Sécuriser les Accès Microsoft | Guide Microsoft 365

# Script de création d'une politique Conditional Access complète

function New-ComprehensiveConditionalAccessPolicy {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$PolicyName,

        [Parameter(Mandatory)]
        [string[]]$TargetUsers,

        [string[]]$ExcludeUsers = @("BreakGlassAccount@contoso.com"),

        [Parameter(Mandatory)]
        [string[]]$CloudApps,

        [string[]]$TrustedLocations = @(),

        [ValidateSet("Allow", "Block", "RequireMFA", "RequireCompliantDevice")]
        [string]$GrantControl = "RequireMFA",

        [switch]$EnableSessionControls,

        [switch]$ReportOnlyMode
    )

    # Connexion à Microsoft Graph avec les scopes requis
    Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess", "Directory.Read.All"

    # Construction de la politique
    $policy = @{
        displayName = $PolicyName
        state = if ($ReportOnlyMode) { "enabledForReportingButNotEnforced" } else { "enabled" }

        conditions = @{
            users = @{
                includeUsers = $TargetUsers
                excludeUsers = $ExcludeUsers
            }
            applications = @{
                includeApplications = $CloudApps
                excludeApplications = @()
            }
            platforms = @{
                includePlatforms = @("all")
                excludePlatforms = @()
            }
            locations = if ($TrustedLocations.Count -gt 0) {
                @{
                    includeLocations = @("All")
                    excludeLocations = $TrustedLocations
                }
            } else {
                @{
                    includeLocations = @("All")
                }
            }
            clientAppTypes = @("all")
            deviceStates = @{
                includeStates = @("all")
                excludeStates = @()
            }
        }
    }

    # Configuration des contrôles d'accès
    switch ($GrantControl) {
        "RequireMFA" {
            $policy.grantControls = @{
                operator = "OR"
                builtInControls = @("mfa")
                customAuthenticationFactors = @()
                termsOfUse = @()
            }
        }
        "RequireCompliantDevice" {
            $policy.grantControls = @{
                operator = "OR"
                builtInControls = @("compliantDevice", "hybridAzureADJoinedDevice")
            }
        }
        "Block" {
            $policy.grantControls = @{
                operator = "OR"
                builtInControls = @("block")
            }
        }
        default {
            $policy.grantControls = @{
                operator = "OR"
                builtInControls = @("mfa")
            }
        }
    }

    # Configuration des contrôles de session si activés
    if ($EnableSessionControls) {
        $policy.sessionControls = @{
            applicationEnforcedRestrictions = @{
                isEnabled = $false
            }
            cloudAppSecurity = @{
                isEnabled = $true
                cloudAppSecurityType = "monitorOnly"
            }
            signInFrequency = @{
                isEnabled = $true
                type = "hours"
                value = 8
            }
            persistentBrowser = @{
                isEnabled = $false
            }
        }
    }

    try {
        # Création de la politique
        $newPolicy = New-MgIdentityConditionalAccessPolicy -BodyParameter $policy

        Write-Host "✅ Politique '$PolicyName' créée avec succès" -ForegroundColor Green
        Write-Host "   ID: $($newPolicy.Id)" -ForegroundColor Gray
        Write-Host "   État: $($newPolicy.State)" -ForegroundColor Gray

        # Vérification et rapport
        $report = @{
            PolicyId = $newPolicy.Id
            PolicyName = $newPolicy.DisplayName
            State = $newPolicy.State
            TargetUsers = $TargetUsers.Count
            TargetApps = $CloudApps.Count
            GrantControls = $policy.grantControls.builtInControls -join ", "
            SessionControls = if ($EnableSessionControls) { "Enabled" } else { "Disabled" }
            CreatedDate = Get-Date
        }

        return $report
    }
    catch {
        Write-Error "❌ Erreur lors de la création de la politique: $($_.Exception.Message)"
        throw
    }
}

# Template de politique pour administrateurs

$adminPolicy = @{
    displayName = "CA001-BLOCK-AdminAccess-UntrustedLocations"
    state = "enabled"
    conditions = @{
        users = @{
            includeRoles = @(
                "62e90394-69f5-4237-9190-012177145e10", # Global Administrator
                "e8611ab8-c189-46e8-94e1-60213ab1f814", # Privileged Role Administrator
                "fe930be7-5e62-47db-91af-98c3a49a38b1", # User Administrator
                "29232cdf-9323-42fd-ade2-1d097af3e4de", # Exchange Administrator
                "f28a1f50-f6e7-4571-818b-6a12f2af6b6c"  # SharePoint Administrator
            )
            excludeUsers = @("breakglass1@contoso.com", "breakglass2@contoso.com")
        }
        applications = @{
            includeApplications = @("All")
        }
        locations = @{
            includeLocations = @("All")
            excludeLocations = @("TrustedCorporateNetwork", "HomeOfficeLocations")
        }
        clientAppTypes = @("all")
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @("block")
    }
}

# Création avec validation
try {
    New-MgIdentityConditionalAccessPolicy -BodyParameter $adminPolicy
    Write-Host "✅ Politique administrateur créée avec succès" -ForegroundColor Green
} catch {
    Write-Error "❌ Échec création politique: $($_.Exception.Message)"
}