Zero Trust M365 : Strategies de Detection et de Remediation

# PowerShell - Audit Zero Trust readiness
# Évaluation des identités
$AdminUsers = Get-MgDirectoryRole | ForEach-Object {
    Get-MgDirectoryRoleMember -DirectoryRoleId $_.Id
} | Where-Object {$_.'@odata.type' -eq '#microsoft.graph.user'}

# Analyse MFA
$MFAStatus = Get-MgUser -All | ForEach-Object {
    $MFAMethods = Get-MgUserAuthenticationMethod -UserId $_.Id
    [PSCustomObject]@{
        UserPrincipalName = $_.UserPrincipalName
        MFAEnabled = $MFAMethods.Count -gt 1
        MethodCount = $MFAMethods.Count
        LastSignIn = $_.SignInActivity.LastSignInDateTime
    }
}

# Score de préparation Zero Trust
$ZeroTrustScore = @{
    MFAAdoption = ($MFAStatus | Where-Object {$_.MFAEnabled}).Count / $MFAStatus.Count * 100
    AdminSecurity = "Requires detailed analysis"
    DeviceCompliance = "Assessment needed"
    ConditionalAccess = "Policy review required"
}

# Configuration Conditional Access Zero Trust
$ZeroTrustPolicy = @{
    displayName = "Zero Trust - Require compliant device and MFA"
    state = "enabled"
    conditions = @{
        users = @{
            includeUsers = @("All")
            excludeUsers = @("Break-Glass-Account-1", "Break-Glass-Account-2")
        }
        applications = @{
            includeApplications = @("All")
        }
        locations = @{
            excludeLocations = @("Named-Trusted-Locations")
        }
        platforms = @{
            includePlatforms = @("all")
        }
        deviceStates = @{
            includeStates = @("all")
        }
    }
    grantControls = @{
        operator = "AND"
        builtInControls = @("mfa", "compliantDevice")
        customAuthenticationFactors = @()
    }
    sessionControls = @{
        applicationEnforcedRestrictions = @{
            isEnabled = $true
        }
        signInFrequency = @{
            value = 4
            type = "hours"
            isEnabled = $true
        }
    }
}

# Configuration PIM pour accès admin Zero Trust
$PIMRoleSettings = @{
    roleDefinitionId = "Global Administrator Role ID"
    assignmentType = "Eligible"
    maximumDuration = "PT4H"  # 4 heures maximum
    requireJustification = $true
    requireMFA = $true
    requireApproval = $true
    approvers = @("Security-Team-Group-ID")
    activationRequirements = @{
        mfaRequired = $true
        justificationRequired = $true
        approvalRequired = $true
        additionalSecurityChecks = @("deviceCompliance", "riskAssessment")
    }
}

# PowerShell - Collecte métriques Zero Trust
function Get-ZeroTrustMetrics {
    # Métriques MFA
    $MFAMetrics = Get-MgReportAuthenticationMethodUserRegistrationDetail | Group-Object -Property IsMfaRegistered |
        Select-Object Name, Count, @{n='Percentage';e={[math]::Round($_.Count/($Total)*100,2)}}

    # Métriques Conditional Access
    $CAMetrics = Get-MgIdentityConditionalAccessPolicy | Group-Object -Property State |
        Select-Object Name, Count

    # Métriques device compliance
    $DeviceMetrics = Get-MgDeviceManagementManagedDevice | Group-Object -Property ComplianceState |
        Select-Object Name, Count

    # Métriques risque identité
    $RiskMetrics = Get-MgIdentityProtectionRiskyUser | Group-Object -Property RiskLevel |
        Select-Object Name, Count

    # Score Zero Trust composite
    $ZeroTrustScore = [PSCustomObject]@{
        MFAAdoption = ($MFAMetrics | Where-Object {$_.Name -eq $true}).Percentage
        CACompliance = ($CAMetrics | Where-Object {$_.Name -eq "enabled"}).Count / $CAMetrics.Count * 100
        DeviceCompliance = ($DeviceMetrics | Where-Object {$_.Name -eq "Compliant"}).Count / $DeviceMetrics.Count * 100
        IdentityRisk = 100 - (($RiskMetrics | Where-Object {$_.Name -in @("high","medium")}).Count / $RiskMetrics.Count * 100)
        OverallScore = 0
    }

    $ZeroTrustScore.OverallScore = ($ZeroTrustScore.MFAAdoption + $ZeroTrustScore.CACompliance +
                                   $ZeroTrustScore.DeviceCompliance + $ZeroTrustScore.IdentityRisk) / 4

    return $ZeroTrustScore
}