TenantLens

1.3.2

Rules/INT-006.devices-encrypted.psd1

                                @{

    Id          = 'INT-006'

    Title       = 'Every managed device reports storage encryption'

    Area        = 'ManagedDevices'

    Severity    = 'High'

    References  = @(

        'https://learn.microsoft.com/intune/intune-service/protect/encrypt-devices'

    )

    Rationale   = 'An unencrypted laptop is a data breach in a backpack - device loss turns into disclosure the moment the disk is readable.'

    Remediation = 'Enforce BitLocker/FileVault via compliance policy and configuration profile; remediate the flagged devices.'

    Test        = {

        param($Snapshot)

        $summary = $Snapshot.ManagedDevices.summary

        $notEncrypted = [int]$summary.notEncryptedCount

        if ($notEncrypted -eq 0) {

            New-TLRuleResult -Status Pass -Evidence ("All {0} managed devices report encryption." -f $summary.total)

        }

        else {

            $examples = @($Snapshot.ManagedDevices.devices | Where-Object { -not $_.isEncrypted } |

                    Select-Object -First 10 | ForEach-Object { "$($_.deviceName) ($($_.operatingSystem))" })

            New-TLRuleResult -Status Fail -Evidence (@("{0} of {1} managed devices report no encryption." -f $notEncrypted, $summary.total) + $examples)

        }

    }

}