mmckinnon/IntunePolicies
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: add compliance policies

Browse Source
This commit is contained in:
Matthew McKinnon
2025-03-16 13:55:59 +10:00
parent 4cd0393a38
commit 104b34de50
5 changed files with 157 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
CompliancePolicy.ps1 Normal file
View File

@ -0,0 +1,25 @@
# Connect to Microsoft Graph
Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All", "Organization.Read.All", "Group.ReadWrite.All", "Directory.ReadWrite.All" -NoWelcome
$policies = Get-ChildItem ./policies/compliance
ForEach ($policie in $policies) {
$PolicieName = $policie.name
$JsonData = Get-Content -Path ./policies/compliance/$PolicieName -Raw
$JsonDataUpdated = $JsonData -replace '\$tenantId', $tenantId
$PolicyObject = $JsonDataUpdated | ConvertFrom-Json
try {
$uri = "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies" # Using the beta version
$response = Invoke-MgGraphRequest -Method POST -Uri $uri -Body ($PolicyObject | ConvertTo-Json -Depth 10)
Write-Host "✅ $PolicieName - successfully imported!"
#$response
} catch {
Write-Error "❌ An error occurred while importing the policy: $_"
}
}
# Disconnect from Graph
$null = Disconnect-Graph -ErrorAction SilentlyContinue

43
policies/compliance/Win - Compliance - U - Defender for Endpoint.json Normal file
View File

@ -0,0 +1,43 @@
{
"@odata.type": "#microsoft.graph.windows10CompliancePolicy",
"displayName": "Win - Compliance - U - Defender for Endpoint",
"description": null,
"passwordRequired": false,
"passwordBlockSimple": false,
"passwordRequiredToUnlockFromIdle": false,
"passwordRequiredType": "deviceDefault",
"requireHealthyDeviceReport": false,
"earlyLaunchAntiMalwareDriverEnabled": false,
"bitLockerEnabled": false,
"secureBootEnabled": false,
"codeIntegrityEnabled": false,
"memoryIntegrityEnabled": false,
"kernelDmaProtectionEnabled": false,
"virtualizationBasedSecurityEnabled": false,
"firmwareProtectionEnabled": false,
"storageRequireEncryption": false,
"activeFirewallRequired": false,
"defenderEnabled": true,
"signatureOutOfDate": true,
"rtpEnabled": true,
"antivirusRequired": false,
"antiSpywareRequired": false,
"deviceThreatProtectionEnabled": false,
"deviceThreatProtectionRequiredSecurityLevel": "unavailable",
"configurationManagerComplianceRequired": false,
"tpmRequired": false,
"validOperatingSystemBuildRanges": [],
// Scheduled Actions (MUST be included in the initial policy creation)
"scheduledActionsForRule": [
{
"ruleName": null,
"scheduledActionConfigurations": [
{
"actionType": "block",
"gracePeriodHours": 6
}
]
}
]
}

BIN
policies/compliance/Win - Compliance - U - Device Health.json Normal file
View File

Binary file not shown.

43
policies/compliance/Win - Compliance - U - Device Security.json Normal file
View File

@ -0,0 +1,43 @@
{
"@odata.type": "#microsoft.graph.windows10CompliancePolicy",
"displayName": "Win - Compliance - U - Device Security",
"description": null,
"passwordRequired": false,
"passwordBlockSimple": false,
"passwordRequiredToUnlockFromIdle": false,
"passwordRequiredType": "deviceDefault",
"requireHealthyDeviceReport": false,
"earlyLaunchAntiMalwareDriverEnabled": false,
"bitLockerEnabled": false,
"secureBootEnabled": false,
"codeIntegrityEnabled": false,
"memoryIntegrityEnabled": false,
"kernelDmaProtectionEnabled": false,
"virtualizationBasedSecurityEnabled": false,
"firmwareProtectionEnabled": false,
"storageRequireEncryption": false,
"activeFirewallRequired": true,
"defenderEnabled": false,
"signatureOutOfDate": false,
"rtpEnabled": false,
"antivirusRequired": true,
"antiSpywareRequired": true,
"deviceThreatProtectionEnabled": false,
"deviceThreatProtectionRequiredSecurityLevel": "unavailable",
"configurationManagerComplianceRequired": false,
"tpmRequired": true,
"validOperatingSystemBuildRanges": [],
// Scheduled Actions (MUST be included in the initial policy creation)
"scheduledActionsForRule": [
{
"ruleName": null,
"scheduledActionConfigurations": [
{
"actionType": "block",
"gracePeriodHours": 6
}
]
}
]
}

46
policies/compliance/Win - Compliance - U - Password.json Normal file
View File

@ -0,0 +1,46 @@
{
"@odata.type": "#microsoft.graph.windows10CompliancePolicy",
"displayName": "Win - Compliance - U - Password",
"description": null,
"passwordRequired": true,
"passwordBlockSimple": true,
"passwordRequiredToUnlockFromIdle": false,
"passwordRequiredType": "numeric",
"passwordMinimumLength": 8,
"passwordExpirationDays": null,
"passwordPreviousPasswordBlockCount": null,
"passwordMinimumCharacterSetCount": null,
"passwordMinutesOfInactivityBeforeLock": 15,
"requireHealthyDeviceReport": false,
"earlyLaunchAntiMalwareDriverEnabled": false,
"bitLockerEnabled": false,
"secureBootEnabled": false,
"codeIntegrityEnabled": false,
"memoryIntegrityEnabled": false,
"kernelDmaProtectionEnabled": false,
"virtualizationBasedSecurityEnabled": false,
"firmwareProtectionEnabled": false,
"storageRequireEncryption": false,
"activeFirewallRequired": false,
"defenderEnabled": false,
"signatureOutOfDate": false,
"rtpEnabled": false,
"antivirusRequired": false,
"antiSpywareRequired": false,
"deviceThreatProtectionEnabled": false,
"deviceThreatProtectionRequiredSecurityLevel": "unavailable",
"configurationManagerComplianceRequired": false,
"tpmRequired": false,
"validOperatingSystemBuildRanges": [],
"scheduledActionsForRule": [
{
"ruleName": "PasswordRequired",
"scheduledActionConfigurations": [
{
"actionType": "block",
"gracePeriodHours": 0
}
]
}
]
}