Made hybrid join optional in filter. Fix for #433

maester365 · Sep 9, 2024 · b98ba31 · b98ba31
1 parent 4fc136d
commit b98ba31
Show file tree

Hide file tree

Showing 2 changed files with 91 additions and 4 deletions.
diff --git a/powershell/public/Test-MtCaEnforceNonPersistentBrowserSession.ps1 b/powershell/public/Test-MtCaEnforceNonPersistentBrowserSession.ps1
@@ -41,13 +41,15 @@ See [Require reauthentication and disable browser persistence - Microsoft Learn]
         if (-not $AllDevices.IsPresent) {
             # Check if device filter for compliant or hybrid Azure AD joined devices is present
             if ( $policy.conditions.devices.deviceFilter.mode -eq "include" `
-                    -and $policy.conditions.devices.deviceFilter.rule -match 'device.trustType -ne \"ServerAD\"' `
-                    -and $policy.conditions.devices.deviceFilter.rule -match 'device.isCompliant -ne True' `
+                    -and (($policy.conditions.devices.deviceFilter.rule -match 'device.trustType -ne \"ServerAD\"' `
+                    -and $policy.conditions.devices.deviceFilter.rule -match 'device.isCompliant -ne True') `
+                    -or $policy.conditions.devices.deviceFilter.rule -match 'device.isCompliant -ne True') `
             ) {
                 $IsDeviceFilterPresent = $true
             } elseif ( $policy.conditions.devices.deviceFilter.mode -eq "exclude" `
-                    -and $policy.conditions.devices.deviceFilter.rule -match 'device.trustType -eq \"ServerAD\"' `
-                    -and $policy.conditions.devices.deviceFilter.rule -match 'device.isCompliant -eq True' `
+                    -and (($policy.conditions.devices.deviceFilter.rule -match 'device.trustType -eq \"ServerAD\"' `
+                    -and $policy.conditions.devices.deviceFilter.rule -match 'device.isCompliant -eq True') `
+                    -or $policy.conditions.devices.deviceFilter.rule -match 'device.isCompliant -eq True') `
             ) {
                 $IsDeviceFilterPresent = $true
             } else {

diff --git a/powershell/tests/functions/Test-MtCaEnforceNonPersistentBrowserSession.Tests.ps1 b/powershell/tests/functions/Test-MtCaEnforceNonPersistentBrowserSession.Tests.ps1
@@ -0,0 +1,85 @@
+
+Describe 'Test-MtCaEnforceNonPersistentBrowserSession' {
+    BeforeAll {
+        Mock -ModuleName Maester Get-MtLicenseInformation { return "P1" }
+
+        function Get-BaselinePolicy {
+            return [PSCustomObject]@{
+                state = "enabled"
+                conditions = @{
+                    users = @{
+                        includeUsers = "All"
+                    }
+                    applications = @{
+                        includeApplications = "All"
+                    }
+                    devices = @{
+                        deviceFilter = @{
+                            mode = "include"
+                            rule = 'device.trustType -ne "ServerAD" -or device.isCompliant -ne True'
+                        }
+                    }
+                }
+                sessionControls = @{
+                    persistentBrowser = @{
+                        isEnabled = $true
+                        mode = "never"
+                    }
+                }
+            }
+        }
+    }
+
+    Context "CA: Enforce non persistent browser session" {
+
+        It 'Policy without non persistent browser session should fail' {
+            $policy = Get-BaselinePolicy
+            $policy.sessionControls.persistentBrowser.isEnabled = $false
+
+            Mock -ModuleName Maester Get-MtConditionalAccessPolicy { return $policy }
+
+            Test-MtCaEnforceNonPersistentBrowserSession | Should -BeFalse
+        }
+
+        It 'Include: Non Hybrid or Non-compliant device filter should Pass' {
+            $policy = Get-BaselinePolicy
+            $policy.conditions.devices.deviceFilter.mode = "include"
+            $policy.conditions.devices.deviceFilter.rule = 'device.trustType -ne "ServerAD" -or device.isCompliant -ne True'
+            Mock -ModuleName Maester Get-MtConditionalAccessPolicy { return $policy }
+
+            Test-MtCaEnforceNonPersistentBrowserSession | Should -BeTrue
+        }
+
+        It 'Include: Non Compliant device filter (no-hybrid) should Pass' {
+            # Should work with CA policies that only check for compliant devices
+            # See https://github.com/maester365/maester/issues/433
+            $policy = Get-BaselinePolicy
+            $policy.conditions.devices.deviceFilter.mode = "include"
+            $policy.conditions.devices.deviceFilter.rule = 'device.isCompliant -ne True'
+            Mock -ModuleName Maester Get-MtConditionalAccessPolicy { return $policy }
+
+            Test-MtCaEnforceNonPersistentBrowserSession | Should -BeTrue
+        }
+
+        It 'Exclude: Hybrid or compliant device filter should Pass' {
+            $policy = Get-BaselinePolicy
+            $policy.conditions.devices.deviceFilter.mode = "exclude"
+            $policy.conditions.devices.deviceFilter.rule = 'device.trustType -eq "ServerAD" -or device.isCompliant -eq True'
+            Mock -ModuleName Maester Get-MtConditionalAccessPolicy { return $policy }
+
+            Test-MtCaEnforceNonPersistentBrowserSession | Should -BeTrue
+        }
+
+        It 'Exclude: Compliant device filter (no-hybrid) should Pass' {
+            # Should work with CA policies that only check for compliant devices
+            # See https://github.com/maester365/maester/issues/433
+            $policy = Get-BaselinePolicy
+            $policy.conditions.devices.deviceFilter.mode = "exclude"
+            $policy.conditions.devices.deviceFilter.rule = 'device.isCompliant -eq True'
+            Mock -ModuleName Maester Get-MtConditionalAccessPolicy { return $policy }
+
+            Test-MtCaEnforceNonPersistentBrowserSession | Should -BeTrue
+        }
+    }
+}
+