diff --git a/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json similarity index 100% rename from ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json rename to Config/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json diff --git a/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json b/Config/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json similarity index 100% rename from ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json rename to Config/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json diff --git a/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json b/Config/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json similarity index 100% rename from ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json rename to Config/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json diff --git a/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json similarity index 100% rename from ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json rename to Config/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json diff --git a/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json b/Config/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json similarity index 100% rename from ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json rename to Config/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json diff --git a/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json b/Config/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json similarity index 100% rename from ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json rename to Config/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json diff --git a/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json similarity index 100% rename from ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json rename to Config/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json diff --git a/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json similarity index 100% rename from ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json rename to Config/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json diff --git a/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json b/Config/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json similarity index 100% rename from ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json rename to Config/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json diff --git a/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json similarity index 100% rename from ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json rename to Config/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json diff --git a/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json b/Config/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json similarity index 100% rename from ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json rename to Config/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json diff --git a/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json b/Config/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json similarity index 100% rename from ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json rename to Config/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json diff --git a/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json similarity index 100% rename from ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json rename to Config/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json diff --git a/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json b/Config/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json similarity index 100% rename from ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json rename to Config/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json diff --git a/ConditionalAccess/CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration.json b/Config/ConditionalAccess/CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration.json similarity index 97% rename from ConditionalAccess/CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration.json rename to Config/ConditionalAccess/CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration.json index 2421227..c198556 100644 Binary files a/ConditionalAccess/CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration.json and b/Config/ConditionalAccess/CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration.json differ diff --git a/ConditionalAccess/CA206-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json b/Config/ConditionalAccess/CA206-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json similarity index 100% rename from ConditionalAccess/CA206-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json rename to Config/ConditionalAccess/CA206-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json diff --git a/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json similarity index 100% rename from ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json rename to Config/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json diff --git a/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json b/Config/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json similarity index 100% rename from ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json rename to Config/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json diff --git a/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json b/Config/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json similarity index 100% rename from ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json rename to Config/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json diff --git a/Config/Groups/APP_Microsoft365_E5_Dev.json b/Config/Groups/APP_Microsoft365_E5_Dev.json new file mode 100644 index 0000000..bf159c1 Binary files /dev/null and b/Config/Groups/APP_Microsoft365_E5_Dev.json differ diff --git a/Config/Groups/CA-BreakGlassAccounts - Exclude.json b/Config/Groups/CA-BreakGlassAccounts - Exclude.json new file mode 100644 index 0000000..943a64b Binary files /dev/null and b/Config/Groups/CA-BreakGlassAccounts - Exclude.json differ diff --git a/Config/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..38ea819 Binary files /dev/null and b/Config/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json b/Config/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json new file mode 100644 index 0000000..2496b97 Binary files /dev/null and b/Config/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json differ diff --git a/Config/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json b/Config/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json new file mode 100644 index 0000000..d9c7bca Binary files /dev/null and b/Config/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json differ diff --git a/Config/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json b/Config/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..e0c5b6b Binary files /dev/null and b/Config/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json b/Config/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json new file mode 100644 index 0000000..be17377 Binary files /dev/null and b/Config/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json differ diff --git a/Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json b/Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json new file mode 100644 index 0000000..fd15493 Binary files /dev/null and b/Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json differ diff --git a/Config/Groups/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA - Exclude.json b/Config/Groups/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..389d83d Binary files /dev/null and b/Config/Groups/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..b97f9cd Binary files /dev/null and b/Config/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json b/Config/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json new file mode 100644 index 0000000..35e5687 Binary files /dev/null and b/Config/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json differ diff --git a/Config/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..49ebddc Binary files /dev/null and b/Config/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/Groups/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk - Exclude.json b/Config/Groups/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk - Exclude.json new file mode 100644 index 0000000..52f7d91 Binary files /dev/null and b/Config/Groups/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk - Exclude.json differ diff --git a/Config/Groups/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices - Exclude.json b/Config/Groups/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices - Exclude.json new file mode 100644 index 0000000..5c588d5 Binary files /dev/null and b/Config/Groups/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices - Exclude.json differ diff --git a/Config/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json b/Config/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..1220f8c Binary files /dev/null and b/Config/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/Groups/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms - Exclude.json b/Config/Groups/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms - Exclude.json new file mode 100644 index 0000000..7be6b60 Binary files /dev/null and b/Config/Groups/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms - Exclude.json differ diff --git a/Config/Groups/CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration - Exclude.json b/Config/Groups/CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration - Exclude.json new file mode 100644 index 0000000..f3330dd Binary files /dev/null and b/Config/Groups/CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration - Exclude.json differ diff --git a/Config/Groups/CA206-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json b/Config/Groups/CA206-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json new file mode 100644 index 0000000..31bb2c8 Binary files /dev/null and b/Config/Groups/CA206-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json differ diff --git a/Config/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..96ed5a6 Binary files /dev/null and b/Config/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json b/Config/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json new file mode 100644 index 0000000..390a29c Binary files /dev/null and b/Config/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json differ diff --git a/Config/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json b/Config/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json new file mode 100644 index 0000000..7fd659c Binary files /dev/null and b/Config/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json differ diff --git a/Config/MigrationTable.json b/Config/MigrationTable.json new file mode 100644 index 0000000..5dd7398 Binary files /dev/null and b/Config/MigrationTable.json differ diff --git a/README.md b/README.md index 36f14cc..6c7b15d 100644 --- a/README.md +++ b/README.md @@ -139,11 +139,48 @@ This policy requires MFA for all internal identities, for all cloud applications > Verify the included group(s) and/or add your custom groups which have all internals in it. ### CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk + +This policy blocks all internal users which have a **high risk** (sign-in and user risk) status, to all cloud apps, from all platforms. + +> [!IMPORTANT] +> Verify the included group(s) and/or add your custom groups which have all internals in it. + ### CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices + +This policy sets a Sign-in frequency to a maximum of 12 hours for internals, to all cloud apps, using unmanaged Windows or MacOS devices. + +> [!IMPORTANT] +> Verify the included group(s) and/or add your custom groups which have all internals in it. + ### CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA + +This policy requires MFA for internals when enrolling their devices in Intune. + +> [!IMPORTANT] +> Verify the included group(s) and/or add your custom groups which have all internals in it. + ### CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms + +This policy blocks unknown/unsupported device platforms for internals. + +> [!NOTE] +> Currently only Windows, MacOS, Android and iOS are supported. If (for example) Linux or Windows Phone is allowed you need to modify the policy. + +> [!IMPORTANT] +> Verify the included group(s) and/or add your custom groups which have all internals in it. + ### CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration + +This policy requires secrity information registration for internals only from a managed or compliant device. + +> [!IMPORTANT] +> Verify the included group(s) and/or add your custom groups which have all internals in it. + ### CA206-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ + +> [!IMPORTANT] +> Verify the included group(s) and/or add your custom groups which have all internals in it. + ### CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA ### CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess ### CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency