Microsoft 365 et Conformité - Guide Pratique Cybersecurite

# Configuration initiale Microsoft Purview

function Initialize-PurviewGovernance {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$TenantId,

        [Parameter(Mandatory)]
        [string]$SubscriptionId,

        [string]$ResourceGroupName = "rg-purview-governance",
        [string]$PurviewAccountName = "purview-$((Get-Random).ToString().Substring(0,6))",
        [string]$Location = "West Europe"
    )

    # Connexion aux services requis
    Connect-AzAccount
    Connect-MgGraph -Scopes "Directory.Read.All", "Policy.ReadWrite.ConditionalAccess"

    Write-Host "🚀 Initialisation Microsoft Purview..." -ForegroundColor Cyan

    # Création du compte Purview
    $purviewAccount = @{
        accountName = $PurviewAccountName
        location = $Location
        properties = @{
            publicNetworkAccess = "Enabled"
            managedResourceGroupName = "$ResourceGroupName-managed"
        }
        identity = @{
            type = "SystemAssigned"
        }
    }

    try {
        # Création du resource group
        $rg = New-AzResourceGroup -Name $ResourceGroupName -Location $Location -Force
        Write-Host "✅ Resource Group créé: $($rg.ResourceGroupName)" -ForegroundColor Green

        # Déploiement du compte Purview
        $deployment = New-AzResourceGroupDeployment -ResourceGroupName $ResourceGroupName -TemplateParameterObject $purviewAccount

        Write-Host "✅ Compte Purview déployé: $PurviewAccountName" -ForegroundColor Green

        # Configuration des rôles et permissions
        $purviewPrincipalId = (Get-AzResource -Name $PurviewAccountName -ResourceType "Microsoft.Purview/accounts").Identity.PrincipalId

        # Attribution des rôles requis
        $roleAssignments = @(
            @{ Role = "Storage Blob Data Reader"; Scope = "/subscriptions/$SubscriptionId" },
            @{ Role = "Reader"; Scope = "/subscriptions/$SubscriptionId" },
            @{ Role = "Purview Data Reader"; Scope = "/subscriptions/$SubscriptionId" }
        )

        foreach ($assignment in $roleAssignments) {
            try {
                New-AzRoleAssignment -ObjectId $purviewPrincipalId -RoleDefinitionName $assignment.Role -Scope $assignment.Scope -ErrorAction SilentlyContinue
                Write-Host "✅ Rôle attribué: $($assignment.Role)" -ForegroundColor Green
            } catch {
                Write-Warning "⚠️ Erreur attribution rôle $($assignment.Role): $($_.Exception.Message)"
            }
        }

        # Configuration des data sources Microsoft 365
        $dataSources = @(
            @{
                Name = "M365-Exchange"
                Type = "AzureExchangeOnline"
                Description = "Exchange Online mailboxes and content"
            },
            @{
                Name = "M365-SharePoint"
                Type = "AzureSharePointOnline"
                Description = "SharePoint sites and OneDrive content"
            },
            @{
                Name = "M365-Teams"
                Type = "AzureTeams"
                Description = "Teams conversations and files"
            }
        )

        foreach ($source in $dataSources) {
            Write-Host "📊 Configuration data source: $($source.Name)" -ForegroundColor Yellow
            # Configuration via API Purview (nécessite SDK Purview)
        }

        # Configuration des policies de base
        $basePolicies = @{
            "PII-Detection" = @{
                Description = "Automatic detection of PII data"
                Rules = @("Email", "Phone", "SSN", "CreditCard")
                Actions = @("Classify", "Alert", "Audit")
            }
            "Financial-Data" = @{
                Description = "Financial data protection"
                Rules = @("BankAccount", "IBAN", "SWIFT")
                Actions = @("Classify", "Encrypt", "Restrict")
            }
            "Health-Data" = @{
                Description = "Healthcare data compliance"
                Rules = @("MedicalRecord", "Prescription", "Diagnosis")
                Actions = @("Classify", "Audit", "Restrict")
            }
        }

        $results = @{
            PurviewAccountName = $PurviewAccountName
            ResourceGroup = $ResourceGroupName
            Location = $Location
            PrincipalId = $purviewPrincipalId
            DataSources = $dataSources.Count
            Policies = $basePolicies.Count
            Status = "Deployed Successfully"
            NextSteps = @(
                "Configure data source scans",
                "Set up classification rules",
                "Enable automated labeling",
                "Create compliance dashboards"
            )
        }

        return $results

    } catch {
        Write-Error "❌ Erreur lors du déploiement Purview: $($_.Exception.Message)"
        throw
    }
}

# Configuration des sensitivity labels avec PowerShell

function Deploy-SensitivityLabels {
    [CmdletBinding()]
    param(
        [switch]$EnableAutoLabeling,
        [switch]$ConfigureProtection,
        [string[]]$Scopes = @("File", "Email", "Site", "UnifiedGroup")
    )

    # Connexion au Security & Compliance Center
    Connect-IPPSSession -UserPrincipalName $env:USERNAME

    # Configuration des labels de base
    $labels = @(
        @{
            Name = "Public"
            DisplayName = "Public"
            Description = "Information publique sans restriction"
            Color = "Green"
            Priority = 0
            Settings = @{
                ContentType = @("File", "Email", "Site")
                Protection = $null
                Marking = @{
                    WaterMarkText = "PUBLIC"
                    HeaderText = "Classification: Public"
                }
            }
        },
        @{
            Name = "Internal"
            DisplayName = "Usage Interne"
            Description = "Information interne à l'organisation"
            Color = "Yellow"
            Priority = 1
            Settings = @{
                ContentType = @("File", "Email", "Site", "UnifiedGroup")
                Protection = @{
                    Type = "UserDefined"
                    UserRights = @("domain.com=View,Edit,Save,Export,Reply")
                }
                Marking = @{
                    WaterMarkText = "USAGE INTERNE"
                    HeaderText = "Classification: Usage Interne"
                    FooterText = "Propriété de [Organization] - Diffusion interne uniquement"
                }
            }
        },
        @{
            Name = "Confidential"
            DisplayName = "Confidentiel"
            Description = "Information confidentielle nécessitant une protection renforcée"
            Color = "Red"
            Priority = 2
            Settings = @{
                ContentType = @("File", "Email", "Site", "UnifiedGroup")
                Protection = @{
                    Type = "Template"
                    TemplateId = "Encrypt-AuthenticatedUsers"
                    ContentExpirationDate = (Get-Date).AddYears(2)
                    OfflineAccessInterval = 7
                }
                Marking = @{
                    WaterMarkText = "CONFIDENTIEL"
                    HeaderText = "Classification: Confidentiel"
                    FooterText = "Propriété de [Organization] - Accès autorisé uniquement"
                }
                DLPSettings = @{
                    BlockExternalSharing = $true
                    RequireJustification = $true
                    AuditAccess = $true
                }
            }
        },
        @{
            Name = "HighlyConfidential"
            DisplayName = "Hautement Confidentiel"
            Description = "Information hautement sensible - Accès très restreint"
            Color = "Red"
            Priority = 3
            Settings = @{
                ContentType = @("File", "Email")
                Protection = @{
                    Type = "Custom"
                    Rights = @{
                        "executives@domain.com" = @("View", "Edit")
                        "legal@domain.com" = @("View")
                        "compliance@domain.com" = @("View", "Audit")
                    }
                    ContentExpirationDate = (Get-Date).AddMonths(6)
                    OfflineAccessInterval = 1
                    RequireAdditionalAuth = $true
                }
                Marking = @{
                    WaterMarkText = "HAUTEMENT CONFIDENTIEL"
                    HeaderText = "Classification: Hautement Confidentiel"
                    FooterText = "Accès restreint - Ne pas diffuser"
                }
                DLPSettings = @{
                    BlockExternalSharing = $true
                    BlockPrinting = $true
                    BlockCopyPaste = $true
                    RequireJustification = $true
                    ManagerApprovalRequired = $true
                }
            }
        }
    )

    $deployedLabels = @()

    foreach ($labelConfig in $labels) {
        try {
            Write-Host "📋 Création du label: $($labelConfig.DisplayName)" -ForegroundColor Cyan

            # Création du sensitivity label
            $labelParams = @{
                Name = $labelConfig.Name
                DisplayName = $labelConfig.DisplayName
                Comment = $labelConfig.Description
                AdvancedSettings = @{
                    Color = $labelConfig.Color
                    Priority = $labelConfig.Priority
                }
            }

            $newLabel = New-Label @labelParams

            # Configuration des protection settings si spécifiés
            if ($ConfigureProtection -and $labelConfig.Settings.Protection) {
                $protectionParams = @{
                    Identity = $newLabel.Guid
                }

                switch ($labelConfig.Settings.Protection.Type) {
                    "Template" {
                        $protectionParams.RightsManagementProtection = $labelConfig.Settings.Protection.TemplateId
                    }
                    "Custom" {
                        $protectionParams.UserRightsManagementSettings = $labelConfig.Settings.Protection.Rights | ConvertTo-Json
                    }
                    "UserDefined" {
                        $protectionParams.UserRightsManagementSettings = $labelConfig.Settings.Protection.UserRights -join ";"
                    }
                }

                Set-Label @protectionParams
            }

            # Configuration du visual marking
            if ($labelConfig.Settings.Marking) {
                $markingParams = @{
                    Identity = $newLabel.Guid
                }

                if ($labelConfig.Settings.Marking.WaterMarkText) {
                    $markingParams.ApplyWaterMarkText = $labelConfig.Settings.Marking.WaterMarkText
                    $markingParams.WaterMarkAlignment = "Center"
                    $markingParams.WaterMarkEnabled = $true
                }

                if ($labelConfig.Settings.Marking.HeaderText) {
                    $markingParams.ApplyContentMarkingHeaderText = $labelConfig.Settings.Marking.HeaderText
                    $markingParams.ContentMarkingHeaderEnabled = $true
                }

                if ($labelConfig.Settings.Marking.FooterText) {
                    $markingParams.ApplyContentMarkingFooterText = $labelConfig.Settings.Marking.FooterText
                    $markingParams.ContentMarkingFooterEnabled = $true
                }

                Set-Label @markingParams
            }

            # Publication du label
            $publishParams = @{
                Name = "Policy-$($labelConfig.Name)"
                Labels = $newLabel.Guid
                ExchangeLocation = "All"
                SharePointLocation = "All"
                OneDriveLocation = "All"
                TeamsLocation = "All"
            }

            New-LabelPolicy @publishParams

            $deployedLabels += [PSCustomObject]@{
                Name = $labelConfig.Name
                DisplayName = $labelConfig.DisplayName
                Guid = $newLabel.Guid
                Priority = $labelConfig.Priority
                Status = "Deployed"
                Scopes = $labelConfig.Settings.ContentType -join ", "
            }

            Write-Host "✅ Label déployé: $($labelConfig.DisplayName)" -ForegroundColor Green

        } catch {
            Write-Warning "⚠️ Erreur déploiement label $($labelConfig.Name): $($_.Exception.Message)"

            $deployedLabels += [PSCustomObject]@{
                Name = $labelConfig.Name
                DisplayName = $labelConfig.DisplayName
                Status = "Failed"
                Error = $_.Exception.Message
            }
        }
    }

    # Configuration de l'auto-labeling si demandé
    if ($EnableAutoLabeling) {
        Write-Host "🤖 Configuration de l'auto-labeling..." -ForegroundColor Yellow

        $autoLabelingRules = @{
            "PII-Detection" = @{
                Label = "Confidential"
                Conditions = @("EU Passport Number", "Credit Card Number", "Social Security Number")
                Confidence = 85
                Actions = @("ApplyLabel", "Notify", "Audit")
            }
            "Financial-Data" = @{
                Label = "HighlyConfidential"
                Conditions = @("Bank Account Number", "SWIFT Code", "Financial Report")
                Confidence = 90
                Actions = @("ApplyLabel", "Notify", "Block", "Audit")
            }
        }

        foreach ($rule in $autoLabelingRules.Keys) {
            $ruleConfig = $autoLabelingRules[$rule]

            try {
                New-AutoSensitivityLabelPolicy -Name $rule -ApplySensitivityLabel $ruleConfig.Label -ExchangeLocation All -SharePointLocation All -OneDriveLocation All -Mode Simulate

                Write-Host "✅ Règle auto-labeling créée: $rule" -ForegroundColor Green
            } catch {
                Write-Warning "⚠️ Erreur création règle $rule : $($_.Exception.Message)"
            }
        }
    }

    return $deployedLabels
}