TenantLens

1.3.2

Rules/INT-004.compliance-per-platform.psd1

@{
    Id          = 'INT-004'
    Title       = 'Every managed platform has an assigned compliance policy'
    Area        = 'IntuneCompliance'
    Severity    = 'Medium'
    References  = @(
        'https://learn.microsoft.com/intune/intune-service/protect/device-compliance-get-started'
    )
    Rationale   = 'A single compliance policy for one platform satisfies "a policy exists" while every other managed platform reports compliant by default - platform-level gaps hide behind tenant-level checks.'
    Remediation = 'Create and assign a compliance policy for each platform that has configuration profiles (Windows, iOS, Android, macOS).'
    Test        = {
        param($Snapshot)
        if ($null -eq $Snapshot.PSObject.Properties['IntuneConfiguration']) {
            return New-TLRuleResult -Status Manual -Evidence 'IntuneConfiguration area not collected - managed platforms cannot be derived.'
        }
        function Get-TLPlatformFromText {
            param([string]$Text)
            switch -Regex ($Text) {
                '(?i)windows' { return 'Windows' }
                '(?i)ios' { return 'iOS' }
                '(?i)android' { return 'Android' }
                '(?i)mac' { return 'macOS' }
            }
            return $null
        }
        $managed = [System.Collections.Generic.List[string]]::new()
        foreach ($configurationProfile in @($Snapshot.IntuneConfiguration.deviceConfigurations)) {
            $platform = Get-TLPlatformFromText -Text ([string]$configurationProfile.'@odata.type')
            if ($platform -and ($managed -notcontains $platform)) { $managed.Add($platform) }
        }
        foreach ($policy in @($Snapshot.IntuneConfiguration.settingsCatalogPolicies)) {
            $platform = Get-TLPlatformFromText -Text ([string]$policy.platforms)
            if ($platform -and ($managed -notcontains $platform)) { $managed.Add($platform) }
        }
        if ($managed.Count -eq 0) {
            return New-TLRuleResult -Status Manual -Evidence 'No configuration profiles found - no managed platforms to correlate.'
        }
        $covered = [System.Collections.Generic.List[string]]::new()
        foreach ($policy in @($Snapshot.IntuneCompliance.policies)) {
            if (@($policy.assignments).Count -eq 0) { continue }
            $platform = Get-TLPlatformFromText -Text ([string]$policy.'@odata.type')
            if ($platform -and ($covered -notcontains $platform)) { $covered.Add($platform) }
        }
        $uncovered = @($managed | Where-Object { $covered -notcontains $_ })
        if ($uncovered.Count -gt 0) {
            New-TLRuleResult -Status Fail -Evidence ("Managed platforms without an assigned compliance policy: {0}." -f ($uncovered -join ', '))
        }
        else {
            New-TLRuleResult -Status Pass -Evidence ("All managed platforms covered: {0}." -f (@($managed) -join ', '))
        }
    }
}