEnabled = $true } } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Sign-in frequency policy created" -ForegroundColor Green Write-Host "Policy: $($newPolicy.displayName)" -ForegroundColor Cyan Write-Host "⚠️ In REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "`nAdmins will re-authenticate every $FrequencyHours hours" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Sign-in Frequency for Administrators .DESCRIPTION Requires administrators to sign in more frequently (e.g., every 4 hours). Reduces the risk of session hijacking for privileged accounts. .NOTES Filename: signin-frequency-admins.ps1 Author: Nederlandse Baseline voor Veilige Cloud .PARAMETER FrequencyHours How often admins must re-authenticate (default: 4 hours) .EXAMPLE .\signin-frequency-admins.ps1 -Monitoring Check if sign-in frequency is enforced for admins #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf, [Parameter(Mandatory=$false)] [int]$FrequencyHours = 4 ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Sign-in Frequency for Administrators" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking sign-in frequency policies..." -ForegroundColor Gray $policies = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ isCompliant = $false frequencyPolicies = 0 policyNames = @() } foreach ($policy in $policies.value) { if ($policy.state -ne 'enabled') { continue } # Check if targets admin roles $targetsAdmins = $policy.conditions.users.includeRoles.Count -gt 0 # Check if has sign-in frequency control $hasFrequency = $null -ne $policy.sessionControls.signInFrequency if ($targetsAdmins -and $hasFrequency) { $freq = $policy.sessionControls.signInFrequency $result.frequencyPolicies++ $result.policyNames += $policy.displayName $result.isCompliant = $true Write-Host " [OK] ADMIN FREQUENCY POLICY: $($policy.displayName)" -ForegroundColor Green Write-Host " Re-auth every: $($freq.value) $($freq.type)" -ForegroundColor Cyan } } Write-Host "`n Admin sign-in frequency policies: $($result.frequencyPolicies)" -ForegroundColor $( if ($result.frequencyPolicies -gt 0) { 'Green' } else { 'Yellow' } ) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ NO ADMIN SIGN-IN FREQUENCY FOUND" -ForegroundColor Yellow Write-Host "Recommend: Require admins to re-auth every 4 hours" -ForegroundColor Cyan exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" -ErrorAction Stop -NoWelcome Write-Host "Getting admin roles..." -ForegroundColor Gray $adminRoles = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/directoryRoles" $adminRoleIds = $adminRoles.value | Select-Object -ExpandProperty id Write-Host "Creating sign-in frequency policy for admins..." -ForegroundColor Gray Write-Host "Frequency: Every $FrequencyHours hours" -ForegroundColor Cyan $policyBody = @{ displayName = "Require Admin Re-authentication Every $FrequencyHours Hours - Nederlandse Baseline" state = "enabledForReportingButNotEnforced" conditions = @{ users = @{ includeRoles = @($adminRoleIds) } applications = @{ includeApplications = @("All") } } sessionControls = @{ signInFrequency = @{ value = $FrequencyHours type = "hours" isEnabled = $true } } } $newPolicy = Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" ` -Body ($policyBody | ConvertTo-Json -Depth 10) Write-Host "`n[OK] Sign-in frequency policy created" -ForegroundColor Green Write-Host "Policy: $($newPolicy.displayName)" -ForegroundColor Cyan Write-Host "⚠️ In REPORT-ONLY mode" -ForegroundColor Yellow Write-Host "`nAdmins will re-authenticate every $FrequencyHours hours" -ForegroundColor Cyan exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check current policies" -ForegroundColor Gray Write-Host " -Remediation Create frequency policy" -ForegroundColor Gray Write-Host " -FrequencyHours <int> Hours between re-auth (default: 4)" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check current policies" -ForegroundColor Gray Write-Host " -Remediation Create frequency policy" -ForegroundColor Gray Write-Host " -FrequencyHours <int> Hours between re-auth (default: 4)" -ForegroundColor Gray } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }