From 302044cf90c44f420bc1563b40d5c9710af27bf9 Mon Sep 17 00:00:00 2001 From: merill <1288081+merill@users.noreply.github.com> Date: Sat, 25 Jul 2026 10:45:49 +0000 Subject: [PATCH] [create-pull-request] automated change --- ...tGsaBaselineThreatIntelligenceEnforced.mdx | 73 ++++++++++++ ...tGsaCompliantNetworkBreakGlassExcluded.mdx | 75 ++++++++++++ ...saForwardingProfileAssignmentNotNested.mdx | 76 ++++++++++++ .../commands/Test-MtGsaM365ProfileEnabled.mdx | 75 ++++++++++++ ...GsaPrivateAccessAppAssignmentNotNested.mdx | 76 ++++++++++++ ...t-MtGsaPrivateAccessAppCompliantDevice.mdx | 76 ++++++++++++ ...ateAccessAppNotOnDefaultConnectorGroup.mdx | 72 ++++++++++++ ...st-MtGsaPrivateAccessAppSegmentHygiene.mdx | 107 +++++++++++++++++ ...Test-MtGsaQuickAccessNoSignInFrequency.mdx | 111 ++++++++++++++++++ website/docs/commands/docusaurus.sidebar.js | 9 ++ ...tGsaBaselineThreatIntelligenceEnforced.mdx | 73 ++++++++++++ ...tGsaCompliantNetworkBreakGlassExcluded.mdx | 75 ++++++++++++ ...saForwardingProfileAssignmentNotNested.mdx | 76 ++++++++++++ .../commands/Test-MtGsaM365ProfileEnabled.mdx | 75 ++++++++++++ ...GsaPrivateAccessAppAssignmentNotNested.mdx | 76 ++++++++++++ ...t-MtGsaPrivateAccessAppCompliantDevice.mdx | 76 ++++++++++++ ...ateAccessAppNotOnDefaultConnectorGroup.mdx | 72 ++++++++++++ ...st-MtGsaPrivateAccessAppSegmentHygiene.mdx | 107 +++++++++++++++++ ...Test-MtGsaQuickAccessNoSignInFrequency.mdx | 111 ++++++++++++++++++ 19 files changed, 1491 insertions(+) create mode 100644 website/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced.mdx create mode 100644 website/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded.mdx create mode 100644 website/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested.mdx create mode 100644 website/docs/commands/Test-MtGsaM365ProfileEnabled.mdx create mode 100644 website/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested.mdx create mode 100644 website/docs/commands/Test-MtGsaPrivateAccessAppCompliantDevice.mdx create mode 100644 website/docs/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.mdx create mode 100644 website/docs/commands/Test-MtGsaPrivateAccessAppSegmentHygiene.mdx create mode 100644 website/docs/commands/Test-MtGsaQuickAccessNoSignInFrequency.mdx create mode 100644 website/versioned_docs/version-2.1.0/commands/Test-MtGsaBaselineThreatIntelligenceEnforced.mdx create mode 100644 website/versioned_docs/version-2.1.0/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded.mdx create mode 100644 website/versioned_docs/version-2.1.0/commands/Test-MtGsaForwardingProfileAssignmentNotNested.mdx create mode 100644 website/versioned_docs/version-2.1.0/commands/Test-MtGsaM365ProfileEnabled.mdx create mode 100644 website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested.mdx create mode 100644 website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppCompliantDevice.mdx create mode 100644 website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.mdx create mode 100644 website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppSegmentHygiene.mdx create mode 100644 website/versioned_docs/version-2.1.0/commands/Test-MtGsaQuickAccessNoSignInFrequency.mdx diff --git a/website/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced.mdx b/website/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced.mdx new file mode 100644 index 000000000..16bb5655b --- /dev/null +++ b/website/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced.mdx @@ -0,0 +1,73 @@ +--- +sidebar_class_name: hidden +description: "Checks that the baseline Global Secure Access security profile enforces a threat-intelligence floor." +id: Test-MtGsaBaselineThreatIntelligenceEnforced +title: Test-MtGsaBaselineThreatIntelligenceEnforced +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaBaselineThreatIntelligenceEnforced.ps1 +--- + +## SYNOPSIS + +Checks that the baseline Global Secure Access security profile enforces a threat-intelligence floor. + +## SYNTAX + +```powershell +Test-MtGsaBaselineThreatIntelligenceEnforced [-ProgressAction ] [] +``` + +## DESCRIPTION + +The baseline security profile (priority 65000) applies to all Internet Access traffic with no +Conditional Access required. +Linking an enabled threat-intelligence policy to the baseline +provides an always-on malware and phishing floor that also covers non-client / remote-network +traffic, the Conditional Access token-propagation gap, and users not matched by any user-aware +profile. +Microsoft recommends linking the threat-intelligence policy to the baseline. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaBaselineThreatIntelligenceEnforced +``` + +Returns $true if the baseline security profile has an enabled threat-intelligence policy linked. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced](https://maester.dev/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced) diff --git a/website/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded.mdx b/website/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded.mdx new file mode 100644 index 000000000..82cdfda51 --- /dev/null +++ b/website/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded.mdx @@ -0,0 +1,75 @@ +--- +sidebar_class_name: hidden +description: "Checks that every Compliant Network Conditional Access policy excludes the emergency access (break-glass) accounts." +id: Test-MtGsaCompliantNetworkBreakGlassExcluded +title: Test-MtGsaCompliantNetworkBreakGlassExcluded +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaCompliantNetworkBreakGlassExcluded.ps1 +--- + +## SYNOPSIS + +Checks that every Compliant Network Conditional Access policy excludes the emergency access (break-glass) accounts. + +## SYNTAX + +```powershell +Test-MtGsaCompliantNetworkBreakGlassExcluded [-ProgressAction ] [] +``` + +## DESCRIPTION + +A Conditional Access policy that enforces the Global Secure Access Compliant Network control +blocks access when the session is not on a compliant network. +If such a policy does not exclude +the emergency access (break-glass) accounts, it can lock out the very accounts needed to recover +the tenant. +This check verifies that every enabled Compliant Network enforcement policy excludes +all configured break-glass accounts and groups. + +Emergency access accounts are read from the EmergencyAccessAccounts setting in maester-config.json. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaCompliantNetworkBreakGlassExcluded +``` + +Returns $true if every Compliant Network enforcement policy excludes the break-glass accounts. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded](https://maester.dev/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded) diff --git a/website/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested.mdx b/website/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested.mdx new file mode 100644 index 000000000..e2d0968f9 --- /dev/null +++ b/website/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested.mdx @@ -0,0 +1,76 @@ +--- +sidebar_class_name: hidden +description: "Checks if groups assigned to Global Secure Access traffic forwarding profiles use direct membership (no nested groups)." +id: Test-MtGsaForwardingProfileAssignmentNotNested +title: Test-MtGsaForwardingProfileAssignmentNotNested +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaForwardingProfileAssignmentNotNested.ps1 +--- + +## SYNOPSIS + +Checks if groups assigned to Global Secure Access traffic forwarding profiles use direct membership (no nested groups). + +## SYNTAX + +```powershell +Test-MtGsaForwardingProfileAssignmentNotNested [-ProgressAction ] [] +``` + +## DESCRIPTION + +Global Secure Access traffic forwarding profiles (Microsoft 365, Internet, and Private Access) +can be scoped to specific users and groups. +Microsoft does not support nested group membership +for this assignment - a user must be a DIRECT member of the assigned group to receive the +profile (and therefore the Global Secure Access client routing). +A nested assignment group +silently leaves part of the intended population without the profile. + +Traffic forwarding profiles are represented by service principals whose display name ends with +'trafficforwardingprofile'; their user and group assignments are exposed as app role assignments. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaForwardingProfileAssignmentNotNested +``` + +Returns $true if no group assigned to a traffic forwarding profile contains a nested group. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested](https://maester.dev/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested) diff --git a/website/docs/commands/Test-MtGsaM365ProfileEnabled.mdx b/website/docs/commands/Test-MtGsaM365ProfileEnabled.mdx new file mode 100644 index 000000000..18b136be8 --- /dev/null +++ b/website/docs/commands/Test-MtGsaM365ProfileEnabled.mdx @@ -0,0 +1,75 @@ +--- +sidebar_class_name: hidden +description: "Checks if the Microsoft 365 traffic forwarding profile in Global Secure Access is enabled." +id: Test-MtGsaM365ProfileEnabled +title: Test-MtGsaM365ProfileEnabled +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaM365ProfileEnabled.ps1 +--- + +## SYNOPSIS + +Checks if the Microsoft 365 traffic forwarding profile in Global Secure Access is enabled. + +## SYNTAX + +```powershell +Test-MtGsaM365ProfileEnabled [-ProgressAction ] [] +``` + +## DESCRIPTION + +The Microsoft 365 traffic forwarding profile routes Microsoft 365 traffic (Exchange Online, +SharePoint Online, Teams) through Global Secure Access. +Enabling it is the lowest-risk entry +point to Global Secure Access and unlocks source IP restoration, the Compliant Network signal +in Conditional Access (token replay protection), Universal Tenant Restrictions, and network +access traffic logging. + +Learn more: +https://learn.microsoft.com/entra/global-secure-access/concept-traffic-forwarding + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaM365ProfileEnabled +``` + +Returns $true if the Microsoft 365 traffic forwarding profile exists and is enabled. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaM365ProfileEnabled](https://maester.dev/docs/commands/Test-MtGsaM365ProfileEnabled) diff --git a/website/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested.mdx b/website/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested.mdx new file mode 100644 index 000000000..833e5cee4 --- /dev/null +++ b/website/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested.mdx @@ -0,0 +1,76 @@ +--- +sidebar_class_name: hidden +description: "Checks if groups assigned to Entra Private Access (and Quick Access) applications use direct membership (no nested groups)." +id: Test-MtGsaPrivateAccessAppAssignmentNotNested +title: Test-MtGsaPrivateAccessAppAssignmentNotNested +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaPrivateAccessAppAssignmentNotNested.ps1 +--- + +## SYNOPSIS + +Checks if groups assigned to Entra Private Access (and Quick Access) applications use direct membership (no nested groups). + +## SYNTAX + +```powershell +Test-MtGsaPrivateAccessAppAssignmentNotNested [-ProgressAction ] [] +``` + +## DESCRIPTION + +Microsoft Entra enterprise application assignment grants access to the direct (and dynamic) +members of an assigned group only - the assignment does not cascade to nested groups, and +nested group membership is not supported for app assignment. +Groups assigned to Global Secure +Access Private Access applications (and the Quick Access app) must therefore use direct +membership, otherwise members of a nested group are silently left without access. + +Note: this only applies to app assignment (appRoleAssignedTo). +Conditional Access scoping does +honor nested groups, so the MFA and managed-device coverage checks are not affected. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaPrivateAccessAppAssignmentNotNested +``` + +Returns $true if no group assigned to a Private Access or Quick Access application contains a nested group. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested](https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested) diff --git a/website/docs/commands/Test-MtGsaPrivateAccessAppCompliantDevice.mdx b/website/docs/commands/Test-MtGsaPrivateAccessAppCompliantDevice.mdx new file mode 100644 index 000000000..050f50ba3 --- /dev/null +++ b/website/docs/commands/Test-MtGsaPrivateAccessAppCompliantDevice.mdx @@ -0,0 +1,76 @@ +--- +sidebar_class_name: hidden +description: "Checks if all Entra Private Access applications are covered by a Conditional Access policy that requires a managed device." +id: Test-MtGsaPrivateAccessAppCompliantDevice +title: Test-MtGsaPrivateAccessAppCompliantDevice +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaPrivateAccessAppCompliantDevice.ps1 +--- + +## SYNOPSIS + +Checks if all Entra Private Access applications are covered by a Conditional Access policy that requires a managed device. + +## SYNTAX + +```powershell +Test-MtGsaPrivateAccessAppCompliantDevice [-ProgressAction ] [] +``` + +## DESCRIPTION + +Every Entra Private Access (and Quick Access) application should be protected by an enabled +Conditional Access policy that requires a managed device - either by targeting the +application directly or via All cloud apps. +A policy satisfies the requirement when it grants +'compliantDevice' (Intune compliant) or 'domainJoinedDevice' (Microsoft Entra hybrid joined), +ensuring private apps are only reachable from managed endpoints. + +Note: this check evaluates application coverage only. +It does not evaluate whether the policy +applies to every user of the app (a policy could be scoped to a subset of users). + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaPrivateAccessAppCompliantDevice +``` + +Returns $true if every Entra Private Access application is covered by a managed-device policy. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppCompliantDevice](https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppCompliantDevice) diff --git a/website/docs/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.mdx b/website/docs/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.mdx new file mode 100644 index 000000000..fe1be02df --- /dev/null +++ b/website/docs/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.mdx @@ -0,0 +1,72 @@ +--- +sidebar_class_name: hidden +description: "Checks that no Entra Private Access application is served by the Default connector group." +id: Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup +title: Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.ps1 +--- + +## SYNOPSIS + +Checks that no Entra Private Access application is served by the Default connector group. + +## SYNTAX + +```powershell +Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup [-ProgressAction ] [] +``` + +## DESCRIPTION + +Newly installed Microsoft Entra private network connectors automatically join the Default +connector group. +If an application is served by the Default group, a freshly installed or +misconfigured connector immediately begins handling its traffic - a routing and outage risk. +The Default group should stay an idle / onboarding pool, and every Private Access application +should be served through a dedicated connector group. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup +``` + +Returns $true if no Entra Private Access application is assigned to the Default connector group. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup](https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup) diff --git a/website/docs/commands/Test-MtGsaPrivateAccessAppSegmentHygiene.mdx b/website/docs/commands/Test-MtGsaPrivateAccessAppSegmentHygiene.mdx new file mode 100644 index 000000000..f99d2edc8 --- /dev/null +++ b/website/docs/commands/Test-MtGsaPrivateAccessAppSegmentHygiene.mdx @@ -0,0 +1,107 @@ +--- +sidebar_class_name: hidden +description: "Checks that no Entra Private Access application segment uses a broad or risky destination." +id: Test-MtGsaPrivateAccessAppSegmentHygiene +title: Test-MtGsaPrivateAccessAppSegmentHygiene +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaPrivateAccessAppSegmentHygiene.ps1 +--- + +## SYNOPSIS + +Checks that no Entra Private Access application segment uses a broad or risky destination. + +## SYNTAX + +```powershell +Test-MtGsaPrivateAccessAppSegmentHygiene [[-BroadIPv4MaskThreshold] ] + [-ProgressAction ] [] +``` + +## DESCRIPTION + +Reviews the application segments of Entra Private Access (and Quick Access) applications and +flags destinations that break least-privilege or carry operational risk: + +- destinationType 'dnsSuffix' that is a bare top-level domain (single label, e.g. +'com' / 'net' / + 'local') - a TLD-wide catch-all. +A normal scoped suffix (e.g. +'contoso.com') is the recommended + resolution path and is not flagged. +- Wildcard FQDN (destinationHost contains '*'). +- Single-label FQDN (destinationType 'fqdn' with no dot, e.g. +'fileserver') - relies on the + synthetic Global Secure Access suffix and carries a Kerberos SPN risk. +- servicePrincipalName segments (Kerberos SPNs such as 'HTTP/*') are a legitimate construct and + are not evaluated. +- Broad IP ranges (near-default routes) - the portal's broadest selectable mask is /1, so an + exact 0.0.0.0/0 rarely appears; segments broader than /16 are flagged instead, so a /16 - + common for 10.x networks - still passes. +(Global Secure Access is IPv4-only, so IPv6 segments + are not evaluated.) Finer least-privilege CIDR sweeps (e.g. +< /24) are intentionally left to + the overlapping ZTA segment check this will be merged with. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaPrivateAccessAppSegmentHygiene +``` + +Returns $true if no application segment uses a broad or risky destination. + +## PARAMETERS + +### -BroadIPv4MaskThreshold + +A CIDR segment whose prefix length is *below* this value (broader than /16) is flagged as a broad / near-default route. +A /16 - common for 10.x networks - and narrower pass. +(GSA is IPv4-only, so IPv6 segments are not evaluated.) + +```yaml +Type: Int32 +Parameter Sets: (All) +Aliases: + +Required: False +Position: 1 +Default value: 16 +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppSegmentHygiene](https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppSegmentHygiene) diff --git a/website/docs/commands/Test-MtGsaQuickAccessNoSignInFrequency.mdx b/website/docs/commands/Test-MtGsaQuickAccessNoSignInFrequency.mdx new file mode 100644 index 000000000..6797deded --- /dev/null +++ b/website/docs/commands/Test-MtGsaQuickAccessNoSignInFrequency.mdx @@ -0,0 +1,111 @@ +--- +sidebar_class_name: hidden +description: "Checks that no Conditional Access sign-in frequency control applies to the Global Secure Access Quick Access app." +id: Test-MtGsaQuickAccessNoSignInFrequency +title: Test-MtGsaQuickAccessNoSignInFrequency +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaQuickAccessNoSignInFrequency.ps1 +--- + +## SYNOPSIS + +Checks that no Conditional Access sign-in frequency control applies to the Global Secure Access Quick Access app. + +## SYNTAX + +```powershell +Test-MtGsaQuickAccessNoSignInFrequency [[-AllowedPolicies] ] [-ProgressAction ] + [] +``` + +## DESCRIPTION + +When Private DNS is hosted on the Quick Access application, the Global Secure Access client's DNS +queries authenticate against the Quick Access app and are evaluated by Conditional Access. +A +sign-in frequency session control then re-triggers on those frequent DNS lookups, causing +unexpected and repeated authentication prompts. +Microsoft therefore recommends not applying a +sign-in frequency control to Quick Access. + +This is an operational / user-experience hygiene check, not a security gap. +An enabled sign-in +frequency policy that targets Quick Access is reported as Fail, except when it falls into a +category that does not drive routine DNS prompts, which is surfaced for Review instead: + +- Role-only : scoped only to directory roles (e.g. +admins), who typically do not use Private Access. +- Guest : scoped to guest / external users, who very rarely use Private Access. +- Risk-gated : has a user- or sign-in-risk condition, so the control only applies under elevated risk. +- Browser : limited to the 'browser' client app type; Private Access traffic is not browser-based. + +Reviewed, accepted exceptions can be allow-listed by policy id or display name via the +'GsaQuickAccessSignInFrequencyAllowedPolicies' global setting (maester-config.json); those are +reported as Accepted and never fail. + +Remediation for a Fail is to exclude the Quick Access app from the sign-in frequency policy - not +to remove the control organization-wide. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaQuickAccessNoSignInFrequency +``` + +Returns $true if no sign-in frequency policy applies to Quick Access outside the allowed categories. + +## PARAMETERS + +### -AllowedPolicies + +Conditional Access policies (by id or displayName) that are reviewed, accepted exceptions and +should never fail this check. +Defaults to the 'GsaQuickAccessSignInFrequencyAllowedPolicies' +GlobalSetting in maester-config.json. + +```yaml +Type: String[] +Parameter Sets: (All) +Aliases: + +Required: False +Position: 1 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaQuickAccessNoSignInFrequency](https://maester.dev/docs/commands/Test-MtGsaQuickAccessNoSignInFrequency) diff --git a/website/docs/commands/docusaurus.sidebar.js b/website/docs/commands/docusaurus.sidebar.js index a466a1dab..8cbf03c3a 100644 --- a/website/docs/commands/docusaurus.sidebar.js +++ b/website/docs/commands/docusaurus.sidebar.js @@ -635,6 +635,15 @@ module.exports = [ 'commands/Test-MtExoSetScl', 'commands/Test-MtFeatureUpdatePolicy', 'commands/Test-MtGroupCreationRestricted', + 'commands/Test-MtGsaBaselineThreatIntelligenceEnforced', + 'commands/Test-MtGsaCompliantNetworkBreakGlassExcluded', + 'commands/Test-MtGsaForwardingProfileAssignmentNotNested', + 'commands/Test-MtGsaM365ProfileEnabled', + 'commands/Test-MtGsaPrivateAccessAppAssignmentNotNested', + 'commands/Test-MtGsaPrivateAccessAppCompliantDevice', + 'commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup', + 'commands/Test-MtGsaPrivateAccessAppSegmentHygiene', + 'commands/Test-MtGsaQuickAccessNoSignInFrequency', 'commands/Test-MtHighPrivilegeServicePrincipalsForAllUsers', 'commands/Test-MtHighRiskAppPermissions', 'commands/Test-MtIntuneAppControl', diff --git a/website/versioned_docs/version-2.1.0/commands/Test-MtGsaBaselineThreatIntelligenceEnforced.mdx b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaBaselineThreatIntelligenceEnforced.mdx new file mode 100644 index 000000000..16bb5655b --- /dev/null +++ b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaBaselineThreatIntelligenceEnforced.mdx @@ -0,0 +1,73 @@ +--- +sidebar_class_name: hidden +description: "Checks that the baseline Global Secure Access security profile enforces a threat-intelligence floor." +id: Test-MtGsaBaselineThreatIntelligenceEnforced +title: Test-MtGsaBaselineThreatIntelligenceEnforced +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaBaselineThreatIntelligenceEnforced.ps1 +--- + +## SYNOPSIS + +Checks that the baseline Global Secure Access security profile enforces a threat-intelligence floor. + +## SYNTAX + +```powershell +Test-MtGsaBaselineThreatIntelligenceEnforced [-ProgressAction ] [] +``` + +## DESCRIPTION + +The baseline security profile (priority 65000) applies to all Internet Access traffic with no +Conditional Access required. +Linking an enabled threat-intelligence policy to the baseline +provides an always-on malware and phishing floor that also covers non-client / remote-network +traffic, the Conditional Access token-propagation gap, and users not matched by any user-aware +profile. +Microsoft recommends linking the threat-intelligence policy to the baseline. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaBaselineThreatIntelligenceEnforced +``` + +Returns $true if the baseline security profile has an enabled threat-intelligence policy linked. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced](https://maester.dev/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced) diff --git a/website/versioned_docs/version-2.1.0/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded.mdx b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded.mdx new file mode 100644 index 000000000..82cdfda51 --- /dev/null +++ b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded.mdx @@ -0,0 +1,75 @@ +--- +sidebar_class_name: hidden +description: "Checks that every Compliant Network Conditional Access policy excludes the emergency access (break-glass) accounts." +id: Test-MtGsaCompliantNetworkBreakGlassExcluded +title: Test-MtGsaCompliantNetworkBreakGlassExcluded +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaCompliantNetworkBreakGlassExcluded.ps1 +--- + +## SYNOPSIS + +Checks that every Compliant Network Conditional Access policy excludes the emergency access (break-glass) accounts. + +## SYNTAX + +```powershell +Test-MtGsaCompliantNetworkBreakGlassExcluded [-ProgressAction ] [] +``` + +## DESCRIPTION + +A Conditional Access policy that enforces the Global Secure Access Compliant Network control +blocks access when the session is not on a compliant network. +If such a policy does not exclude +the emergency access (break-glass) accounts, it can lock out the very accounts needed to recover +the tenant. +This check verifies that every enabled Compliant Network enforcement policy excludes +all configured break-glass accounts and groups. + +Emergency access accounts are read from the EmergencyAccessAccounts setting in maester-config.json. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaCompliantNetworkBreakGlassExcluded +``` + +Returns $true if every Compliant Network enforcement policy excludes the break-glass accounts. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded](https://maester.dev/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded) diff --git a/website/versioned_docs/version-2.1.0/commands/Test-MtGsaForwardingProfileAssignmentNotNested.mdx b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaForwardingProfileAssignmentNotNested.mdx new file mode 100644 index 000000000..e2d0968f9 --- /dev/null +++ b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaForwardingProfileAssignmentNotNested.mdx @@ -0,0 +1,76 @@ +--- +sidebar_class_name: hidden +description: "Checks if groups assigned to Global Secure Access traffic forwarding profiles use direct membership (no nested groups)." +id: Test-MtGsaForwardingProfileAssignmentNotNested +title: Test-MtGsaForwardingProfileAssignmentNotNested +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaForwardingProfileAssignmentNotNested.ps1 +--- + +## SYNOPSIS + +Checks if groups assigned to Global Secure Access traffic forwarding profiles use direct membership (no nested groups). + +## SYNTAX + +```powershell +Test-MtGsaForwardingProfileAssignmentNotNested [-ProgressAction ] [] +``` + +## DESCRIPTION + +Global Secure Access traffic forwarding profiles (Microsoft 365, Internet, and Private Access) +can be scoped to specific users and groups. +Microsoft does not support nested group membership +for this assignment - a user must be a DIRECT member of the assigned group to receive the +profile (and therefore the Global Secure Access client routing). +A nested assignment group +silently leaves part of the intended population without the profile. + +Traffic forwarding profiles are represented by service principals whose display name ends with +'trafficforwardingprofile'; their user and group assignments are exposed as app role assignments. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaForwardingProfileAssignmentNotNested +``` + +Returns $true if no group assigned to a traffic forwarding profile contains a nested group. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested](https://maester.dev/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested) diff --git a/website/versioned_docs/version-2.1.0/commands/Test-MtGsaM365ProfileEnabled.mdx b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaM365ProfileEnabled.mdx new file mode 100644 index 000000000..18b136be8 --- /dev/null +++ b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaM365ProfileEnabled.mdx @@ -0,0 +1,75 @@ +--- +sidebar_class_name: hidden +description: "Checks if the Microsoft 365 traffic forwarding profile in Global Secure Access is enabled." +id: Test-MtGsaM365ProfileEnabled +title: Test-MtGsaM365ProfileEnabled +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaM365ProfileEnabled.ps1 +--- + +## SYNOPSIS + +Checks if the Microsoft 365 traffic forwarding profile in Global Secure Access is enabled. + +## SYNTAX + +```powershell +Test-MtGsaM365ProfileEnabled [-ProgressAction ] [] +``` + +## DESCRIPTION + +The Microsoft 365 traffic forwarding profile routes Microsoft 365 traffic (Exchange Online, +SharePoint Online, Teams) through Global Secure Access. +Enabling it is the lowest-risk entry +point to Global Secure Access and unlocks source IP restoration, the Compliant Network signal +in Conditional Access (token replay protection), Universal Tenant Restrictions, and network +access traffic logging. + +Learn more: +https://learn.microsoft.com/entra/global-secure-access/concept-traffic-forwarding + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaM365ProfileEnabled +``` + +Returns $true if the Microsoft 365 traffic forwarding profile exists and is enabled. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaM365ProfileEnabled](https://maester.dev/docs/commands/Test-MtGsaM365ProfileEnabled) diff --git a/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested.mdx b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested.mdx new file mode 100644 index 000000000..833e5cee4 --- /dev/null +++ b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested.mdx @@ -0,0 +1,76 @@ +--- +sidebar_class_name: hidden +description: "Checks if groups assigned to Entra Private Access (and Quick Access) applications use direct membership (no nested groups)." +id: Test-MtGsaPrivateAccessAppAssignmentNotNested +title: Test-MtGsaPrivateAccessAppAssignmentNotNested +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaPrivateAccessAppAssignmentNotNested.ps1 +--- + +## SYNOPSIS + +Checks if groups assigned to Entra Private Access (and Quick Access) applications use direct membership (no nested groups). + +## SYNTAX + +```powershell +Test-MtGsaPrivateAccessAppAssignmentNotNested [-ProgressAction ] [] +``` + +## DESCRIPTION + +Microsoft Entra enterprise application assignment grants access to the direct (and dynamic) +members of an assigned group only - the assignment does not cascade to nested groups, and +nested group membership is not supported for app assignment. +Groups assigned to Global Secure +Access Private Access applications (and the Quick Access app) must therefore use direct +membership, otherwise members of a nested group are silently left without access. + +Note: this only applies to app assignment (appRoleAssignedTo). +Conditional Access scoping does +honor nested groups, so the MFA and managed-device coverage checks are not affected. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaPrivateAccessAppAssignmentNotNested +``` + +Returns $true if no group assigned to a Private Access or Quick Access application contains a nested group. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested](https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested) diff --git a/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppCompliantDevice.mdx b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppCompliantDevice.mdx new file mode 100644 index 000000000..050f50ba3 --- /dev/null +++ b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppCompliantDevice.mdx @@ -0,0 +1,76 @@ +--- +sidebar_class_name: hidden +description: "Checks if all Entra Private Access applications are covered by a Conditional Access policy that requires a managed device." +id: Test-MtGsaPrivateAccessAppCompliantDevice +title: Test-MtGsaPrivateAccessAppCompliantDevice +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaPrivateAccessAppCompliantDevice.ps1 +--- + +## SYNOPSIS + +Checks if all Entra Private Access applications are covered by a Conditional Access policy that requires a managed device. + +## SYNTAX + +```powershell +Test-MtGsaPrivateAccessAppCompliantDevice [-ProgressAction ] [] +``` + +## DESCRIPTION + +Every Entra Private Access (and Quick Access) application should be protected by an enabled +Conditional Access policy that requires a managed device - either by targeting the +application directly or via All cloud apps. +A policy satisfies the requirement when it grants +'compliantDevice' (Intune compliant) or 'domainJoinedDevice' (Microsoft Entra hybrid joined), +ensuring private apps are only reachable from managed endpoints. + +Note: this check evaluates application coverage only. +It does not evaluate whether the policy +applies to every user of the app (a policy could be scoped to a subset of users). + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaPrivateAccessAppCompliantDevice +``` + +Returns $true if every Entra Private Access application is covered by a managed-device policy. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppCompliantDevice](https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppCompliantDevice) diff --git a/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.mdx b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.mdx new file mode 100644 index 000000000..fe1be02df --- /dev/null +++ b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.mdx @@ -0,0 +1,72 @@ +--- +sidebar_class_name: hidden +description: "Checks that no Entra Private Access application is served by the Default connector group." +id: Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup +title: Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.ps1 +--- + +## SYNOPSIS + +Checks that no Entra Private Access application is served by the Default connector group. + +## SYNTAX + +```powershell +Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup [-ProgressAction ] [] +``` + +## DESCRIPTION + +Newly installed Microsoft Entra private network connectors automatically join the Default +connector group. +If an application is served by the Default group, a freshly installed or +misconfigured connector immediately begins handling its traffic - a routing and outage risk. +The Default group should stay an idle / onboarding pool, and every Private Access application +should be served through a dedicated connector group. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup +``` + +Returns $true if no Entra Private Access application is assigned to the Default connector group. + +## PARAMETERS + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup](https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup) diff --git a/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppSegmentHygiene.mdx b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppSegmentHygiene.mdx new file mode 100644 index 000000000..f99d2edc8 --- /dev/null +++ b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaPrivateAccessAppSegmentHygiene.mdx @@ -0,0 +1,107 @@ +--- +sidebar_class_name: hidden +description: "Checks that no Entra Private Access application segment uses a broad or risky destination." +id: Test-MtGsaPrivateAccessAppSegmentHygiene +title: Test-MtGsaPrivateAccessAppSegmentHygiene +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaPrivateAccessAppSegmentHygiene.ps1 +--- + +## SYNOPSIS + +Checks that no Entra Private Access application segment uses a broad or risky destination. + +## SYNTAX + +```powershell +Test-MtGsaPrivateAccessAppSegmentHygiene [[-BroadIPv4MaskThreshold] ] + [-ProgressAction ] [] +``` + +## DESCRIPTION + +Reviews the application segments of Entra Private Access (and Quick Access) applications and +flags destinations that break least-privilege or carry operational risk: + +- destinationType 'dnsSuffix' that is a bare top-level domain (single label, e.g. +'com' / 'net' / + 'local') - a TLD-wide catch-all. +A normal scoped suffix (e.g. +'contoso.com') is the recommended + resolution path and is not flagged. +- Wildcard FQDN (destinationHost contains '*'). +- Single-label FQDN (destinationType 'fqdn' with no dot, e.g. +'fileserver') - relies on the + synthetic Global Secure Access suffix and carries a Kerberos SPN risk. +- servicePrincipalName segments (Kerberos SPNs such as 'HTTP/*') are a legitimate construct and + are not evaluated. +- Broad IP ranges (near-default routes) - the portal's broadest selectable mask is /1, so an + exact 0.0.0.0/0 rarely appears; segments broader than /16 are flagged instead, so a /16 - + common for 10.x networks - still passes. +(Global Secure Access is IPv4-only, so IPv6 segments + are not evaluated.) Finer least-privilege CIDR sweeps (e.g. +< /24) are intentionally left to + the overlapping ZTA segment check this will be merged with. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaPrivateAccessAppSegmentHygiene +``` + +Returns $true if no application segment uses a broad or risky destination. + +## PARAMETERS + +### -BroadIPv4MaskThreshold + +A CIDR segment whose prefix length is *below* this value (broader than /16) is flagged as a broad / near-default route. +A /16 - common for 10.x networks - and narrower pass. +(GSA is IPv4-only, so IPv6 segments are not evaluated.) + +```yaml +Type: Int32 +Parameter Sets: (All) +Aliases: + +Required: False +Position: 1 +Default value: 16 +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppSegmentHygiene](https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppSegmentHygiene) diff --git a/website/versioned_docs/version-2.1.0/commands/Test-MtGsaQuickAccessNoSignInFrequency.mdx b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaQuickAccessNoSignInFrequency.mdx new file mode 100644 index 000000000..6797deded --- /dev/null +++ b/website/versioned_docs/version-2.1.0/commands/Test-MtGsaQuickAccessNoSignInFrequency.mdx @@ -0,0 +1,111 @@ +--- +sidebar_class_name: hidden +description: "Checks that no Conditional Access sign-in frequency control applies to the Global Secure Access Quick Access app." +id: Test-MtGsaQuickAccessNoSignInFrequency +title: Test-MtGsaQuickAccessNoSignInFrequency +hide_title: false +hide_table_of_contents: false +custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaQuickAccessNoSignInFrequency.ps1 +--- + +## SYNOPSIS + +Checks that no Conditional Access sign-in frequency control applies to the Global Secure Access Quick Access app. + +## SYNTAX + +```powershell +Test-MtGsaQuickAccessNoSignInFrequency [[-AllowedPolicies] ] [-ProgressAction ] + [] +``` + +## DESCRIPTION + +When Private DNS is hosted on the Quick Access application, the Global Secure Access client's DNS +queries authenticate against the Quick Access app and are evaluated by Conditional Access. +A +sign-in frequency session control then re-triggers on those frequent DNS lookups, causing +unexpected and repeated authentication prompts. +Microsoft therefore recommends not applying a +sign-in frequency control to Quick Access. + +This is an operational / user-experience hygiene check, not a security gap. +An enabled sign-in +frequency policy that targets Quick Access is reported as Fail, except when it falls into a +category that does not drive routine DNS prompts, which is surfaced for Review instead: + +- Role-only : scoped only to directory roles (e.g. +admins), who typically do not use Private Access. +- Guest : scoped to guest / external users, who very rarely use Private Access. +- Risk-gated : has a user- or sign-in-risk condition, so the control only applies under elevated risk. +- Browser : limited to the 'browser' client app type; Private Access traffic is not browser-based. + +Reviewed, accepted exceptions can be allow-listed by policy id or display name via the +'GsaQuickAccessSignInFrequencyAllowedPolicies' global setting (maester-config.json); those are +reported as Accepted and never fail. + +Remediation for a Fail is to exclude the Quick Access app from the sign-in frequency policy - not +to remove the control organization-wide. + +## EXAMPLES + +### EXAMPLE 1 + +```powershell +Test-MtGsaQuickAccessNoSignInFrequency +``` + +Returns $true if no sign-in frequency policy applies to Quick Access outside the allowed categories. + +## PARAMETERS + +### -AllowedPolicies + +Conditional Access policies (by id or displayName) that are reviewed, accepted exceptions and +should never fail this check. +Defaults to the 'GsaQuickAccessSignInFrequencyAllowedPolicies' +GlobalSetting in maester-config.json. + +```yaml +Type: String[] +Parameter Sets: (All) +Aliases: + +Required: False +Position: 1 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ProgressAction + +Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress. + +```yaml +Type: ActionPreference +Parameter Sets: (All) +Aliases: proga + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +### System.Boolean + +## NOTES + +## RELATED LINKS + +[https://maester.dev/docs/commands/Test-MtGsaQuickAccessNoSignInFrequency](https://maester.dev/docs/commands/Test-MtGsaQuickAccessNoSignInFrequency)