Third Party Apps Blocked

<# .SYNOPSIS Third Party Apps Blocked .DESCRIPTION Identifies and recommends blocking unauthorized third-party applications .NOTES NL Baseline v2.0 #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Third Party Apps Blocked" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "Application.Read.All", "Policy.Read.All" -ErrorAction Stop -NoWelcome $apps = Get-MgApplication -All | Where-Object { $_.PublisherDomain -notmatch 'microsoft.com|windows.net' } $result = @{ totalThirdPartyApps = $apps.Count; appsWithHighPerms = 0; highRiskApps = @() } Write-Host " Third-party Apps: $($result.totalThirdPartyApps)" -ForegroundColor $( if ($result.totalThirdPartyApps -eq 0) { 'Green' }else { 'Yellow' } ) # Sample first 20 apps for high permissions $sampleApps = $apps | Select-Object -First 20 foreach ($app in $sampleApps) { $perms = $app.RequiredResourceAccess $highRisk = $perms | Where-Object { $_.ResourceAppId -match '00000003-0000-0000-c000-000000000000' -and $_.ResourceAccess.Type -eq 'Role' } if ($highRisk) { $result.appsWithHighPerms++ $result.highRiskApps += $app.DisplayName } } Write-Host " Apps with high permissions (sampled): $($result.appsWithHighPerms)/20" -ForegroundColor $( if ($result.appsWithHighPerms -eq 0) { 'Green' }else { 'Yellow' } ) if ($result.highRiskApps.Count -gt 0) { Write-Host "`n ⚠️ High-risk apps found:" -ForegroundColor Yellow $result.highRiskApps | Select-Object -First 10 | ForEach-Object { Write-Host " • $_" -ForegroundColor Gray } } Write-Host "`n Security Recommendations:" -ForegroundColor Cyan Write-Host " • Review and approve only necessary third-party apps" -ForegroundColor Gray Write-Host " • Block unauthorized apps via Conditional Access" -ForegroundColor Gray Write-Host " • Use Cloud App Security for app governance" -ForegroundColor Gray Write-Host " • Implement app consent policies" -ForegroundColor Gray Write-Host "`n ⚠️ Manual review required for all third-party apps" -ForegroundColor Yellow exit 0 } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }