Sécuriser les Accès Microsoft | Guide Microsoft 365

# Script de création d'une politique Conditional Access complète

function New-ComprehensiveConditionalAccessPolicy {
 [CmdletBinding()]
 param(
 [Parameter(Mandatory)]
 [string]$PolicyName,

 [Parameter(Mandatory)]
 [string[]]$TargetUsers,

 [string[]]$ExcludeUsers = @("[email protected]"),

 [Parameter(Mandatory)]
 [string[]]$CloudApps,

 [string[]]$TrustedLocations = @(),

 [ValidateSet("Allow", "Block", "RequireMFA", "RequireCompliantDevice")]
 [string]$GrantControl = "RequireMFA",

 [switch]$EnableSessionControls,

 [switch]$ReportOnlyMode
 )

 # Connexion à Microsoft Graph avec les scopes requis
 Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess", "Directory.Read.All"

 # Construction de la politique
 $policy = @{
 displayName = $PolicyName
 state = if ($ReportOnlyMode) { "enabledForReportingButNotEnforced" } else { "enabled" }

 conditions = @{
 users = @{
 includeUsers = $TargetUsers
 excludeUsers = $ExcludeUsers
 }
 applications = @{
 includeApplications = $CloudApps
 excludeApplications = @()
 }
 platforms = @{
 includePlatforms = @("all")
 excludePlatforms = @()
 }
 locations = if ($TrustedLocations.Count -gt 0) {
 @{
 includeLocations = @("All")
 excludeLocations = $TrustedLocations
 }
 } else {
 @{
 includeLocations = @("All")
 }
 }
 clientAppTypes = @("all")
 deviceStates = @{
 includeStates = @("all")
 excludeStates = @()
 }
 }
 }

 # Configuration des contrôles d'accès
 switch ($GrantControl) {
 "RequireMFA" {
 $policy.grantControls = @{
 operator = "OR"
 builtInControls = @("mfa")
 customAuthenticationFactors = @()
 termsOfUse = @()
 }
 }
 "RequireCompliantDevice" {
 $policy.grantControls = @{
 operator = "OR"
 builtInControls = @("compliantDevice", "hybridAzureADJoinedDevice")
 }
 }
 "Block" {
 $policy.grantControls = @{
 operator = "OR"
 builtInControls = @("block")
 }
 }
 default {
 $policy.grantControls = @{
 operator = "OR"
 builtInControls = @("mfa")
 }
 }
 }

 # Configuration des contrôles de session si activés
 if ($EnableSessionControls) {
 $policy.sessionControls = @{
 applicationEnforcedRestrictions = @{
 isEnabled = $false
 }
 cloudAppSecurity = @{
 isEnabled = $true
 cloudAppSecurityType = "monitorOnly"
 }
 signInFrequency = @{
 isEnabled = $true
 type = "hours"
 value = 8
 }
 persistentBrowser = @{
 isEnabled = $false
 }
 }
 }

 try {
 # Création de la politique
 $newPolicy = New-MgIdentityConditionalAccessPolicy -BodyParameter $policy

 Write-Host "✅ Politique '$PolicyName' créée avec succès" -ForegroundColor Green
 Write-Host " ID: $($newPolicy.Id)" -ForegroundColor Gray
 Write-Host " État: $($newPolicy.State)" -ForegroundColor Gray

 # Vérification et rapport
 $report = @{
 PolicyId = $newPolicy.Id
 PolicyName = $newPolicy.DisplayName
 State = $newPolicy.State
 TargetUsers = $TargetUsers.Count
 TargetApps = $CloudApps.Count
 GrantControls = $policy.grantControls.builtInControls -join ", "
 SessionControls = if ($EnableSessionControls) { "Enabled" } else { "Disabled" }
 CreatedDate = Get-Date
 }

 return $report
 }
 catch {
 Write-Error "❌ Erreur lors de la création de la politique: $($_.Exception.Message)"
 throw
 }
}

# Template de politique pour administrateurs

$adminPolicy = @{
 displayName = "CA001-BLOCK-AdminAccess-UntrustedLocations"
 state = "enabled"
 conditions = @{
 users = @{
 includeRoles = @(
 "62e90394-69f5-4237-9190-012177145e10", # Global Administrator
 "e8611ab8-c189-46e8-94e1-60213ab1f814", # Privileged Role Administrator
 "fe930be7-5e62-47db-91af-98c3a49a38b1", # User Administrator
 "29232cdf-9323-42fd-ade2-1d097af3e4de", # Exchange Administrator
 "f28a1f50-f6e7-4571-818b-6a12f2af6b6c" # SharePoint Administrator
 )
 excludeUsers = @("[email protected]", "[email protected]")
 }
 applications = @{
 includeApplications = @("All")
 }
 locations = @{
 includeLocations = @("All")
 excludeLocations = @("TrustedCorporateNetwork", "HomeOfficeLocations")
 }
 clientAppTypes = @("all")
 }
 grantControls = @{
 operator = "OR"
 builtInControls = @("block")
 }
}

# Création avec validation
try {
 New-MgIdentityConditionalAccessPolicy -BodyParameter $adminPolicy
 Write-Host "✅ Politique administrateur créée avec succès" -ForegroundColor Green
} catch {
 Write-Error "❌ Échec création politique: $($_.Exception.Message)"
}

# Configuration avancée des méthodes MFA

function Configure-AdvancedMFAMethods {
 [CmdletBinding()]
 param(
 [Parameter(Mandatory)]
 [string]$TenantId,

 [switch]$DisableWeakMethods,
 [switch]$EnforceStrongMethods,
 [switch]$EnablePasswordlessOnly
 )

 # Connexion avec permissions appropriées
 Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod", "UserAuthenticationMethod.ReadWrite.All"

 # Configuration des politiques par méthode d'authentification
 $authMethodPolicies = @{
 # Microsoft Authenticator - Recommandée
 "MicrosoftAuthenticator" = @{
 IsEnabled = $true
 ExcludeTargets = @()
 Configuration = @{
 IsSoftwareOathEnabled = $false
 IsPhoneAppNotificationEnabled = $true
 IsPhoneAppOTPEnabled = $false
 }
 }

 # FIDO2 Security Keys - Plus sécurisé
 "Fido2" = @{
 IsEnabled = $true
 IsAttestationEnforced = $true
 IsSelfServiceRegistrationAllowed = $false
 KeyRestrictions = @{
 AaGuids = @() # Limiter aux fournisseurs approuvés
 EnforcementType = "Allow"
 }
 }

 # SMS - À limiter ou désactiver
 "Sms" = @{
 IsEnabled = if ($DisableWeakMethods) { $false } else { $true }
 ExcludeTargets = if ($EnforceStrongMethods) { @() } else { @("Administrators") }
 }

 # Appels vocaux - À limiter
 "Voice" = @{
 IsEnabled = if ($DisableWeakMethods) { $false } else { $true }
 ExcludeTargets = @("Administrators")
 }

 # Email - À désactiver pour la production
 "Email" = @{
 IsEnabled = $false
 ExcludeTargets = @("All")
 }

 # Software OATH tokens
 "SoftwareOath" = @{
 IsEnabled = $true
 ExcludeTargets = @()
 }

 # Temporary Access Pass (TAP)
 "TemporaryAccessPass" = @{
 IsEnabled = $true
 DefaultLifetimeInMinutes = 60
 DefaultLength = 8
 MinimumLifetimeInMinutes = 10
 MaximumLifetimeInMinutes = 480
 IsUsableOnce = $true
 }
 }

 $results = @()

 foreach ($method in $authMethodPolicies.Keys) {
 try {
 $config = $authMethodPolicies[$method]

 # Application de la configuration selon la méthode
 switch ($method) {
 "MicrosoftAuthenticator" {
 $policy = Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $method -BodyParameter $config
 }
 "Fido2" {
 $policy = Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $method -BodyParameter $config
 }
 "Sms" {
 $policy = Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $method -BodyParameter $config
 }
 default {
 $policy = Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $method -BodyParameter $config
 }
 }

 $results += [PSCustomObject]@{
 Method = $method
 Status = if ($config.IsEnabled) { "Enabled" } else { "Disabled" }
 Configuration = $config | ConvertTo-Json -Compress
 Result = "Success"
 }

 Write-Host "✅ Méthode $method configurée avec succès" -ForegroundColor Green

 } catch {
 Write-Warning "⚠️ Erreur configuration $method : $($_.Exception.Message)"

 $results += [PSCustomObject]@{
 Method = $method
 Status = "Error"
 Configuration = $null
 Result = $_.Exception.Message
 }
 }
 }

 # Configuration des politiques de registration MFA
 if ($EnablePasswordlessOnly) {
 $registrationPolicy = @{
 IsEnabled = $true
 MfaRequiredState = "Required"
 SsprRequiredState = "Required"
 RequireNumberOfAuthenticationMethods = 2
 DaysUntilForcedRegistration = 14
 RegistrationReEnforceToleranceInDays = 3
 }

 try {
 Update-MgPolicyAuthenticationMethodPolicyRegistrationEnforcement -BodyParameter $registrationPolicy
 Write-Host "✅ Politique d'enregistrement MFA configurée" -ForegroundColor Green
 } catch {
 Write-Warning "⚠️ Erreur configuration politique d'enregistrement: $($_.Exception.Message)"
 }
 }

 return $results
}