ROOTM365

1.0.1

SHELL/5.2.2.4.ps1

$CheckId = "5.2.2.4"
$Title = "Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users"
$Level = "L1"
$BenchmarkType = "Automated"
$HelperPath = Join-Path $PSScriptRoot "helpers\ca_policy_helpers.ps1"

try {
    if (-not (Test-Path $HelperPath)) {
        throw "Required helper file not found: $HelperPath"
    }

    . $HelperPath

    $Policies = @(Get-Root365CaPoliciesNormalized)
    if ($Policies.Count -eq 0) {
        [pscustomobject]@{
            CheckId = $CheckId
            Title = $Title
            Level = $Level
            BenchmarkType = $BenchmarkType
            Status = "FAIL"
            Pass = $false
            Evidence = [pscustomobject]@{
                HelperPath = $HelperPath
                ConditionalAccessPolicyCount = 0
                SourceDocument = "CIS_Microsoft_365_Foundations_Benchmark_v6.0.1"
            }
            Error = "No Conditional Access policies were returned."
            Timestamp = Get-Date
        }
        return
    }

    $EnabledPolicies = @($Policies | Where-Object { $_.IsEnabled })
    $MatchedPolicies = @(
        $EnabledPolicies | Where-Object {
            $Hours = Convert-Root365SignInFrequencyToHours -Value $_.SignInFrequencyValue -Type $_.SignInFrequencyType
            $SignInFrequencyCompliant = ($_.SignInFrequencyEnabled -eq $true) -and ($null -ne $Hours) -and ($Hours -le 4)
            $PersistentBrowserCompliant = ($_.PersistentBrowserEnabled -eq $true) -and (([string]$_.PersistentBrowserMode) -match '^(?i:never)$')

            ($_.IncludeRoles.Count -gt 0) -and
            (Test-Root365ContainsValue -Collection $_.IncludeApplications -Expected "All") -and
            $SignInFrequencyCompliant -and
            $PersistentBrowserCompliant
        }
    )

    $Pass = $MatchedPolicies.Count -gt 0
    $Status = if ($Pass) { "PASS" } else { "FAIL" }

    [pscustomobject]@{
        CheckId = $CheckId
        Title = $Title
        Level = $Level
        BenchmarkType = $BenchmarkType
        Status = $Status
        Pass = $Pass
        Evidence = [pscustomobject]@{
            ConditionalAccessPolicyCount = $Policies.Count
            EnabledPolicyCount = $EnabledPolicies.Count
            MatchedPolicyCount = $MatchedPolicies.Count
            MatchedPolicies = @(Get-Root365CaPolicyEvidenceSummary -Policies $MatchedPolicies)
            ComplianceCriteria = "Enabled CA policy targets admin roles/all resources, sign-in frequency <= 4 hours, and persistent browser mode is Never."
            SourceDocument = "CIS_Microsoft_365_Foundations_Benchmark_v6.0.1"
        }
        Error = if ($Pass) { $null } else { "No enabled Conditional Access policy was found that enforces <=4 hour sign-in frequency and never-persistent browser sessions for administrative roles." }
        Timestamp = Get-Date
    }
}
catch {
    [pscustomobject]@{
        CheckId = $CheckId
        Title = $Title
        Level = $Level
        BenchmarkType = $BenchmarkType
        Status = "ERROR"
        Pass = $null
        Evidence = [pscustomobject]@{
            HelperPath = $HelperPath
            SourceDocument = "CIS_Microsoft_365_Foundations_Benchmark_v6.0.1"
        }
        Error = $_.Exception.Message
        Timestamp = Get-Date
    }
}