Aangepaste Script Personal Restricted

<# .SYNOPSIS Custom Script Personal Sites Restricted .DESCRIPTION Restricts custom scripts on personal SharePoint sites .NOTES NL Baseline v2.0 Security risk: Custom scripts can introduce XSS vulnerabilities #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Custom Script Personal Sites Restricted" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host " ⚠️ Manual verification required" -ForegroundColor Yellow Write-Host "`n PowerShell Commands:" -ForegroundColor Cyan Write-Host " Connect-SPOService -Url https://TENANT-admin.sharepoint.com" -ForegroundColor Gray Write-Host " Get-SPOSite -IncludePersonalSite `$true | Select-Object Url,DenyAddAndCustomizePages" -ForegroundColor Gray Write-Host "`n Required Setting:" -ForegroundColor Cyan Write-Host " ✓ DenyAddAndCustomizePages = True (custom scripts blocked)" -ForegroundColor Gray Write-Host "`n Remediation Command:" -ForegroundColor Yellow Write-Host " Set-SPOSite -Identity <URL> -DenyAddAndCustomizePages `$true" -ForegroundColor Gray Write-Host "`n Security Risk:" -ForegroundColor Red Write-Host " • Custom scripts can introduce XSS vulnerabilities" -ForegroundColor Red Write-Host " • Potential for malicious code execution" -ForegroundColor Red Write-Host " • Data exfiltration risk" -ForegroundColor Red Write-Host "`n Security Benefits:" -ForegroundColor Cyan Write-Host " • Prevents script injection attacks" -ForegroundColor Gray Write-Host " • Reduces attack surface" -ForegroundColor Gray Write-Host " • Maintains site security" -ForegroundColor Gray Write-Host "`n ⚠️ Security Risk: Custom scripts can introduce XSS!" -ForegroundColor Red exit 0 } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }