Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Aad conditional access policy custom controls - Fix #2292 #2295

Closed
wants to merge 2 commits into from
Closed

Aad conditional access policy custom controls - Fix #2292 #2295

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9de2f04
Add CustomControls attribute for get, set, and export
Sep 15, 2022
9002365
Fix custom controls attribute name, fix typo in TermsOfUse Verbose text
Sep 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 21 additions & 2 deletions ...t365DSC/DSCResources/MSFT_AADConditionalAccessPolicy/MSFT_AADConditionalAccessPolicy.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,10 @@ function Get-TargetResource
[System.String[]]
$BuiltInControls,

[Parameter()]
[System.String[]]
$CustomControls,

#ConditionalAccessSessionControls
[Parameter()]
[System.Boolean]
Expand Down Expand Up @@ -683,6 +687,8 @@ function Get-TargetResource
GrantControlOperator = $Policy.GrantControls.Operator
#no translation or conversion needed
BuiltInControls = [System.String[]](@() + $Policy.GrantControls.BuiltInControls)
#no translation or conversion needed
CustomControls = [System.String[]](@() + $Policy.GrantControls.CustomAuthenticationFactors)
#no translation needed, return empty string array if undefined
ApplicationEnforcedRestrictionsIsEnabled = $false -or $Policy.SessionControls.ApplicationEnforcedRestrictions.IsEnabled
#make false if undefined, true if true
Expand Down Expand Up @@ -831,6 +837,10 @@ function Set-TargetResource
[System.String[]]
$BuiltInControls,

[Parameter()]
[System.String[]]
$CustomControls,

#ConditionalAccessSessionControls
[Parameter()]
[System.Boolean]
Expand Down Expand Up @@ -1557,7 +1567,7 @@ function Set-TargetResource
#create and provision Grant Control object
Write-Verbose -Message "Set-Targetresource: create and provision Grant Control object"

if ($GrantControlOperator -and ($BuiltInControls -or $TermsOfUse))
if ($GrantControlOperator -and ($BuiltInControls -or $TermsOfUse -or $CustomControls))
{
$GrantControls = @{
Operator = $GrantControlOperator
Expand All @@ -1568,9 +1578,14 @@ function Set-TargetResource
$GrantControls.Add("BuiltInControls", $BuiltInControls)
}

if ($CustomControls)
{
$GrantControls.Add("CustomAuthenticationFactors", $CustomControls)
}

if ($TermsOfUse)
{
Write-Verbose -Message "Gettign Terms of Use {$TermsOfUse}"
Write-Verbose -Message "Getting Terms of Use {$TermsOfUse}"
$TermsOfUseObj = Get-MgAgreement | Where-Object -FilterScript {$_.DisplayName -eq $TermsOfUse}
$GrantControls.Add('TermsOfUse', $TermsOfUseObj.Id)
}
Expand Down Expand Up @@ -1869,6 +1884,10 @@ function Test-TargetResource
[System.String[]]
$BuiltInControls,

[Parameter()]
[System.String[]]
$CustomControls,

#ConditionalAccessSessionControls
[Parameter()]
[System.Boolean]
Expand Down
1 change: 1 addition & 0 deletions ...C/DSCResources/MSFT_AADConditionalAccessPolicy/MSFT_AADConditionalAccessPolicy.schema.mof
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ class MSFT_AADConditionalAccessPolicy : OMI_BaseResource
[Write, Description("Client App types in scope of the Policy.")] String ClientAppTypes[];
[Write, Description("Operator to be used for Grant Controls."), ValueMap{"AND","OR"}, Values{"AND","OR"}] String GrantControlOperator;
[Write, Description("List of built-in Grant Controls to be applied by the Policy.")] String BuiltInControls[];
[Write, Description("List of Custom Grant Control IDs to be applied by the Policy.")] String CustomControls[];
[Write, Description("Specifies, whether Application Enforced Restrictions are enabled in the Policy.")] Boolean ApplicationEnforcedRestrictionsIsEnabled;
[Write, Description("Specifies, whether Cloud App Security is enforced by the Policy.")] Boolean CloudAppSecurityIsEnabled;
[Write, Description("Specifies, what Cloud App Security control is enforced by the Policy.")] String CloudAppSecurityType;
Expand Down
4 changes: 4 additions & 0 deletions Modules/Microsoft365DSC/DSCResources/MSFT_AADConditionalAccessPolicy/Readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,7 @@
## Description

This resource configures an Azure Active Directory Conditional Access Policy.

## Notes
The CustomControls attribute contains the IDs of the custom controls, not the names.
The "Id" attribute is part of the custom control json definition.
3 changes: 3 additions & 0 deletions Tests/Unit/Microsoft365DSC/Microsoft365DSC.AADConditionalAccessPolicy.Tests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,6 +275,7 @@ Describe -Name $Global:DscHelper.DescribeHeader -Fixture {
$testParams = @{
ApplicationEnforcedRestrictionsIsEnabled = $True
BuiltInControls = @("Mfa", "CompliantDevice", "DomainJoinedDevice", "ApprovedApplication", "CompliantApplication")
CustomControls = @("Custom_Control_MFA_21341251")
ClientAppTypes = @("Browser", "MobileAppsAndDesktopClients")
CloudAppSecurityIsEnabled = $True
CloudAppSecurityType = "MonitorOnly"
Expand Down Expand Up @@ -352,6 +353,7 @@ Describe -Name $Global:DscHelper.DescribeHeader -Fixture {
GrantControls = @{
Operator = "AND"
BuiltInControls = @("Mfa", "CompliantDevice", "DomainJoinedDevice", "ApprovedApplication", "CompliantApplication")
CustomControls = @("Custom_Control_MFA_21341251")
}
SessionControls = @{
ApplicationEnforcedRestrictions = @{
Expand Down Expand Up @@ -592,6 +594,7 @@ Describe -Name $Global:DscHelper.DescribeHeader -Fixture {
GrantControls = @{
_Operator = "AND"
BuiltInControls = @("Mfa", "CompliantDevice", "DomainJoinedDevice", "ApprovedApplication", "CompliantApplication")
CustomControls = @("Custom_Control_MFA_21341251")
}
SessionControls = @{
ApplicationEnforcedRestrictions = @{
Expand Down
2 changes: 1 addition & 1 deletion docs/docs/resources/azure-ad/AADConditionalAccessPolicy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
| **ClientAppTypes** | Write | StringArray[] | Client App types in scope of the Policy. ||
| **GrantControlOperator** | Write | String | Operator to be used for Grant Controls. |AND, OR|
| **BuiltInControls** | Write | StringArray[] | List of built-in Grant Controls to be applied by the Policy. ||
| **CustomControls** | Write | StringArray[] | List of Custom Grant Control IDs to be applied by the Policy. ||
| **ApplicationEnforcedRestrictionsIsEnabled** | Write | Boolean | Specifies, whether Application Enforced Restrictions are enabled in the Policy. ||
| **CloudAppSecurityIsEnabled** | Write | Boolean | Specifies, whether Cloud App Security is enforced by the Policy. ||
| **CloudAppSecurityType** | Write | String | Specifies, what Cloud App Security control is enforced by the Policy. ||
Expand Down Expand Up @@ -107,4 +108,3 @@ Configuration Example
}
}
```