Signin Risk Blocked High

<# .SYNOPSIS Sign-in Risk Blocked High .DESCRIPTION Ensures high-risk sign-ins are blocked by Conditional Access policies .NOTES NL Baseline v2.0 Requires: Azure AD Premium P2 #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Sign-in Risk Blocked High" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" $result = @{ highRiskBlockPolicies = 0; policies = @() } foreach ($policy in $policies.value) { if ($policy.state -eq 'enabled' -and $policy.conditions.signInRiskLevels -contains 'high') { if ($policy.grantControls.builtInControls -contains 'block') { $result.highRiskBlockPolicies++ $result.policies += $policy.displayName Write-Host " [OK] BLOCKS HIGH RISK: $($policy.displayName)" -ForegroundColor Green Write-Host " Risk levels: $($policy.conditions.signInRiskLevels -join ', ')" -ForegroundColor Cyan } } } Write-Host "`n Summary:" -ForegroundColor Cyan Write-Host " Policies blocking high sign-in risk: $($result.highRiskBlockPolicies)" -ForegroundColor $( if ($result.highRiskBlockPolicies -gt 0) { 'Green' }else { 'Red' } ) Write-Host "`n High Risk Indicators:" -ForegroundColor Cyan Write-Host " • Anonymous IP addresses" -ForegroundColor Gray Write-Host " • Malware-linked IP addresses" -ForegroundColor Gray Write-Host " • Atypical travel patterns" -ForegroundColor Gray Write-Host " • Suspicious browser usage" -ForegroundColor Gray Write-Host "`n ⚠️ Requires: Azure AD Premium P2" -ForegroundColor Yellow if ($result.highRiskBlockPolicies -gt 0) { Write-Host "`n[OK] COMPLIANT - High-risk sign-ins blocked" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - No high-risk blocking!" -ForegroundColor Red exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }