New-AADAssessmentRecommendations.ps1
|
<# .SYNOPSIS Produces the Azure AD Assessment recommendations from collected data. .DESCRIPTION This cmdlet reads data collected and generates recommendations accordingly. .EXAMPLE PS C:\> New-AADAssessmentRecommendations Collect and package assessment data from "C:\AzureADAssessment" and generate recommendations in the same folder. .EXAMPLE PS C:\> New-AADAssessmentRecommendations -OutputDirectory "C:\Temp" Collect and package assessment data from "C:\Temp" and generate recommendations in the same folder. #> function New-AADAssessmentRecommendations { [CmdletBinding()] param ( # Specifies a path where extracted data resides (folder) [Parameter(Mandatory = $false)] [string] $Path = (Join-Path $env:SystemDrive 'AzureADAssessment'), # Full path of the directory where the output files will be copied. [Parameter(Mandatory = $false)] [string] $OutputDirectory = (Join-Path $env:SystemDrive 'AzureADAssessment'), [Parameter(Mandatory = $false)] [switch] $SkipExpand = $false, # Path to the spreadsheet with the interview answers [Parameter(Mandatory = $false)] [string] $InterviewSpreadsheetPath ) #Start-AppInsightsRequest $MyInvocation.MyCommand.Name ## Expand extracted data if (-not $SkipExpand) { $Archives = Get-ChildItem -Path $Path | Where-Object {$_.Name -like "AzureADAssessmentData-*.zip" } $ExtractedDirectories = @() foreach($Archive in $Archives) { $OutputDirectoryData = Join-Path $OutputDirectory ([IO.Path]::GetFileNameWithoutExtension($Archive.Name)) Expand-Archive -Path $Archive.FullName -DestinationPath $OutputDirectoryData -Force -ErrorAction Stop $ExtractedDirectories += $OutputDirectoryData } } ## Determine folder contents $TenantDirectoryData = $null $AADCDirecotryData = @() $ADFSDirectoryData = @() $AADAPDirectoryData = @() foreach($Directory in Get-ChildItem -Path $Path -Directory) { Switch -Wildcard ($Directory.Name) { "AzureADAssessmentData-*.onmicrosoft.com" { $TenantDirectoryData = $Directory.FullName } "AzureADAssessmentData-AADC-*" { $AADCDirecotryData += $Directory.FullName } "AzureADAssessmentData-ADFS-*" { $ADFSDirectoryData += $Directory.FullName } "AzureADAssessmentData-AADAP-*" { $AADAPDirectoryData += $Directory.FullName } default { Write-Warning "Unrecognized directory $($Directory.Name)" } } } # Generate recommendations from tenant data if (![String]::IsNullOrWhiteSpace($TenantDirectoryData)) { $data = @{} ### Load all the data on AAD # Load Interview questions if($null -ne $InterviewSpreadsheetPath){ $interviewQna = Get-SpreadsheetJson $InterviewSpreadsheetPath $interviewQnaPath = Join-Path $TenantDirectoryData "QnA.json" $interviewQna | ConvertTo-Json | Out-File $interviewQnaPath $data['QnA.json'] = $interviewQna } # Prepare paths $AssessmentDetailPath = Join-Path $TenantDirectoryData "AzureADAssessment.json" # Read assessment data $AssessmentDetail = Get-Content $AssessmentDetailPath -Raw | ConvertFrom-Json # Generate AAD data path $AADPath = Join-Path $TenantDirectoryData "AAD-$($AssessmentDetail.AssessmentTenantDomain)" <# do not load file before hand but only when necessary $files = get-childitem -Path $AADPath -File foreach($file in $files) { switch -Wildcard ($file.Name) { "*.json" { $data[$file.Name] = get-content -Path $file.FullName | ConvertFrom-Json } "*.csv" { $data[$file.Name] = Import-Csv -Path $file.FullName } "*.xml" { $data[$file.Name] = Import-Clixml -Path $file.FullName } default { Write-Warning "Unsupported data file format: $($file.Name)" } } }#> ### Load configuration file $recommendations = Select-Xml -Path (Join-Path $PSScriptRoot "AADRecommendations.xml") -XPath "/recommendations" $recommendationList = @() $idUniqueCheck = @{} # Hashtable to validate that IDs are unique foreach($recommendationDef in $recommendations.Node.recommendation) { if($idUniqueCheck.ContainsKey($recommendationDef.ID)){ Write-Error "Found duplicate recommendation $($recommendationDef.ID)" } else { $idUniqueCheck.Add($recommendationDef.ID, $recommendationDef.ID) } if(Get-ObjectPropertyValue $recommendationDef 'Sources'){ # make sure necessary files are loaded $fileMissing = $false foreach($fileName in $recommendationDef.Sources.File) { $filePath = Join-Path $AADPath $fileName if (!(Test-Path -Path $filePath)) { Write-Warning "File not found: $filePath" $fileMissing = $true break } if ($fileName -in $data.Keys) { continue } switch -Wildcard ($fileName) { "*.json" { $data[$fileName] = get-content -Path $filePath | ConvertFrom-Json } "*.csv" { $data[$fileName] = Import-Csv -Path $filePath } "*.xml" { $data[$fileName] = Import-Clixml -Path $filePath } default { Write-Warning "Unsupported data file format: $($fileName)" } } } if ($fileMissing) { write-warning "A necessary file is missing" continue } } $recommendation = $recommendationDef | select-object ID,Category,Area,Name,Summary,Recommendation,Priority,Data,SortOrder # Manual checks won't have a PowerShell script to run if(Get-ObjectPropertyValue $recommendationDef 'PowerShell'){ $scriptblock = [Scriptblock]::Create($recommendationDef.PowerShell) $result = Invoke-Command -ScriptBlock $scriptblock -ArgumentList $Data $recommendation.Priority = $result.Priority $recommendation.Data = $result.Data } else { if((Get-ObjectPropertyValue $recommendationDef 'Type') -eq 'QnA'){ Set-TypeQnAResult $data $recommendationDef $recommendation } } Set-SortOrder $recommendation $recommendationList += $recommendation } #Set-Content -Value ($idUniqueCheck.GetEnumerator() | Sort-Object name | Select-Object name) -Path ./log.txt #Write-Output "Total checks: $($idUniqueCheck.Count)" Write-Output "Completed $($recommendationList.Length) checks." Write-Verbose "Writing recommendations" Write-RecommendationsReport $data $recommendationList Write-Verbose "Recommendations written" # generate Trusted network locations #Get-TrustedNetworksRecommendation -Path $TenantDirectoryData } else { Write-Error "No Tenant Data found" } #Complete-AppInsightsRequest $MyInvocation.MyCommand.Name -Success $? } function Set-TypeQnAResult($data, $recommendationDef, $recommendation){ $qnaData = $data['QnA.json'] $qnaReco = Get-ObjectPropertyValue $recommendationDef 'QnA' $namedRange = Get-ObjectPropertyValue $qnaReco 'Name' $userValue = Get-ObjectPropertyValue $qnaData[$namedRange] 'Value' switch ($userValue) { '' { $recommendation.Priority = "Not Answered" } 'Not Applicable' { $recommendation.Priority = "N/A" } Default { foreach($answer in $qnaReco.Answers.Answer){ if($userValue -eq $answer.Value){ $recommendation.Priority = $answer.Priority } } } } } |