Microsoft 365 Beveiligingsupdates En Release Governance Voor De Nederlandse Overheid

<# .SYNOPSIS Security-update assessment, monitoring en roadmap-synchronisatie voor Microsoft 365. .DESCRIPTION Automatiseert het verzamelen van Microsoft 365 beveiligingsupdates via Microsoft Graph, verrijkt de signalen met Secure Score en Conditional Access configuraties en genereert pilotplannen plus bewijsrapportages volgens de Nederlandse Baseline voor Veilige Cloud. .NOTES Project : Nederlandse Baseline voor Veilige Cloud Author : Nederlandse Baseline voor Veilige Cloud Team Created : 2025-11-27 Version : 1.0 JSON : content/m365/security-updates/index.json .EXAMPLE .\index.ps1 -Assessment -ReportPath .\evidence\security-updates.json -DebugMode .EXAMPLE .\index.ps1 -Monitoring .EXAMPLE .\index.ps1 -RoadmapSync -RoadmapPath .\roadmap\m365-security-updates.json #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph.Authentication [CmdletBinding(DefaultParameterSetName = 'Help')] param( [Parameter(ParameterSetName = 'Assessment')] [switch]$Assessment, [Parameter(ParameterSetName = 'Monitoring')] [switch]$Monitoring, [Parameter(ParameterSetName = 'Roadmap')] [switch]$RoadmapSync, [Parameter()] [string]$ReportPath, [Parameter(ParameterSetName = 'Roadmap')] [string]$RoadmapPath = "./m365-security-updates-roadmap.json", [switch]$DebugMode, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' $VerbosePreference = 'Continue' function Write-M365SecurityUpdateHeader { Write-Host "" Write-Host "===============================================" -ForegroundColor Cyan Write-Host " Microsoft 365 Security Update Toolkit" -ForegroundColor Cyan Write-Host " Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "===============================================" -ForegroundColor Cyan Write-Host "" } function Test-RequiredModules { [CmdletBinding()] param( [string[]]$Names = @('Microsoft.Graph.Authentication', 'Microsoft.Graph.Reports') ) foreach ($name in $Names) { if (-not (Get-Module -ListAvailable -Name $name -ErrorAction SilentlyContinue)) { throw "Vereiste module '$name' ontbreekt. Installeer de module of gebruik -DebugMode voor lokale tests (<15s)." } } } function Connect-M365Graph { [CmdletBinding()] param( [switch]$Force ) if ($DebugMode) { Write-Verbose "DebugMode actief: Graph-verbinding wordt overgeslagen." return } Test-RequiredModules $scopes = @( 'ServiceHealth.Read.All', 'Reports.Read.All', 'SecurityEvents.Read.All', 'Policy.Read.All' ) $ctx = Get-MgContext -ErrorAction SilentlyContinue $needsConnect = $Force -or -not $ctx if (-not $needsConnect -and $ctx) { $missing = $scopes | Where-Object { $_ -notin $ctx.Scopes } if ($missing) { $needsConnect = $true } } if ($needsConnect) { Write-Host "Verbinding maken met Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes $scopes -NoWelcome | Out-Null } try { Select-MgProfile -Name beta } catch { throw "Graph-profiel 'beta' kan niet worden geselecteerd. Update Microsoft.Graph modules." } } function Invoke-GraphPagedRequest { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string]$Uri ) $results = @() $next = $Uri while ($next) { $response = Invoke-MgGraphRequest -Method GET -Uri $next -OutputType PSObject if ($response.value) { $results += $response.value } $next = $response.'@odata.nextLink' } return $results } function Get-M365ServiceMessages { [CmdletBinding()] param() if ($DebugMode) { return @( [PSCustomObject]@{ Id = "MC-999001" Title = "Exchange Online zero-day mitigatie forceren" Severity = "critical" Services = @("Exchange Online") Classification = "Security" LastModified = (Get-Date).AddDays(-1) ActionRequiredBy = (Get-Date).AddDays(3) ShortLink = "https://aka.ms/exchange-mitigatie" Summary = "Transportregels moeten worden bijgewerkt voor uitgaande mailstromen." }, [PSCustomObject]@{ Id = "MC-999014" Title = "Teams content sharing hardening" Severity = "informational" Services = @("Microsoft Teams") Classification = "Configuration" LastModified = (Get-Date).AddDays(-2) ActionRequiredBy = (Get-Date).AddDays(14) ShortLink = "https://aka.ms/teams-sharing" Summary = "Nieuwe standaard voor externe schermdeling." } ) } Connect-M365Graph $uri = "https://graph.microsoft.com/beta/admin/serviceAnnouncement/messages?`$top=50&`$orderby=lastModifiedDateTime desc&`$select=id,title,severity,services,lastModifiedDateTime,category,isMajorChange,details" $raw = Invoke-GraphPagedRequest -Uri $uri return $raw | ForEach-Object { [PSCustomObject]@{ Id = $_.id Title = $_.title Severity = $_.severity Services = $_.services Classification = $_.category LastModified = $_.lastModifiedDateTime ActionRequiredBy = if ($_.details -and $_.details[0].actionRequiredByDateTime) { $_.details[0].actionRequiredByDateTime } else { $null } ShortLink = $_.details[0].supportArticleUrl Summary = $_.details[0].description } } } function Get-M365ServiceHealth { [CmdletBinding()] param() if ($DebugMode) { return [PSCustomObject]@{ OpenIncidents = 1 Issues = @( [PSCustomObject]@{ Service = "SharePoint Online" Status = "serviceDegradation" Details = "Latency pieken tijdens retentiepolicy uitrol." } ) } } Connect-M365Graph $uri = "https://graph.microsoft.com/beta/admin/serviceAnnouncement/healthOverviews?`$select=service,status" $raw = Invoke-GraphPagedRequest -Uri $uri $issues = @() foreach ($entry in $raw) { if ($entry.status -and $entry.status -ne 'serviceOperational') { $issues += [PSCustomObject]@{ Service = $entry.service Status = $entry.status Details = "Zie Service health center voor meer informatie." } } } return [PSCustomObject]@{ OpenIncidents = $issues.Count Issues = $issues } } function Get-M365SecureScore { [CmdletBinding()] param() if ($DebugMode) { return [PSCustomObject]@{ CurrentScore = 72 MaxScore = 82 Percentage = 87.8 LastUpdated = (Get-Date).AddDays(-1) } } Connect-M365Graph $uri = "https://graph.microsoft.com/beta/security/secureScores?`$top=1" $raw = Invoke-GraphPagedRequest -Uri $uri $score = $raw | Select-Object -First 1 if (-not $score) { return [PSCustomObject]@{ CurrentScore = 0 MaxScore = 0 Percentage = 0 LastUpdated = $null } } return [PSCustomObject]@{ CurrentScore = $score.currentScore MaxScore = $score.maxScore Percentage = if ($score.maxScore -gt 0) { [math]::Round(($score.currentScore / $score.maxScore) * 100, 2) } else { 0 } LastUpdated = $score.createdDateTime } } function Get-M365ConditionalAccessSummary { [CmdletBinding()] param() if ($DebugMode) { return [PSCustomObject]@{ TotalPolicies = 12 EnabledPolicies = 11 PoliciesWithControls = 9 LastPolicyModifiedDate = (Get-Date).AddDays(-3) } } Connect-M365Graph $uri = "https://graph.microsoft.com/beta/identity/conditionalAccess/policies?`$select=id,state,modifiedDateTime,grantControls" $policies = Invoke-GraphPagedRequest -Uri $uri $enabled = ($policies | Where-Object { $_.state -eq 'enabled' }).Count $withControls = ($policies | Where-Object { $_.grantControls -and $_.grantControls.builtInControls -contains 'mfa' }).Count $lastModified = ($policies | Sort-Object -Property modifiedDateTime -Descending | Select-Object -First 1).modifiedDateTime return [PSCustomObject]@{ TotalPolicies = $policies.Count EnabledPolicies = $enabled PoliciesWithControls = $withControls LastPolicyModifiedDate = $lastModified } } function Invoke-M365SecurityUpdateAssessment { [CmdletBinding()] param() Write-Verbose "Start beveiligingsupdate-assessment. DebugMode=$DebugMode" $messages = Get-M365ServiceMessages $serviceHealth = Get-M365ServiceHealth $secureScore = Get-M365SecureScore $caSummary = Get-M365ConditionalAccessSummary $issues = [System.Collections.Generic.List[string]]::new() $recommendations = [System.Collections.Generic.List[string]]::new() $critical = $messages | Where-Object { $_.Severity -eq 'critical' -or $_.Classification -eq 'Security' } $soonDue = $messages | Where-Object { $_.ActionRequiredBy -and $_.ActionRequiredBy -lt (Get-Date).AddDays(7) } if ($critical.Count -eq 0) { $recommendations.Add("Geen kritieke meldingen gevonden; bevestig dagelijkse monitoring.") } else { $issues.Add("Er zijn $($critical.Count) kritieke beveiligingsmeldingen die opvolging vereisen.") } if ($serviceHealth.OpenIncidents -gt 0) { $issues.Add("Open service health incidenten verhinderen volledige uitrol.") } if ($secureScore.Percentage -lt 80) { $recommendations.Add("Secure Score < 80%. Gebruik indicatoren voor bestuurlijke rapportages.") } if ($caSummary.EnabledPolicies -lt $caSummary.TotalPolicies) { $issues.Add("Conditional Access bevat uitgeschakelde policies; verifieer uitzonderingen.") } $pending = $messages | Select-Object @{ Name = 'Id' Expression = { $_.Id } }, @{ Name = 'Title' Expression = { $_.Title } }, @{ Name = 'Service' Expression = { $_.Services -join ', ' } }, @{ Name = 'Severity' Expression = { $_.Severity } }, @{ Name = 'Classification' Expression = { $_.Classification } }, @{ Name = 'ActionRequiredBy' Expression = { $_.ActionRequiredBy } }, @{ Name = 'Summary' Expression = { $_.Summary } }, @{ Name = 'Link' Expression = { $_.ShortLink } } return [PSCustomObject]@{ Script = "code/m365/security-updates/index.ps1" GeneratedOn = Get-Date DebugMode = [bool]$DebugMode PendingReleases = $pending ServiceHealth = $serviceHealth SecureScore = $secureScore ConditionalAccess = $caSummary CriticalMessages = $critical UpcomingDue = $soonDue Issues = $issues Recommendations = $recommendations IsHealthy = ($issues.Count -eq 0) } } function Start-M365UpdatePilot { [CmdletBinding()] param( [pscustomobject]$Assessment, [int]$PilotSize = 150 ) if (-not $Assessment) { $Assessment = Invoke-M365SecurityUpdateAssessment } $focusMessages = if ($Assessment.CriticalMessages.Count -gt 0) { $Assessment.CriticalMessages } else { $Assessment.PendingReleases | Select-Object -First 3 } $phases = @( [ordered]@{ Name = "Pilot" Coverage = "10% van prioritaire workloads" TargetUsers = $PilotSize Objectives = "Valideren van regressies, benchmarken van SOC-signalen, controleren van communicatieflows" ExitCriteria = "Geen kritieke incidenten binnen 24 uur en service health stabiel" }, [ordered]@{ Name = "Gefaseerde uitrol" Coverage = "40% (bestuurlijke staf, beleidsafdelingen, shared services)" TargetUsers = [math]::Round($PilotSize * 4) Objectives = "Opschalen terwijl fallback beschikbaar blijft" ExitCriteria = "Lessons learned verwerkt, servicedesk ready, CA policies afgestemd" }, [ordered]@{ Name = "Productiebrede uitrol" Coverage = "100% binnen afgesproken maintenance window" TargetUsers = "Volledige tenant" Objectives = "Volledige compliancestatus bereiken en bewijs genereren" ExitCriteria = "Rapportage gepubliceerd en rest-risico's geformaliseerd" } ) return [PSCustomObject]@{ Script = "code/m365/security-updates/index.ps1" GeneratedOn = Get-Date FocusUpdates = $focusMessages Phases = $phases PilotSize = $PilotSize DebugMode = [bool]$DebugMode Dependencies = @("Intune onderhoudsvensters", "Service health status", "Communicatiepakket gereed") } } function Publish-M365SecurityUpdateReport { [CmdletBinding()] param( [Parameter(Mandatory = $true)] $Payload, [Parameter(Mandatory = $true)] [string]$Path ) $directory = Split-Path -Path $Path -Parent if ($directory -and -not (Test-Path -Path $directory)) { New-Item -ItemType Directory -Path $directory -Force | Out-Null } if ($WhatIf) { Write-Host "[WhatIf] Rapport zou worden opgeslagen op $Path" -ForegroundColor Yellow return } $Payload | ConvertTo-Json -Depth 8 | Out-File -FilePath $Path -Encoding UTF8 -Force $hash = Get-FileHash -Path $Path -Algorithm SHA256 Write-Host "[OK] Rapport opgeslagen: $Path" -ForegroundColor Green Write-Host ("SHA256: {0}" -f $hash.Hash) -ForegroundColor Gray } function Export-M365SecurityUpdateRoadmap { [CmdletBinding()] param( [pscustomobject]$Assessment, [Parameter(Mandatory = $true)] [string]$Path ) if (-not $Assessment) { $Assessment = Invoke-M365SecurityUpdateAssessment } $roadmap = [ordered]@{ generatedOn = (Get-Date).ToString("yyyy-MM-ddTHH:mm:ssK") pending = $Assessment.PendingReleases serviceHealth= $Assessment.ServiceHealth secureScore = $Assessment.SecureScore } Publish-M365SecurityUpdateReport -Payload $roadmap -Path $Path } function Invoke-M365SecurityUpdateMonitoring { [CmdletBinding()] param( [pscustomobject]$Assessment ) if (-not $Assessment) { $Assessment = Invoke-M365SecurityUpdateAssessment } Write-Host "== Monitoringrapport ==" -ForegroundColor Cyan Write-Host ("Tijdstip : {0}" -f $Assessment.GeneratedOn) Write-Host ("Kritieke meldingen : {0}" -f $Assessment.CriticalMessages.Count) -ForegroundColor $(if ($Assessment.CriticalMessages.Count -gt 0) { "Yellow" } else { "Green" }) Write-Host ("Updates binnen 7 d : {0}" -f $Assessment.UpcomingDue.Count) -ForegroundColor $(if ($Assessment.UpcomingDue.Count -gt 0) { "Yellow" } else { "Green" }) Write-Host ("Secure Score : {0}% (laatst: {1})" -f $Assessment.SecureScore.Percentage, $Assessment.SecureScore.LastUpdated) Write-Host ("CA policies actief : {0}/{1}" -f $Assessment.ConditionalAccess.EnabledPolicies, $Assessment.ConditionalAccess.TotalPolicies) if ($Assessment.ServiceHealth.OpenIncidents -gt 0) { Write-Host "" Write-Host "Open Service Health incidenten:" -ForegroundColor Yellow foreach ($issue in $Assessment.ServiceHealth.Issues) { Write-Host (" - {0}: {1}" -f $issue.Service, $issue.Status) -ForegroundColor Yellow } } if ($Assessment.Issues.Count -gt 0) { Write-Host "" Write-Host "Issues:" -ForegroundColor Red $Assessment.Issues | ForEach-Object { Write-Host (" - {0}" -f $_) -ForegroundColor Red } } if ($Assessment.Recommendations.Count -gt 0) { Write-Host "" Write-Host "Aanbevelingen:" -ForegroundColor Cyan $Assessment.Recommendations | ForEach-Object { Write-Host (" - {0}" -f $_) -ForegroundColor Cyan } } return $Assessment } Write-M365SecurityUpdateHeader $executed = $false $assessmentResult = $null if ($Assessment) { $assessmentResult = Invoke-M365SecurityUpdateAssessment if ($ReportPath) { Publish-M365SecurityUpdateReport -Payload $assessmentResult -Path $ReportPath } $executed = $true $assessmentResult } if ($Monitoring) { $monitoringResult = Invoke-M365SecurityUpdateMonitoring -Assessment $assessmentResult if ($ReportPath) { Publish-M365SecurityUpdateReport -Payload $monitoringResult -Path $ReportPath } $executed = $true $monitoringResult } if ($RoadmapSync) { Export-M365SecurityUpdateRoadmap -Assessment $assessmentResult -Path $RoadmapPath $executed = $true } if (-not $executed) { Write-Host "Gebruik een van de volgende opties:" -ForegroundColor Yellow Write-Host " -Assessment Voer een security-update-assessment uit (optioneel -ReportPath)" -ForegroundColor Gray Write-Host " -Monitoring Toon overzicht van kritieke meldingen, Secure Score en CA status" -ForegroundColor Gray Write-Host " -RoadmapSync Schrijf pending updates en health naar -RoadmapPath" -ForegroundColor Gray Write-Host "Optioneel: -DebugMode voor lokale tests (<15 seconden) en -ReportPath voor evidence." -ForegroundColor Gray } Write-Host ""