Security Migration: AD Security Model to Entra ID¶

# Create baseline Conditional Access policy: Require MFA for all users
$params = @{
    displayName = "CA001 - Require MFA for all users"
    state = "enabledForReportingButNotEnforced"
    conditions = @{
        users = @{
            includeUsers = @("All")
            excludeUsers = @("BreakGlassAccount1-ObjectId", "BreakGlassAccount2-ObjectId")
        }
        applications = @{
            includeApplications = @("All")
        }
        clientAppTypes = @("browser", "mobileAppsAndDesktopClients")
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @("mfa")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $params

# Create policy: Block legacy authentication
$blockLegacy = @{
    displayName = "CA002 - Block legacy authentication"
    state = "enabledForReportingButNotEnforced"
    conditions = @{
        users = @{ includeUsers = @("All") }
        applications = @{ includeApplications = @("All") }
        clientAppTypes = @(
            "exchangeActiveSync",
            "other"
        )
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @("block")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $blockLegacy

# Configure sign-in risk policy
$signInRiskPolicy = @{
    displayName = "Sign-in Risk Policy - Require MFA"
    state = "enabled"
    conditions = @{
        users = @{ includeUsers = @("All") }
        applications = @{ includeApplications = @("All") }
        signInRiskLevels = @("medium", "high")
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @("mfa")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $signInRiskPolicy

# Configure user risk policy
$userRiskPolicy = @{
    displayName = "User Risk Policy - Require Password Change"
    state = "enabled"
    conditions = @{
        users = @{ includeUsers = @("All") }
        applications = @{ includeApplications = @("All") }
        userRiskLevels = @("high")
    }
    grantControls = @{
        operator = "AND"
        builtInControls = @("mfa", "passwordChange")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $userRiskPolicy

# Configure PIM settings for Fabric Administrator role
$roleId = (Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'Fabric Administrator'").Id

# Configure activation requirements
$pimSettings = @{
    rules = @(
        @{
            id = "Approval_EndUser_Assignment"
            ruleType = "RoleManagementPolicyApprovalRule"
            target = @{ caller = "EndUser"; operations = @("All"); level = "Assignment" }
            setting = @{
                isApprovalRequired = $true
                approvalStages = @(
                    @{
                        approvalStageTimeOutInDays = 1
                        primaryApprovers = @(
                            @{
                                "@odata.type" = "#microsoft.graph.singleUser"
                                userId = "approver-object-id"
                            }
                        )
                    }
                )
            }
        }
        @{
            id = "AuthenticationContext_EndUser_Assignment"
            ruleType = "RoleManagementPolicyAuthenticationContextRule"
            target = @{ caller = "EndUser"; operations = @("All"); level = "Assignment" }
            setting = @{
                isEnabled = $true
                claimValue = "c1"  # Require phishing-resistant MFA
            }
        }
        @{
            id = "Expiration_EndUser_Assignment"
            ruleType = "RoleManagementPolicyExpirationRule"
            target = @{ caller = "EndUser"; operations = @("All"); level = "Assignment" }
            setting = @{
                isExpirationRequired = $true
                maximumDuration = "PT4H"  # 4 hours maximum
            }
        }
    )
}

# Create Windows LAPS policy via Intune
# Intune > Endpoint Security > Account Protection > LAPS

$lapsPolicy = @{
    displayName = "CSA-in-a-Box LAPS Policy"
    description = "Windows LAPS with Entra ID backup for data platform devices"
    roleScopeTagIds = @("0")
    settings = @(
        @{
            settingDefinitionId = "device_vendor_msft_laps_policies_backupdirectory"
            settingValue = @{
                "@odata.type" = "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
                value = "device_vendor_msft_laps_policies_backupdirectory_1"  # Azure AD
            }
        }
        @{
            settingDefinitionId = "device_vendor_msft_laps_policies_passwordagedaysaad"
            settingValue = @{
                "@odata.type" = "#microsoft.graph.deviceManagementConfigurationIntegerSettingValue"
                value = 30
            }
        }
        @{
            settingDefinitionId = "device_vendor_msft_laps_policies_passwordcomplexity"
            settingValue = @{
                "@odata.type" = "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
                value = "device_vendor_msft_laps_policies_passwordcomplexity_4"  # All character types
            }
        }
        @{
            settingDefinitionId = "device_vendor_msft_laps_policies_passwordlength"
            settingValue = @{
                "@odata.type" = "#microsoft.graph.deviceManagementConfigurationIntegerSettingValue"
                value = 24
            }
        }
        @{
            settingDefinitionId = "device_vendor_msft_laps_policies_postauthenticationactions"
            settingValue = @{
                "@odata.type" = "#microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
                value = "device_vendor_msft_laps_policies_postauthenticationactions_3"  # Reset + logoff
            }
        }
    )
}

# Create recurring access review for CSA-in-a-Box admin group
$accessReview = @{
    displayName = "CSA Platform Admins - Quarterly Review"
    descriptionForAdmins = "Review admin access to CSA-in-a-Box platform services"
    scope = @{
        "@odata.type" = "#microsoft.graph.principalResourceMembershipsScope"
        principalScopes = @(@{
            "@odata.type" = "#microsoft.graph.accessReviewQueryScope"
            query = "/groups/csa-admins-group-id/members"
        })
        resourceScopes = @(@{
            "@odata.type" = "#microsoft.graph.accessReviewQueryScope"
            query = "/groups/csa-admins-group-id"
        })
    }
    reviewers = @(@{
        query = "/users/reviewer-object-id"
        queryType = "MicrosoftGraph"
    })
    settings = @{
        mailNotificationsEnabled = $true
        reminderNotificationsEnabled = $true
        justificationRequiredOnApproval = $true
        defaultDecisionEnabled = $true
        defaultDecision = "Deny"  # If reviewer doesn't respond, access is removed
        instanceDurationInDays = 14
        recurrence = @{
            pattern = @{ type = "absoluteMonthly"; interval = 3 }
            range = @{ type = "noEnd"; startDate = "2026-07-01" }
        }
        autoApplyDecisionsEnabled = $true
    }
}

New-MgIdentityGovernanceAccessReviewDefinition -BodyParameter $accessReview

# Inventory service accounts with SPNs
Get-ADUser -Filter { ServicePrincipalName -like "*" } -Properties `
    ServicePrincipalName, PasswordLastSet, PasswordNeverExpires,
    LastLogonDate, Description |
    Select-Object SamAccountName, Description,
    @{N="SPNs"; E={$_.ServicePrincipalName -join "; "}},
    PasswordLastSet, PasswordNeverExpires, LastLogonDate |
    Export-Csv ".\service-accounts-with-spns.csv" -NoTypeInformation

# Create break-glass accounts (cloud-only, excluded from all CA policies)
# These accounts bypass Conditional Access for emergency admin access

# Account 1: FIDO2 security key
$breakGlass1 = @{
    accountEnabled = $true
    displayName = "Break Glass 1"
    mailNickname = "breakglass1"
    userPrincipalName = "breakglass1@contoso.onmicrosoft.com"
    passwordProfile = @{
        forceChangePasswordNextSignIn = $false
        password = (New-Guid).ToString() + "!Aa1"  # Complex, stored in safe
    }
}
New-MgUser -BodyParameter $breakGlass1

# Assign Global Admin permanently (not via PIM)
$roleDefinitionId = (Get-MgRoleManagementDirectoryRoleDefinition `
    -Filter "displayName eq 'Global Administrator'").Id

New-MgRoleManagementDirectoryRoleAssignment -BodyParameter @{
    principalId = $breakGlass1ObjectId
    roleDefinitionId = $roleDefinitionId
    directoryScopeId = "/"
}

# CRITICAL: Exclude break-glass accounts from ALL Conditional Access policies
# Monitor sign-ins: alert on any break-glass account usage