ROOTM365

1.0.1

SHELL/5.2.2.9.ps1

$CheckId = "5.2.2.9"
$Title = "Ensure a managed device is required for authentication"
$Level = "L1"
$BenchmarkType = "Automated"
$HelperPath = Join-Path $PSScriptRoot "helpers\ca_policy_helpers.ps1"

try {
    if (-not (Test-Path $HelperPath)) {
        throw "Required helper file not found: $HelperPath"
    }

    . $HelperPath

    $Policies = @(Get-Root365CaPoliciesNormalized)
    if ($Policies.Count -eq 0) {
        [pscustomobject]@{
            CheckId = $CheckId
            Title = $Title
            Level = $Level
            BenchmarkType = $BenchmarkType
            Status = "FAIL"
            Pass = $false
            Evidence = [pscustomobject]@{
                HelperPath = $HelperPath
                ConditionalAccessPolicyCount = 0
                SourceDocument = "CIS_Microsoft_365_Foundations_Benchmark_v6.0.1"
            }
            Error = "No Conditional Access policies were returned."
            Timestamp = Get-Date
        }
        return
    }

    $EnabledPolicies = @($Policies | Where-Object { $_.IsEnabled })
    $MatchedPolicies = @(
        $EnabledPolicies | Where-Object {
            $GrantHasManagedDeviceControls =
                (Test-Root365ContainsAllValues -Collection $_.GrantBuiltInControls -ExpectedValues @("compliantDevice", "domainJoinedDevice")) -and
                (([string]$_.GrantOperator) -match '^(?i:or)$')

            (Test-Root365ContainsValue -Collection $_.IncludeUsers -Expected "All") -and
            (Test-Root365ContainsValue -Collection $_.IncludeApplications -Expected "All") -and
            $GrantHasManagedDeviceControls
        }
    )

    $Pass = $MatchedPolicies.Count -gt 0
    $Status = if ($Pass) { "PASS" } else { "FAIL" }

    [pscustomobject]@{
        CheckId = $CheckId
        Title = $Title
        Level = $Level
        BenchmarkType = $BenchmarkType
        Status = $Status
        Pass = $Pass
        Evidence = [pscustomobject]@{
            ConditionalAccessPolicyCount = $Policies.Count
            EnabledPolicyCount = $EnabledPolicies.Count
            MatchedPolicyCount = $MatchedPolicies.Count
            MatchedPolicies = @(Get-Root365CaPolicyEvidenceSummary -Policies $MatchedPolicies)
            ComplianceCriteria = "Enabled CA policy targets all users/all resources and requires compliant device OR hybrid-joined device."
            SourceDocument = "CIS_Microsoft_365_Foundations_Benchmark_v6.0.1"
        }
        Error = if ($Pass) { $null } else { "No enabled Conditional Access policy was found that requires compliant device OR hybrid-joined device for all users across all resources." }
        Timestamp = Get-Date
    }
}
catch {
    [pscustomobject]@{
        CheckId = $CheckId
        Title = $Title
        Level = $Level
        BenchmarkType = $BenchmarkType
        Status = "ERROR"
        Pass = $null
        Evidence = [pscustomobject]@{
            HelperPath = $HelperPath
            SourceDocument = "CIS_Microsoft_365_Foundations_Benchmark_v6.0.1"
        }
        Error = $_.Exception.Message
        Timestamp = Get-Date
    }
}