Private/Get-TLDriftSeverity.ps1
|
function Get-TLDriftSeverity { <# .SYNOPSIS Severity heuristic for drift changes. .DESCRIPTION Changes to Conditional Access exclusions, role assignments or consent settings are highlighted; cosmetic renames rank as Info. #> [CmdletBinding()] param( [Parameter(Mandatory)] [string]$Area, [Parameter(Mandatory)] [ValidateSet('Added', 'Removed', 'Changed')] [string]$ChangeType, [AllowEmptyString()] [string]$Path = '' ) switch -Wildcard ($Area) { 'Intune*' { if ($ChangeType -ne 'Changed') { return 'Medium' } if ($Path -match '(?i)assignments|settings') { return 'Medium' } if ($Path -match '(?i)displayName|^name') { return 'Info' } return 'Low' } 'ConditionalAccess' { if ($ChangeType -ne 'Changed') { return 'High' } if ($Path -match '(?i)exclude|state|grantControls|sessionControls|includeRoles') { return 'High' } if ($Path -match '(?i)displayName') { return 'Info' } return 'Medium' } 'RoleAssignments' { if ($Path -match '(?i)^(assignments|eligibility)') { if ($ChangeType -ne 'Changed') { return 'High' } return 'Medium' } return 'Low' } 'AuthorizationPolicy' { if ($Path -match '(?i)securityDefaults|permissionGrant|guestUserRoleId|allowInvitesFrom') { return 'High' } return 'Medium' } 'NamedLocations' { if ($Path -match '(?i)isTrusted|ipRanges') { return 'High' } return 'Medium' } 'EmailAuthDns' { return 'Medium' } 'ConsentGrants' { if ($ChangeType -ne 'Changed') { return 'High' } if ($Path -match '(?i)appRoleGrants|delegatedGrants') { return 'High' } return 'Medium' } 'CrossTenantAccess' { if ($Path -match '(?i)automaticUserConsent|inboundTrust|b2bCollaboration') { return 'High' } return 'Medium' } 'SharePointSettings' { if ($Path -match '(?i)sharing|legacyAuth') { return 'High' } return 'Medium' } 'Groups' { if ($Path -match '(?i)visibility|membershipRule|owners') { return 'Medium' } if ($Path -match '(?i)displayName') { return 'Info' } return 'Low' } 'Applications' { if ($Path -match '(?i)credential|keyCredentials|passwordCredentials|requiredResourceAccess|owner') { return 'High' } return 'Medium' } default { if ($Path -match '(?i)displayName') { return 'Info' } return 'Low' } } } |