Microsoft 365 et Conformité : Guide Audit Sécurité 2026

# Configuration initiale Microsoft Purview

function Initialize-PurviewGovernance {
 [CmdletBinding()]
 param(
 [Parameter(Mandatory)]
 [string]$TenantId,

 [Parameter(Mandatory)]
 [string]$SubscriptionId,

 [string]$ResourceGroupName = "rg-purview-governance",
 [string]$PurviewAccountName = "purview-$((Get-Random).ToString().Substring(0,6))",
 [string]$Location = "West Europe"
 )

 # Connexion aux services requis
 Connect-AzAccount
 Connect-MgGraph -Scopes "Directory.Read.All", "Policy.ReadWrite.ConditionalAccess"

 Write-Host "🚀 Initialisation Microsoft Purview..." -ForegroundColor Cyan

 # Création du compte Purview
 $purviewAccount = @{
 accountName = $PurviewAccountName
 location = $Location
 properties = @{
 publicNetworkAccess = "Enabled"
 managedResourceGroupName = "$ResourceGroupName-managed"
 }
 identity = @{
 type = "SystemAssigned"
 }
 }

 try {
 # Création du resource group
 $rg = New-AzResourceGroup -Name $ResourceGroupName -Location $Location -Force
 Write-Host "✅ Resource Group créé: $($rg.ResourceGroupName)" -ForegroundColor Green

 # Déploiement du compte Purview
 $deployment = New-AzResourceGroupDeployment -ResourceGroupName $ResourceGroupName -TemplateParameterObject $purviewAccount

 Write-Host "✅ Compte Purview déployé: $PurviewAccountName" -ForegroundColor Green

 # Configuration des rôles et permissions
 $purviewPrincipalId = (Get-AzResource -Name $PurviewAccountName -ResourceType "Microsoft.Purview/accounts").Identity.PrincipalId

 # Attribution des rôles requis
 $roleAssignments = @(
 @{ Role = "Storage Blob Data Reader"; Scope = "/subscriptions/$SubscriptionId" },
 @{ Role = "Reader"; Scope = "/subscriptions/$SubscriptionId" },
 @{ Role = "Purview Data Reader"; Scope = "/subscriptions/$SubscriptionId" }
 )

 foreach ($assignment in $roleAssignments) {
 try {
 New-AzRoleAssignment -ObjectId $purviewPrincipalId -RoleDefinitionName $assignment.Role -Scope $assignment.Scope -ErrorAction SilentlyContinue
 Write-Host "✅ Rôle attribué: $($assignment.Role)" -ForegroundColor Green
 } catch {
 Write-Warning "⚠️ Erreur attribution rôle $($assignment.Role): $($_.Exception.Message)"
 }
 }

 # Configuration des data sources Microsoft 365
 $dataSources = @(
 @{
 Name = "M365-Exchange"
 Type = "AzureExchangeOnline"
 Description = "Exchange Online mailboxes and content"
 },
 @{
 Name = "M365-SharePoint"
 Type = "AzureSharePointOnline"
 Description = "SharePoint sites and OneDrive content"
 },
 @{
 Name = "M365-Teams"
 Type = "AzureTeams"
 Description = "Teams conversations and files"
 }
 )

 foreach ($source in $dataSources) {
 Write-Host "📊 Configuration data source: $($source.Name)" -ForegroundColor Yellow
 # Configuration via API Purview (nécessite SDK Purview)
 }

 # Configuration des policies de base
 $basePolicies = @{
 "PII-Detection" = @{
 Description = "Automatic détection of PII data"
 Rules = @("Email", "Phone", "SSN", "CreditCard")
 Actions = @("Classify", "Alert", "Audit")
 }
 "Financial-Data" = @{
 Description = "Financial data protection"
 Rules = @("BankAccount", "IBAN", "SWIFT")
 Actions = @("Classify", "Encrypt", "Restrict")
 }
 "Health-Data" = @{
 Description = "Healthcare data compliance"
 Rules = @("MedicalRecord", "Prescription", "Diagnosis")
 Actions = @("Classify", "Audit", "Restrict")
 }
 }

 $results = @{
 PurviewAccountName = $PurviewAccountName
 ResourceGroup = $ResourceGroupName
 Location = $Location
 PrincipalId = $purviewPrincipalId
 DataSources = $dataSources.Count
 Policies = $basePolicies.Count
 Status = "Deployed Successfully"
 NextSteps = @(
 "Configure data source scans",
 "Set up classification rules",
 "Enable automated labeling",
 "Create compliance dashboards"
 )
 }

 return $results

 } catch {
 Write-Error "❌ Erreur lors du déploiement Purview: $($_.Exception.Message)"
 throw
 }
}

# Configuration des sensitivity labels avec PowerShell

function Deploy-SensitivityLabels {
 [CmdletBinding()]
 param(
 [switch]$EnableAutoLabeling,
 [switch]$ConfigureProtection,
 [string[]]$Scopes = @("File", "Email", "Site", "UnifiedGroup")
 )

 # Connexion au Security & Compliance Center
 Connect-IPPSSession -UserPrincipalName $env:USERNAME

 # Configuration des labels de base
 $labels = @(
 @{
 Name = "Public"
 DisplayName = "Public"
 Description = "Information publique sans restriction"
 Color = "Green"
 Priority = 0
 Settings = @{
 ContentType = @("File", "Email", "Site")
 Protection = $null
 Marking = @{
 WaterMarkText = "PUBLIC"
 HeaderText = "Classification: Public"
 }
 }
 },
 @{
 Name = "Internal"
 DisplayName = "Usage Interne"
 Description = "Information interne à l'organisation"
 Color = "Yellow"
 Priority = 1
 Settings = @{
 ContentType = @("File", "Email", "Site", "UnifiedGroup")
 Protection = @{
 Type = "UserDefined"
 UserRights = @("domain.com=View,Edit,Save,Export,Reply")
 }
 Marking = @{
 WaterMarkText = "USAGE INTERNE"
 HeaderText = "Classification: Usage Interne"
 FooterText = "Propriété de [Organization] - Diffusion interne uniquement"
 }
 }
 },
 @{
 Name = "Confidential"
 DisplayName = "Confidentiel"
 Description = "Information confidentielle nécessitant une protection renforcée"
 Color = "Red"
 Priority = 2
 Settings = @{
 ContentType = @("File", "Email", "Site", "UnifiedGroup")
 Protection = @{
 Type = "Template"
 TemplateId = "Encrypt-AuthenticatedUsers"
 ContentExpirationDate = (Get-Date).AddYears(2)
 OfflineAccessInterval = 7
 }
 Marking = @{
 WaterMarkText = "CONFIDENTIEL"
 HeaderText = "Classification: Confidentiel"
 FooterText = "Propriété de [Organization] - Accès autorisé uniquement"
 }
 DLPSettings = @{
 BlockExternalSharing = $true
 RequireJustification = $true
 AuditAccess = $true
 }
 }
 },
 @{
 Name = "HighlyConfidential"
 DisplayName = "Hautement Confidentiel"
 Description = "Information hautement sensible - Accès très restreint"
 Color = "Red"
 Priority = 3
 Settings = @{
 ContentType = @("File", "Email")
 Protection = @{
 Type = "Custom"
 Rights = @{
 "executives@domain.com" = @("View", "Edit")
 "legal@domain.com" = @("View")
 "compliance@domain.com" = @("View", "Audit")
 }
 ContentExpirationDate = (Get-Date).AddMonths(6)
 OfflineAccessInterval = 1
 RequireAdditionalAuth = $true
 }
 Marking = @{
 WaterMarkText = "HAUTEMENT CONFIDENTIEL"
 HeaderText = "Classification: Hautement Confidentiel"
 FooterText = "Accès restreint - Ne pas diffuser"
 }
 DLPSettings = @{
 BlockExternalSharing = $true
 BlockPrinting = $true
 BlockCopyPaste = $true
 RequireJustification = $true
 ManagerApprovalRequired = $true
 }
 }
 }
 )

 $deployedLabels = @()

 foreach ($labelConfig in $labels) {
 try {
 Write-Host "📋 Création du label: $($labelConfig.DisplayName)" -ForegroundColor Cyan

 # Création du sensitivity label
 $labelParams = @{
 Name = $labelConfig.Name
 DisplayName = $labelConfig.DisplayName
 Comment = $labelConfig.Description
 AdvancedSettings = @{
 Color = $labelConfig.Color
 Priority = $labelConfig.Priority
 }
 }

 $newLabel = New-Label @labelParams

 # Configuration des protection settings si spécifiés
 if ($ConfigureProtection -and $labelConfig.Settings.Protection) {
 $protectionParams = @{
 Identity = $newLabel.Guid
 }

 switch ($labelConfig.Settings.Protection.Type) {
 "Template" {
 $protectionParams.RightsManagementProtection = $labelConfig.Settings.Protection.TemplateId
 }
 "Custom" {
 $protectionParams.UserRightsManagementSettings = $labelConfig.Settings.Protection.Rights | ConvertTo-Json
 }
 "UserDefined" {
 $protectionParams.UserRightsManagementSettings = $labelConfig.Settings.Protection.UserRights -join ";"
 }
 }

 Set-Label @protectionParams
 }

 # Configuration du visual marking
 if ($labelConfig.Settings.Marking) {
 $markingParams = @{
 Identity = $newLabel.Guid
 }

 if ($labelConfig.Settings.Marking.WaterMarkText) {
 $markingParams.ApplyWaterMarkText = $labelConfig.Settings.Marking.WaterMarkText
 $markingParams.WaterMarkAlignment = "Center"
 $markingParams.WaterMarkEnabled = $true
 }

 if ($labelConfig.Settings.Marking.HeaderText) {
 $markingParams.ApplyContentMarkingHeaderText = $labelConfig.Settings.Marking.HeaderText
 $markingParams.ContentMarkingHeaderEnabled = $true
 }

 if ($labelConfig.Settings.Marking.FooterText) {
 $markingParams.ApplyContentMarkingFooterText = $labelConfig.Settings.Marking.FooterText
 $markingParams.ContentMarkingFooterEnabled = $true
 }

 Set-Label @markingParams
 }

 # Publication du label
 $publishParams = @{
 Name = "Policy-$($labelConfig.Name)"
 Labels = $newLabel.Guid
 ExchangeLocation = "All"
 SharePointLocation = "All"
 OneDriveLocation = "All"
 TeamsLocation = "All"
 }

 New-LabelPolicy @publishParams

 $deployedLabels += [PSCustomObject]@{
 Name = $labelConfig.Name
 DisplayName = $labelConfig.DisplayName
 Guid = $newLabel.Guid
 Priority = $labelConfig.Priority
 Status = "Deployed"
 Scopes = $labelConfig.Settings.ContentType -join ", "
 }

 Write-Host "✅ Label déployé: $($labelConfig.DisplayName)" -ForegroundColor Green

 } catch {
 Write-Warning "⚠️ Erreur déploiement label $($labelConfig.Name): $($_.Exception.Message)"

 $deployedLabels += [PSCustomObject]@{
 Name = $labelConfig.Name
 DisplayName = $labelConfig.DisplayName
 Status = "Failed"
 Error = $_.Exception.Message
 }
 }
 }

 # Configuration de l'auto-labeling si demandé
 if ($EnableAutoLabeling) {
 Write-Host "🤖 Configuration de l'auto-labeling..." -ForegroundColor Yellow

 $autoLabelingRules = @{
 "PII-Detection" = @{
 Label = "Confidential"
 Conditions = @("EU Passport Number", "Credit Card Number", "Social Security Number")
 Confidence = 85
 Actions = @("ApplyLabel", "Notify", "Audit")
 }
 "Financial-Data" = @{
 Label = "HighlyConfidential"
 Conditions = @("Bank Account Number", "SWIFT Code", "Financial Report")
 Confidence = 90
 Actions = @("ApplyLabel", "Notify", "Block", "Audit")
 }
 }

 foreach ($rule in $autoLabelingRules.Keys) {
 $ruleConfig = $autoLabelingRules[$rule]

 try {
 New-AutoSensitivityLabelPolicy -Name $rule -ApplySensitivityLabel $ruleConfig.Label -ExchangeLocation All -SharePointLocation All -OneDriveLocation All -Mode Simulate

 Write-Host "✅ Règle auto-labeling créée: $rule" -ForegroundColor Green
 } catch {
 Write-Warning "⚠️ Erreur création règle $rule : $($_.Exception.Message)"
 }
 }
 }

 return $deployedLabels
}