Create AADConditionalAccessPolicy.md
Nik Charlebois
Родитель
766b58750b
Коммит
9b6c6b0c31
|
|
@ -0,0 +1,131 @@
|
|||
# AADConditionalAccessPolicy
|
||||
|
||||
## Parameters
|
||||
|
||||
| Parameter | Attribute | DataType | Description | Allowed Values |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| **DisplayName** | Key | String | DisplayName of the AAD CA Policy ||
|
||||
| **Id** | Write | String | Specifies the GUID for the Policy. ||
|
||||
| **State** | Write | String | Specifies the State of the Policy. |disabled, enabled, enabledForReportingButNotEnforced|
|
||||
| **IncludeApplications** | Write | StringArray[] | Cloud Apps in scope of the Policy. ||
|
||||
| **ExcludeApplications** | Write | StringArray[] | Cloud Apps out of scope of the Policy. ||
|
||||
| **IncludeUserActions** | Write | StringArray[] | User Actions in scope of the Policy. ||
|
||||
| **IncludeUsers** | Write | StringArray[] | Users in scope of the Policy. ||
|
||||
| **ExcludeUsers** | Write | StringArray[] | Users out of scope of the Policy. ||
|
||||
| **IncludeGroups** | Write | StringArray[] | Groups in scope of the Policy. ||
|
||||
| **ExcludeGroups** | Write | StringArray[] | Groups out of scope of the Policy. ||
|
||||
| **IncludeRoles** | Write | StringArray[] | AAD Admin Roles in scope of the Policy. ||
|
||||
| **ExcludeRoles** | Write | StringArray[] | AAD Admin Roles out of scope of the Policy. ||
|
||||
| **IncludePlatforms** | Write | StringArray[] | Client Device Platforms in scope of the Policy. ||
|
||||
| **ExcludePlatforms** | Write | StringArray[] | Client Device Platforms out of scope of the Policy. ||
|
||||
| **IncludeLocations** | Write | StringArray[] | AAD Named Locations in scope of the Policy. ||
|
||||
| **ExcludeLocations** | Write | StringArray[] | AAD Named Locations out of scope of the Policy. ||
|
||||
| **IncludeDeviceStates** | Write | StringArray[] | Client Device Compliance states in scope of the Policy. ||
|
||||
| **ExcludeDeviceStates** | Write | StringArray[] | Client Device Compliance states out of scope of the Policy. ||
|
||||
| **UserRiskLevels** | Write | StringArray[] | AAD Identity Protection User Risk Levels in scope of the Policy. ||
|
||||
| **SignInRiskLevels** | Write | StringArray[] | AAD Identity Protection Sign-in Risk Levels in scope of the Policy. ||
|
||||
| **ClientAppTypes** | Write | StringArray[] | Client App types in scope of the Policy. ||
|
||||
| **GrantControlOperator** | Write | String | Operator to be used for Grant Controls. |AND, OR|
|
||||
| **BuiltInControls** | Write | StringArray[] | List of built-in Grant Controls to be applied by the Policy. ||
|
||||
| **ApplicationEnforcedRestrictionsIsEnabled** | Write | Boolean | Specifies, whether Application Enforced Restrictions are enabled in the Policy. ||
|
||||
| **CloudAppSecurityIsEnabled** | Write | Boolean | Specifies, whether Cloud App Security is enforced by the Policy. ||
|
||||
| **CloudAppSecurityType** | Write | String | Specifies, what Cloud App Security control is enforced by the Policy. ||
|
||||
| **SignInFrequencyValue** | Write | UInt32 | Sign in frequency time in the given unit to be enforced by the policy. ||
|
||||
| **SignInFrequencyType** | Write | String | Sign in frequency unit (days/hours) to be interpreted by the policy. |Days, Hours, |
|
||||
| **SignInFrequencyIsEnabled** | Write | Boolean | Specifies, whether sign-in frequency is enforced by the Policy. ||
|
||||
| **PersistentBrowserIsEnabled** | Write | Boolean | Specifies, whether Browser Persistence is controlled by the Policy. ||
|
||||
| **PersistentBrowserMode** | Write | String | Specifies, what Browser Persistence control is enforced by the Policy. |Always, Never, |
|
||||
| **Ensure** | Write | String | Specify if the Azure AD CA Policy should exist or not. |Present, Absent|
|
||||
| **GlobalAdminAccount** | Write | PSCredential | Credentials of the Azure Active Directory Admin ||
|
||||
| **ApplicationId** | Write | String | Id of the Azure Active Directory application to authenticate with. ||
|
||||
| **TenantId** | Write | String | Id of the Azure Active Directory tenant used for authentication. ||
|
||||
| **CertificateThumbprint** | Write | String | Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication. ||
|
||||
|
||||
# AADConditionalAccessPolicy
|
||||
|
||||
### Description
|
||||
|
||||
This resource configures an Azure Active Directory Conditional Access Policy.
|
||||
|
||||
## Azure AD Permissions
|
||||
|
||||
To authenticate via Azure Active Directory, this resource required the following Application permissions:
|
||||
|
||||
* **Automate**
|
||||
* Application.Read.All
|
||||
* Group.Read.All
|
||||
* Directory.Read.All
|
||||
* Policy.Read.All
|
||||
* Policy.Read.ConditionalAccess
|
||||
* Policy.ReadWrite.ConditionalAccess
|
||||
* RoleManagement.Read.All
|
||||
* RoleManagement.Read.Directory
|
||||
* User.Read.All
|
||||
|
||||
* **Export**
|
||||
* Application.Read.All
|
||||
* Group.Read.All
|
||||
* Directory.Read.All
|
||||
* Policy.Read.All
|
||||
* Policy.Read.ConditionalAccess
|
||||
* RoleManagement.Read.All
|
||||
* RoleManagement.Read.Directory
|
||||
* User.Read.All
|
||||
|
||||
NOTE: All permisions listed above require admin consent.
|
||||
|
||||
Additionally Global Reader Role needs to be assigned, as long as AAD PowerShell is not fully converged to use GRAPH API
|
||||
|
||||
## Examples
|
||||
|
||||
### Example 1
|
||||
|
||||
This example is used to test new resources and showcase the usage of new resources being worked on.
|
||||
It is not meant to use as a production baseline.
|
||||
|
||||
```powershell
|
||||
Configuration Example
|
||||
{
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[PSCredential]
|
||||
$credsGlobalAdmin
|
||||
)
|
||||
Import-DscResource -ModuleName Microsoft365DSC
|
||||
|
||||
node localhost
|
||||
{
|
||||
AADConditionalAccessPolicy Allin-example
|
||||
{
|
||||
GlobalAdminAccount = $credsGlobalAdmin;
|
||||
BuiltInControls = @("Mfa", "CompliantDevice", "DomainJoinedDevice", "ApprovedApplication", "CompliantApplication");
|
||||
ClientAppTypes = @("ExchangeActiveSync", "Browser", "MobileAppsAndDesktopClients", "Other");
|
||||
CloudAppSecurityIsEnabled = $True;
|
||||
CloudAppSecurityType = "MonitorOnly";
|
||||
DisplayName = "Allin-example";
|
||||
Ensure = "Present";
|
||||
ExcludeApplications = @("803ee9ca-3f7f-4824-bd6e-0b99d720c35c", "00000012-0000-0000-c000-000000000000", "00000007-0000-0000-c000-000000000000", "Office365");
|
||||
ExcludeDeviceStates = @("Compliant", "DomainJoined");
|
||||
ExcludeLocations = @("Blocked Countries");
|
||||
ExcludePlatforms = @("Windows", "WindowsPhone", "MacOS");
|
||||
ExcludeRoles = @("Company Administrator", "Application Administrator", "Application Developer", "Cloud Application Administrator", "Cloud Device Administrator");
|
||||
ExcludeUsers = @("admin@$OrganizationName", "AAdmin@$OrganizationName", "CAAdmin@$OrganizationName", "AllanD@$OrganizationName", "AlexW@$OrganizationName", "GuestsOrExternalUsers");
|
||||
GrantControlOperator = "OR";
|
||||
IncludeApplications = @("All");
|
||||
IncludeDeviceStates = @("All");
|
||||
IncludeLocations = @("AllTrusted");
|
||||
IncludePlatforms = @("Android", "IOS");
|
||||
IncludeUserActions = @();
|
||||
IncludeUsers = @("All");
|
||||
PersistentBrowserMode = "";
|
||||
SignInFrequencyIsEnabled = $True;
|
||||
SignInFrequencyType = "Hours";
|
||||
SignInFrequencyValue = 5;
|
||||
SignInRiskLevels = @("High", "Medium");
|
||||
State = "disabled";
|
||||
UserRiskLevels = @("High", "Medium");
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Загрузка…
Ссылка в новой задаче