public/maester/entra/Test-MtCaApplicationEnforcedRestriction.ps1

<#
 .Synopsis
  Checks if the tenant has at least one conditional access policy is configured to enable application enforced restrictions

 .Description
    Application enforced restrictions conditional access policy can be helpful to minimize the risk of data leakage from a shared device.

  Learn more:
  https://aka.ms/CATemplatesAppRestrictions

 .Example
  Test-MtCaApplicationEnforcedRestriction

.LINK
    https://maester.dev/docs/commands/Test-MtCaApplicationEnforcedRestriction
#>

function Test-MtCaApplicationEnforcedRestriction {
    [CmdletBinding()]
    [OutputType([bool])]
    param ()

    if ( ( Get-MtLicenseInformation EntraID ) -eq 'Free' ) {
        Add-MtTestResultDetail -SkippedBecause NotLicensedEntraIDP1
        return $null
    }

    try {
        $policies = Get-MtConditionalAccessPolicy | Where-Object { $_.state -eq 'enabled' }

        $testDescription = '
Microsoft recommends blocking or limiting access to SharePoint, OneDrive, and Exchange content from unmanaged devices.

See [Use application enforced restrictions for unmanaged devices - Microsoft Learn](https://aka.ms/CATemplatesAppRestrictions)'

        $testResult = "These conditional access policies enforce restrictions for unmanaged devices:`n`n"

        $result = $false
        foreach ($policy in $policies) {
            if ( $policy.conditions.users.includeUsers -eq 'All' `
                    -and $policy.conditions.clientAppTypes -eq 'All' `
                    -and $policy.sessionControls.applicationEnforcedRestrictions.isEnabled -eq $true `
                    -and 'Office365' -in $policy.conditions.applications.includeApplications `
            ) {
                $result = $true
                $CurrentResult = $true
                $testResult += " - [$($policy.displayName)](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/$($($policy.id))?%23view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies?=)`n"
            } else {
                $CurrentResult = $false
            }
            Write-Verbose "$($policy.displayName) - $CurrentResult"
        }

        if ($result -eq $false) {
            $testResult = 'There was no conditional access policy enforcing restrictions for unmanaged devices.'
        }

        Add-MtTestResultDetail -Description $testDescription -Result $testResult
        return $result
    } catch {
        Add-MtTestResultDetail -SkippedBecause Error -SkippedError $_
        return $null
    }
}