Microsoft 365 et Conformité - Guide Pratique Cybersecurite

# Configuration des sensitivity labels avec PowerShell

function Deploy-SensitivityLabels {
    [CmdletBinding()]
    param(
        [switch]$EnableAutoLabeling,
        [switch]$ConfigureProtection,
        [string[]]$Scopes = @("File", "Email", "Site", "UnifiedGroup")
    )

    # Connexion au Security & Compliance Center
    Connect-IPPSSession -UserPrincipalName $env:USERNAME

    # Configuration des labels de base
    $labels = @(
        @{
            Name = "Public"
            DisplayName = "Public"
            Description = "Information publique sans restriction"
            Color = "Green"
            Priority = 0
            Settings = @{
                ContentType = @("File", "Email", "Site")
                Protection = $null
                Marking = @{
                    WaterMarkText = "PUBLIC"
                    HeaderText = "Classification: Public"
                }
            }
        },
        @{
            Name = "Internal"
            DisplayName = "Usage Interne"
            Description = "Information interne à l'organisation"
            Color = "Yellow"
            Priority = 1
            Settings = @{
                ContentType = @("File", "Email", "Site", "UnifiedGroup")
                Protection = @{
                    Type = "UserDefined"
                    UserRights = @("domain.com=View,Edit,Save,Export,Reply")
                }
                Marking = @{
                    WaterMarkText = "USAGE INTERNE"
                    HeaderText = "Classification: Usage Interne"
                    FooterText = "Propriété de [Organization] - Diffusion interne uniquement"
                }
            }
        },
        @{
            Name = "Confidential"
            DisplayName = "Confidentiel"
            Description = "Information confidentielle nécessitant une protection renforcée"
            Color = "Red"
            Priority = 2
            Settings = @{
                ContentType = @("File", "Email", "Site", "UnifiedGroup")
                Protection = @{
                    Type = "Template"
                    TemplateId = "Encrypt-AuthenticatedUsers"
                    ContentExpirationDate = (Get-Date).AddYears(2)
                    OfflineAccessInterval = 7
                }
                Marking = @{
                    WaterMarkText = "CONFIDENTIEL"
                    HeaderText = "Classification: Confidentiel"
                    FooterText = "Propriété de [Organization] - Accès autorisé uniquement"
                }
                DLPSettings = @{
                    BlockExternalSharing = $true
                    RequireJustification = $true
                    AuditAccess = $true
                }
            }
        },
        @{
            Name = "HighlyConfidential"
            DisplayName = "Hautement Confidentiel"
            Description = "Information hautement sensible - Accès très restreint"
            Color = "Red"
            Priority = 3
            Settings = @{
                ContentType = @("File", "Email")
                Protection = @{
                    Type = "Custom"
                    Rights = @{
                        "executives@domain.com" = @("View", "Edit")
                        "legal@domain.com" = @("View")
                        "compliance@domain.com" = @("View", "Audit")
                    }
                    ContentExpirationDate = (Get-Date).AddMonths(6)
                    OfflineAccessInterval = 1
                    RequireAdditionalAuth = $true
                }
                Marking = @{
                    WaterMarkText = "HAUTEMENT CONFIDENTIEL"
                    HeaderText = "Classification: Hautement Confidentiel"
                    FooterText = "Accès restreint - Ne pas diffuser"
                }
                DLPSettings = @{
                    BlockExternalSharing = $true
                    BlockPrinting = $true
                    BlockCopyPaste = $true
                    RequireJustification = $true
                    ManagerApprovalRequired = $true
                }
            }
        }
    )

    $deployedLabels = @()

    foreach ($labelConfig in $labels) {
        try {
            Write-Host "📋 Création du label: $($labelConfig.DisplayName)" -ForegroundColor Cyan

            # Création du sensitivity label
            $labelParams = @{
                Name = $labelConfig.Name
                DisplayName = $labelConfig.DisplayName
                Comment = $labelConfig.Description
                AdvancedSettings = @{
                    Color = $labelConfig.Color
                    Priority = $labelConfig.Priority
                }
            }

            $newLabel = New-Label @labelParams

            # Configuration des protection settings si spécifiés
            if ($ConfigureProtection -and $labelConfig.Settings.Protection) {
                $protectionParams = @{
                    Identity = $newLabel.Guid
                }

                switch ($labelConfig.Settings.Protection.Type) {
                    "Template" {
                        $protectionParams.RightsManagementProtection = $labelConfig.Settings.Protection.TemplateId
                    }
                    "Custom" {
                        $protectionParams.UserRightsManagementSettings = $labelConfig.Settings.Protection.Rights | ConvertTo-Json
                    }
                    "UserDefined" {
                        $protectionParams.UserRightsManagementSettings = $labelConfig.Settings.Protection.UserRights -join ";"
                    }
                }

                Set-Label @protectionParams
            }

            # Configuration du visual marking
            if ($labelConfig.Settings.Marking) {
                $markingParams = @{
                    Identity = $newLabel.Guid
                }

                if ($labelConfig.Settings.Marking.WaterMarkText) {
                    $markingParams.ApplyWaterMarkText = $labelConfig.Settings.Marking.WaterMarkText
                    $markingParams.WaterMarkAlignment = "Center"
                    $markingParams.WaterMarkEnabled = $true
                }

                if ($labelConfig.Settings.Marking.HeaderText) {
                    $markingParams.ApplyContentMarkingHeaderText = $labelConfig.Settings.Marking.HeaderText
                    $markingParams.ContentMarkingHeaderEnabled = $true
                }

                if ($labelConfig.Settings.Marking.FooterText) {
                    $markingParams.ApplyContentMarkingFooterText = $labelConfig.Settings.Marking.FooterText
                    $markingParams.ContentMarkingFooterEnabled = $true
                }

                Set-Label @markingParams
            }

            # Publication du label
            $publishParams = @{
                Name = "Policy-$($labelConfig.Name)"
                Labels = $newLabel.Guid
                ExchangeLocation = "All"
                SharePointLocation = "All"
                OneDriveLocation = "All"
                TeamsLocation = "All"
            }

            New-LabelPolicy @publishParams

            $deployedLabels += [PSCustomObject]@{
                Name = $labelConfig.Name
                DisplayName = $labelConfig.DisplayName
                Guid = $newLabel.Guid
                Priority = $labelConfig.Priority
                Status = "Deployed"
                Scopes = $labelConfig.Settings.ContentType -join ", "
            }

            Write-Host "✅ Label déployé: $($labelConfig.DisplayName)" -ForegroundColor Green

        } catch {
            Write-Warning "⚠️ Erreur déploiement label $($labelConfig.Name): $($_.Exception.Message)"

            $deployedLabels += [PSCustomObject]@{
                Name = $labelConfig.Name
                DisplayName = $labelConfig.DisplayName
                Status = "Failed"
                Error = $_.Exception.Message
            }
        }
    }

    # Configuration de l'auto-labeling si demandé
    if ($EnableAutoLabeling) {
        Write-Host "🤖 Configuration de l'auto-labeling..." -ForegroundColor Yellow

        $autoLabelingRules = @{
            "PII-Detection" = @{
                Label = "Confidential"
                Conditions = @("EU Passport Number", "Credit Card Number", "Social Security Number")
                Confidence = 85
                Actions = @("ApplyLabel", "Notify", "Audit")
            }
            "Financial-Data" = @{
                Label = "HighlyConfidential"
                Conditions = @("Bank Account Number", "SWIFT Code", "Financial Report")
                Confidence = 90
                Actions = @("ApplyLabel", "Notify", "Block", "Audit")
            }
        }

        foreach ($rule in $autoLabelingRules.Keys) {
            $ruleConfig = $autoLabelingRules[$rule]

            try {
                New-AutoSensitivityLabelPolicy -Name $rule -ApplySensitivityLabel $ruleConfig.Label -ExchangeLocation All -SharePointLocation All -OneDriveLocation All -Mode Simulate

                Write-Host "✅ Règle auto-labeling créée: $rule" -ForegroundColor Green
            } catch {
                Write-Warning "⚠️ Erreur création règle $rule : $($_.Exception.Message)"
            }
        }
    }

    return $deployedLabels
}