Sécuriser les Accès
Microsoft 365

# Script de création d'une politique Conditional Access complète

function New-ComprehensiveConditionalAccessPolicy {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$PolicyName,

        [Parameter(Mandatory)]
        [string[]]$TargetUsers,

        [string[]]$ExcludeUsers = @("BreakGlassAccount@contoso.com"),

        [Parameter(Mandatory)]
        [string[]]$CloudApps,

        [string[]]$TrustedLocations = @(),

        [ValidateSet("Allow", "Block", "RequireMFA", "RequireCompliantDevice")]
        [string]$GrantControl = "RequireMFA",

        [switch]$EnableSessionControls,

        [switch]$ReportOnlyMode
    )

    # Connexion à Microsoft Graph avec les scopes requis
    Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess", "Directory.Read.All"

    # Construction de la politique
    $policy = @{
        displayName = $PolicyName
        state = if ($ReportOnlyMode) { "enabledForReportingButNotEnforced" } else { "enabled" }

        conditions = @{
            users = @{
                includeUsers = $TargetUsers
                excludeUsers = $ExcludeUsers
            }
            applications = @{
                includeApplications = $CloudApps
                excludeApplications = @()
            }
            platforms = @{
                includePlatforms = @("all")
                excludePlatforms = @()
            }
            locations = if ($TrustedLocations.Count -gt 0) {
                @{
                    includeLocations = @("All")
                    excludeLocations = $TrustedLocations
                }
            } else {
                @{
                    includeLocations = @("All")
                }
            }
            clientAppTypes = @("all")
            deviceStates = @{
                includeStates = @("all")
                excludeStates = @()
            }
        }
    }

    # Configuration des contrôles d'accès
    switch ($GrantControl) {
        "RequireMFA" {
            $policy.grantControls = @{
                operator = "OR"
                builtInControls = @("mfa")
                customAuthenticationFactors = @()
                termsOfUse = @()
            }
        }
        "RequireCompliantDevice" {
            $policy.grantControls = @{
                operator = "OR"
                builtInControls = @("compliantDevice", "hybridAzureADJoinedDevice")
            }
        }
        "Block" {
            $policy.grantControls = @{
                operator = "OR"
                builtInControls = @("block")
            }
        }
        default {
            $policy.grantControls = @{
                operator = "OR"
                builtInControls = @("mfa")
            }
        }
    }

    # Configuration des contrôles de session si activés
    if ($EnableSessionControls) {
        $policy.sessionControls = @{
            applicationEnforcedRestrictions = @{
                isEnabled = $false
            }
            cloudAppSecurity = @{
                isEnabled = $true
                cloudAppSecurityType = "monitorOnly"
            }
            signInFrequency = @{
                isEnabled = $true
                type = "hours"
                value = 8
            }
            persistentBrowser = @{
                isEnabled = $false
            }
        }
    }

    try {
        # Création de la politique
        $newPolicy = New-MgIdentityConditionalAccessPolicy -BodyParameter $policy

        Write-Host "✅ Politique '$PolicyName' créée avec succès" -ForegroundColor Green
        Write-Host "   ID: $($newPolicy.Id)" -ForegroundColor Gray
        Write-Host "   État: $($newPolicy.State)" -ForegroundColor Gray

        # Vérification et rapport
        $report = @{
            PolicyId = $newPolicy.Id
            PolicyName = $newPolicy.DisplayName
            State = $newPolicy.State
            TargetUsers = $TargetUsers.Count
            TargetApps = $CloudApps.Count
            GrantControls = $policy.grantControls.builtInControls -join ", "
            SessionControls = if ($EnableSessionControls) { "Enabled" } else { "Disabled" }
            CreatedDate = Get-Date
        }

        return $report
    }
    catch {
        Write-Error "❌ Erreur lors de la création de la politique: $($_.Exception.Message)"
        throw
    }
}

# Template de politique pour administrateurs

$adminPolicy = @{
    displayName = "CA001-BLOCK-AdminAccess-UntrustedLocations"
    state = "enabled"
    conditions = @{
        users = @{
            includeRoles = @(
                "62e90394-69f5-4237-9190-012177145e10", # Global Administrator
                "e8611ab8-c189-46e8-94e1-60213ab1f814", # Privileged Role Administrator
                "fe930be7-5e62-47db-91af-98c3a49a38b1", # User Administrator
                "29232cdf-9323-42fd-ade2-1d097af3e4de", # Exchange Administrator
                "f28a1f50-f6e7-4571-818b-6a12f2af6b6c"  # SharePoint Administrator
            )
            excludeUsers = @("breakglass1@contoso.com", "breakglass2@contoso.com")
        }
        applications = @{
            includeApplications = @("All")
        }
        locations = @{
            includeLocations = @("All")
            excludeLocations = @("TrustedCorporateNetwork", "HomeOfficeLocations")
        }
        clientAppTypes = @("all")
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @("block")
    }
}

# Création avec validation
try {
    New-MgIdentityConditionalAccessPolicy -BodyParameter $adminPolicy
    Write-Host "✅ Politique administrateur créée avec succès" -ForegroundColor Green
} catch {
    Write-Error "❌ Échec création politique: $($_.Exception.Message)"
}

# Configuration avancée des méthodes MFA

function Configure-AdvancedMFAMethods {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$TenantId,

        [switch]$DisableWeakMethods,
        [switch]$EnforceStrongMethods,
        [switch]$EnablePasswordlessOnly
    )

    # Connexion avec permissions appropriées
    Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod", "UserAuthenticationMethod.ReadWrite.All"

    # Configuration des politiques par méthode d'authentification
    $authMethodPolicies = @{
        # Microsoft Authenticator - Recommandée
        "MicrosoftAuthenticator" = @{
            IsEnabled = $true
            ExcludeTargets = @()
            Configuration = @{
                IsSoftwareOathEnabled = $false
                IsPhoneAppNotificationEnabled = $true
                IsPhoneAppOTPEnabled = $false
            }
        }

        # FIDO2 Security Keys - Plus sécurisé
        "Fido2" = @{
            IsEnabled = $true
            IsAttestationEnforced = $true
            IsSelfServiceRegistrationAllowed = $false
            KeyRestrictions = @{
                AaGuids = @() # Limiter aux fournisseurs approuvés
                EnforcementType = "Allow"
            }
        }

        # SMS - À limiter ou désactiver
        "Sms" = @{
            IsEnabled = if ($DisableWeakMethods) { $false } else { $true }
            ExcludeTargets = if ($EnforceStrongMethods) { @() } else { @("Administrators") }
        }

        # Appels vocaux - À limiter
        "Voice" = @{
            IsEnabled = if ($DisableWeakMethods) { $false } else { $true }
            ExcludeTargets = @("Administrators")
        }

        # Email - À désactiver pour la production
        "Email" = @{
            IsEnabled = $false
            ExcludeTargets = @("All")
        }

        # Software OATH tokens
        "SoftwareOath" = @{
            IsEnabled = $true
            ExcludeTargets = @()
        }

        # Temporary Access Pass (TAP)
        "TemporaryAccessPass" = @{
            IsEnabled = $true
            DefaultLifetimeInMinutes = 60
            DefaultLength = 8
            MinimumLifetimeInMinutes = 10
            MaximumLifetimeInMinutes = 480
            IsUsableOnce = $true
        }
    }

    $results = @()

    foreach ($method in $authMethodPolicies.Keys) {
        try {
            $config = $authMethodPolicies[$method]

            # Application de la configuration selon la méthode
            switch ($method) {
                "MicrosoftAuthenticator" {
                    $policy = Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $method -BodyParameter $config
                }
                "Fido2" {
                    $policy = Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $method -BodyParameter $config
                }
                "Sms" {
                    $policy = Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $method -BodyParameter $config
                }
                default {
                    $policy = Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $method -BodyParameter $config
                }
            }

            $results += [PSCustomObject]@{
                Method = $method
                Status = if ($config.IsEnabled) { "Enabled" } else { "Disabled" }
                Configuration = $config | ConvertTo-Json -Compress
                Result = "Success"
            }

            Write-Host "✅ Méthode $method configurée avec succès" -ForegroundColor Green

        } catch {
            Write-Warning "⚠️ Erreur configuration $method : $($_.Exception.Message)"

            $results += [PSCustomObject]@{
                Method = $method
                Status = "Error"
                Configuration = $null
                Result = $_.Exception.Message
            }
        }
    }

    # Configuration des politiques de registration MFA
    if ($EnablePasswordlessOnly) {
        $registrationPolicy = @{
            IsEnabled = $true
            MfaRequiredState = "Required"
            SsprRequiredState = "Required"
            RequireNumberOfAuthenticationMethods = 2
            DaysUntilForcedRegistration = 14
            RegistrationReEnforceToleranceInDays = 3
        }

        try {
            Update-MgPolicyAuthenticationMethodPolicyRegistrationEnforcement -BodyParameter $registrationPolicy
            Write-Host "✅ Politique d'enregistrement MFA configurée" -ForegroundColor Green
        } catch {
            Write-Warning "⚠️ Erreur configuration politique d'enregistrement: $($_.Exception.Message)"
        }
    }

    return $results
}