Security Migration Guide: Permissions, Identity, and Governance¶

# Verify Entra Connect sync status
Get-ADSyncScheduler

# Force a delta sync
Start-ADSyncSyncCycle -PolicyType Delta

# Verify synced users
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "onPremisesSyncEnabled eq true" -CountVariable count -ConsistencyLevel eventual
Write-Host "Synced users: $count"

# Generate user mapping from AD and Entra ID
$adUsers = Get-ADUser -Filter * -Properties EmailAddress, UserPrincipalName, SamAccountName |
    Where-Object { $_.Enabled }

$entraUsers = Get-MgUser -All | Select-Object UserPrincipalName, OnPremisesSecurityIdentifier

$mapping = foreach ($adUser in $adUsers) {
    $entraMatch = $entraUsers | Where-Object {
        $_.OnPremisesSecurityIdentifier -eq $adUser.SID.Value
    }
    if ($entraMatch) {
        [PSCustomObject]@{
            Source = "CONTOSO\$($adUser.SamAccountName)"
            Target = $entraMatch.UserPrincipalName
        }
    }
}

$mapping | Export-Csv -Path "C:\Migration\user-mapping.csv" -NoTypeInformation

# Export on-premises groups used in SharePoint
Add-PSSnapin Microsoft.SharePoint.PowerShell

$groupUsage = @()

Get-SPSite -Limit All | ForEach-Object {
    $site = $_
    $_.RootWeb.SiteGroups | ForEach-Object {
        $group = $_
        $groupUsage += [PSCustomObject]@{
            SiteUrl    = $site.Url
            GroupName  = $group.Name
            MemberCount = $group.Users.Count
            Members    = ($group.Users | Select-Object -First 5 -ExpandProperty LoginName) -join "; "
            Roles      = ($_.Roles | Select-Object -ExpandProperty Name) -join "; "
        }
    }
}

$groupUsage | Export-Csv -Path "C:\Migration\group-inventory.csv" -NoTypeInformation

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/finance" -Interactive

# Check site-level permissions
Get-PnPSiteGroup | ForEach-Object {
    $group = $_
    [PSCustomObject]@{
        Group   = $group.Title
        Roles   = ($group.Roles | Select-Object -ExpandProperty Name) -join "; "
        Members = ($group.Users | Select-Object -ExpandProperty Email) -join "; "
    }
} | Format-Table -AutoSize

# Check for items with unique permissions
Get-PnPList | ForEach-Object {
    $list = $_
    $items = Get-PnPListItem -List $_ -PageSize 500 |
        Where-Object { $_.HasUniqueRoleAssignments }
    if ($items.Count -gt 0) {
        Write-Host "List: $($list.Title) - Items with unique permissions: $($items.Count)"
    }
}

# Check site collection administrators
Get-PnPSiteCollectionAdmin | Select-Object Title, Email | Format-Table -AutoSize

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Set tenant-level sharing policy
Set-SPOTenant `
    -SharingCapability ExternalUserAndGuestSharing `  # Options: Disabled, ExistingExternalUserSharingOnly, ExternalUserSharingOnly, ExternalUserAndGuestSharing
    -DefaultSharingLinkType Internal `                 # Default sharing link = organization
    -FileAnonymousLinkType View `                      # Anonymous links = view only
    -FolderAnonymousLinkType View `
    -RequireAcceptingAccountMatchInvitedAccount $true ` # External users must use invited email
    -PreventExternalUsersFromResharing $true `          # External users cannot reshare
    -DefaultLinkPermission View `                       # Default permission = view
    -RequireAnonymousLinksExpireInDays 30 `             # Anonymous links expire in 30 days
    -EmailAttestationRequired $true `                   # Require email verification for external
    -EmailAttestationReAuthDays 30                      # Re-verify every 30 days

# Restrict sharing for sensitive sites
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/legal" `
    -SharingCapability Disabled  # No external sharing for legal site

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/marketing" `
    -SharingCapability ExternalUserSharingOnly  # Named external users only

# Restrict sharing to specific security groups
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/finance" `
    -SharingAllowedDomainList "partner.com,vendor.com" `
    -SharingDomainRestrictionMode AllowList

Connect-IPPSSession

# Create sensitivity labels
New-Label -DisplayName "Public" `
    -Name "Public" `
    -Tooltip "Content approved for public distribution" `
    -Comment "No restrictions" `
    -ContentType "File, Email"

New-Label -DisplayName "Internal" `
    -Name "Internal" `
    -Tooltip "Content for internal use only" `
    -Comment "Do not share externally" `
    -ContentType "File, Email"

New-Label -DisplayName "Confidential" `
    -Name "Confidential" `
    -Tooltip "Sensitive business content" `
    -Comment "Restricted distribution" `
    -ContentType "File, Email" `
    -EncryptionEnabled $true `
    -EncryptionProtectionType Template `
    -EncryptionRightsDefinitions "admin@contoso.com:VIEW,VIEWRIGHTSDATA,DOCEDIT,EDIT,PRINT,EXTRACT,REPLY,REPLYALL,FORWARD,OBJMODEL"

New-Label -DisplayName "Highly Confidential" `
    -Name "HighlyConfidential" `
    -Tooltip "Top-secret business content" `
    -Comment "Executive access only" `
    -ContentType "File, Email" `
    -EncryptionEnabled $true `
    -EncryptionProtectionType Template `
    -EncryptionRightsDefinitions "executives@contoso.com:VIEW,VIEWRIGHTSDATA"

# Publish labels to users
New-LabelPolicy -Name "Corporate Labels" `
    -Labels "Public","Internal","Confidential","HighlyConfidential" `
    -ExchangeLocation All `
    -SharePointLocation All `
    -OneDriveLocation All `
    -Settings @{
        "mandatory"    = "true"
        "defaultlabel" = "Internal"
    }

# Create auto-labeling policy for SSN detection
New-AutoSensitivityLabelPolicy -Name "Auto-Label SSN" `
    -SharePointLocation All `
    -OneDriveLocation All `
    -ApplySensitivityLabel "Confidential" `
    -Mode TestWithNotifications  # Start in simulation mode

New-AutoSensitivityLabelRule -Policy "Auto-Label SSN" `
    -Name "SSN Detection" `
    -ContentContainsSensitiveInformation @{
        Name = "U.S. Social Security Number (SSN)"
        MinCount = 1
        MaxCount = -1
        MinConfidence = 85
    }

Connect-IPPSSession

# Create DLP policy for SharePoint Online
New-DlpCompliancePolicy -Name "SPO Sensitive Content Protection" `
    -SharePointLocation All `
    -OneDriveLocation All `
    -Mode Enable

# Add rule for credit card detection
New-DlpComplianceRule -Policy "SPO Sensitive Content Protection" `
    -Name "Block Credit Card Sharing" `
    -ContentContainsSensitiveInformation @{
        Name = "Credit Card Number"
        MinCount = 1
        MinConfidence = 85
    } `
    -BlockAccess $true `
    -BlockAccessScope All `
    -NotifyUser "SiteAdmin" `
    -NotifyUserType "NotifyUser" `
    -GenerateAlert SiteAdmin

# Add rule for PII detection (warn but do not block)
New-DlpComplianceRule -Policy "SPO Sensitive Content Protection" `
    -Name "Warn on PII Sharing" `
    -ContentContainsSensitiveInformation @{
        Name = "U.S. Social Security Number (SSN)"
        MinCount = 1
        MinConfidence = 75
    } `
    -NotifyUser "SiteAdmin,LastModifier" `
    -GenerateIncidentReport SiteAdmin

# Conditional Access policies are configured in Entra ID (Azure AD)
# These examples use Microsoft Graph PowerShell

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"

# Require MFA for SPO access from unmanaged devices
$conditions = @{
    Applications = @{
        IncludeApplications = @("00000003-0000-0ff1-ce00-000000000000")  # SharePoint Online
    }
    Users = @{
        IncludeUsers = @("All")
        ExcludeGroups = @("{service-accounts-group-id}")
    }
    ClientAppTypes = @("browser", "mobileAppsAndDesktopClients")
    Devices = @{
        DeviceFilter = @{
            Mode = "include"
            Rule = 'device.isCompliant -ne True'
        }
    }
}

$grantControls = @{
    BuiltInControls = @("mfa")
    Operator = "OR"
}

# Block download from unmanaged devices
$sessionControls = @{
    ApplicationEnforcedRestrictions = @{
        IsEnabled = $true
    }
}

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Block download from unmanaged devices
Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess

# Apply to specific sites
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/confidential" `
    -ConditionalAccessPolicy AllowLimitedAccess

# Audit external sharing activity
$startDate = (Get-Date).AddDays(-30)
$endDate = Get-Date

Search-UnifiedAuditLog -StartDate $startDate -EndDate $endDate `
    -Operations "SharingSet","AnonymousLinkCreated","SecureLinkCreated","AddedToSecureLink" `
    -ResultSize 1000 |
    Select-Object CreationDate, UserIds, Operations,
        @{N="Detail"; E={$_.AuditData | ConvertFrom-Json | Select-Object -ExpandProperty ObjectId}} |
    Export-Csv -Path "C:\Migration\external-sharing-audit.csv" -NoTypeInformation