Lab 29: Zero Trust Architecture — Implementation & Validation¶

# Connect to Microsoft Graph (synthetic tenant)
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess","Directory.Read.All"

# ============================================================
# Policy 1: Require MFA for All Users — Baseline Policy
# ============================================================
$params = @{
    DisplayName = "ZT-CA-001: Require MFA for All Users"
    State = "enabledForReportingButNotEnforced"  # Start in report-only
    Conditions = @{
        Users = @{
            IncludeUsers = @("All")
            ExcludeUsers = @()
            ExcludeGroups = @("BreakGlass-EmergencyAccess")  # Emergency access accounts
        }
        Applications = @{
            IncludeApplications = @("All")
        }
        ClientAppTypes = @("browser", "mobileAppsAndDesktopClients")
    }
    GrantControls = @{
        Operator = "OR"
        BuiltInControls = @("mfa")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $params

# ============================================================
# Policy 2: Block Legacy Authentication — Kill Insecure Protocols
# ============================================================
$legacyBlockPolicy = @{
    DisplayName = "ZT-CA-002: Block Legacy Authentication"
    State = "enabled"
    Conditions = @{
        Users = @{
            IncludeUsers = @("All")
        }
        Applications = @{
            IncludeApplications = @("All")
        }
        ClientAppTypes = @("exchangeActiveSync", "other")
    }
    GrantControls = @{
        Operator = "OR"
        BuiltInControls = @("block")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $legacyBlockPolicy

# ============================================================
# Policy 3: Risk-Based Conditional Access — Adaptive MFA
# ============================================================
$riskBasedPolicy = @{
    DisplayName = "ZT-CA-003: Risk-Based Access Control"
    State = "enabledForReportingButNotEnforced"
    Conditions = @{
        Users = @{
            IncludeUsers = @("All")
            ExcludeGroups = @("BreakGlass-EmergencyAccess")
        }
        Applications = @{
            IncludeApplications = @("All")
        }
        SignInRiskLevels = @("high", "medium")
        UserRiskLevels = @("high")
    }
    GrantControls = @{
        Operator = "AND"
        BuiltInControls = @("mfa", "passwordChange")
    }
    SessionControls = @{
        SignInFrequency = @{
            Value = 1
            Type = "hours"
            IsEnabled = $true
        }
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $riskBasedPolicy

# ============================================================
# Policy 4: Location-Based Access — Block Untrusted Locations
# ============================================================

# First, create a named location for trusted office networks
$trustedLocation = @{
    "@odata.type" = "#microsoft.graph.ipNamedLocation"
    DisplayName = "Apex-TrustedOffices"
    IsTrusted = $true
    IpRanges = @(
        @{
            "@odata.type" = "#microsoft.graph.iPv4CidrRange"
            CidrAddress = "198.51.100.0/24"   # SYNTHETIC — HQ office
        }
        @{
            "@odata.type" = "#microsoft.graph.iPv4CidrRange"
            CidrAddress = "203.0.113.0/24"    # SYNTHETIC — Branch office
        }
    )
}

New-MgIdentityConditionalAccessNamedLocation -BodyParameter $trustedLocation

# Block access from non-trusted locations for privileged roles
$locationPolicy = @{
    DisplayName = "ZT-CA-004: Block Untrusted Locations for Privileged Roles"
    State = "enabled"
    Conditions = @{
        Users = @{
            IncludeRoles = @(
                "62e90394-69f5-4237-9190-012177145e10"  # Global Administrator
                "194ae4cb-b126-40b2-bd5b-6091b380977d"  # Security Administrator
                "f28a1f50-f6e7-4571-818b-6a12f2af6b6c"  # SharePoint Administrator
            )
        }
        Applications = @{
            IncludeApplications = @("All")
        }
        Locations = @{
            IncludeLocations = @("All")
            ExcludeLocations = @("Apex-TrustedOffices")
        }
    }
    GrantControls = @{
        Operator = "OR"
        BuiltInControls = @("block")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $locationPolicy

# ============================================================
# Policy 5: Require Compliant Device for Sensitive Applications
# ============================================================
$compliantDevicePolicy = @{
    DisplayName = "ZT-CA-005: Require Compliant Device for Finance Apps"
    State = "enabledForReportingButNotEnforced"
    Conditions = @{
        Users = @{
            IncludeGroups = @("Finance-Department", "Executive-Team")
        }
        Applications = @{
            IncludeApplications = @(
                "00000003-0000-0ff1-ce00-000000000000"  # SharePoint Online
                "00000002-0000-0ff1-ce00-000000000000"  # Exchange Online
            )
        }
        Platforms = @{
            IncludePlatforms = @("all")
        }
    }
    GrantControls = @{
        Operator = "AND"
        BuiltInControls = @("mfa", "compliantDevice")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $compliantDevicePolicy

# ============================================================
# Enumerate all Conditional Access policies and their states
# ============================================================
$allPolicies = Get-MgIdentityConditionalAccessPolicy -All | Sort-Object DisplayName

$allPolicies | ForEach-Object {
    [PSCustomObject]@{
        Name        = $_.DisplayName
        State       = $_.State
        GrantAction = ($_.GrantControls.BuiltInControls -join ", ")
        UserScope   = if ($_.Conditions.Users.IncludeUsers -contains "All") { "All Users" }
                      elseif ($_.Conditions.Users.IncludeGroups) { "Groups: $($_.Conditions.Users.IncludeGroups -join ', ')" }
                      elseif ($_.Conditions.Users.IncludeRoles) { "Roles: $($_.Conditions.Users.IncludeRoles.Count) roles" }
                      else { "Custom" }
        AppScope    = if ($_.Conditions.Applications.IncludeApplications -contains "All") { "All Apps" }
                      else { "Specific Apps: $($_.Conditions.Applications.IncludeApplications.Count)" }
    }
} | Format-Table -AutoSize

# ============================================================
# Test policy evaluation with What-If analysis
# ============================================================
# Simulate: testuser accessing Exchange Online from untrusted location
$whatIfParams = @{
    ConditionalAccessWhatIfConditions = @{
        UserPrincipalName = "testuser@apex.example.com"
        CloudAppId = "00000002-0000-0ff1-ce00-000000000000"  # Exchange Online
        IpAddress = "192.0.2.200"  # SYNTHETIC — untrusted IP
        ClientAppType = "browser"
        DevicePlatform = "windows"
        SignInRiskLevel = "low"
        UserRiskLevel = "none"
        DeviceInfo = @{
            IsCompliant = $false
            TrustType = "AzureAd"
        }
    }
}

# Invoke What-If evaluation
$whatIfResult = Invoke-MgGraphRequest -Method POST `
    -Uri "https://graph.microsoft.com/beta/identity/conditionalAccess/evaluate" `
    -Body $whatIfParams

# Display results
$whatIfResult.appliedPolicies | ForEach-Object {
    Write-Host "Policy: $($_.displayName)" -ForegroundColor Yellow
    Write-Host "  Result: $($_.result)" -ForegroundColor $(if ($_.result -eq "block") { "Red" } else { "Green" })
    Write-Host "  Reasons: $($_.reasons -join ', ')"
    Write-Host ""
}

# ============================================================
# Scenario A: Attempt authentication without MFA
# ============================================================

# Simulate ROPC (Resource Owner Password Credential) flow
# This is a legacy flow that may bypass MFA if not properly blocked
$tokenEndpoint = "https://login.apex.example.com/oauth2/v2.0/token"

$ropcBody = @{
    grant_type    = "password"
    client_id     = "00000000-0000-0000-0000-000000000001"   # SYNTHETIC
    username      = "testuser@apex.example.com"               # SYNTHETIC
    password      = "REDACTED"
    scope         = "https://graph.example.com/.default"
}

# Expected: This should be BLOCKED by ZT-CA-002 (legacy auth block)
try {
    $response = Invoke-RestMethod -Method POST -Uri $tokenEndpoint -Body $ropcBody
    Write-Warning "FINDING: ROPC flow succeeded — legacy auth NOT blocked!"
    Write-Host "Token acquired without MFA — Zero Trust violation detected"
} catch {
    Write-Host "SUCCESS: ROPC flow blocked as expected" -ForegroundColor Green
    Write-Host "Error: $($_.Exception.Message)"
}

# ============================================================
# Scenario B: Test MFA enforcement for interactive sign-in
# ============================================================

# Simulate OAuth2 Authorization Code flow (interactive)
$authUrl = "https://login.apex.example.com/oauth2/v2.0/authorize?" +
    "client_id=00000000-0000-0000-0000-000000000001" +
    "&response_type=code" +
    "&redirect_uri=https://app.apex.example.com/callback" +
    "&scope=openid profile email" +
    "&state=$(New-Guid)" +
    "&prompt=login"

Write-Host "Authorization URL (inspect redirect for MFA challenge):"
Write-Host $authUrl

# Expected behavior:
# 1. User authenticates with username/password
# 2. Conditional Access evaluates → triggers MFA challenge
# 3. User completes MFA (phone/authenticator app)
# 4. Authorization code returned only after MFA completion

# ============================================================
# Windows 10/11 Device Compliance Policy
# ============================================================
$compliancePolicy = @{
    "@odata.type" = "#microsoft.graph.windows10CompliancePolicy"
    displayName = "ZT-DEVICE-001: Windows Endpoint Compliance"
    description = "Zero trust device compliance baseline for Windows endpoints"
    scheduledActionsForRule = @(
        @{
            ruleName = "PasswordRequired"
            scheduledActionConfigurations = @(
                @{
                    actionType = "block"
                    gracePeriodHours = 0
                    notificationTemplateId = ""
                }
            )
        }
    )
    # Password requirements
    passwordRequired = $true
    passwordMinimumLength = 14
    passwordRequiredType = "alphanumeric"
    passwordMinutesOfInactivityBeforeLock = 5
    passwordExpirationDays = 90
    passwordPreviousPasswordBlockCount = 12

    # Device security
    secureBootEnabled = $true
    codeIntegrityEnabled = $true
    bitLockerEnabled = $true
    tpmRequired = $true

    # OS version
    osMinimumVersion = "10.0.19045.0"

    # Defender requirements
    defenderEnabled = $true
    defenderVersion = ""
    signatureOutOfDate = $false
    rtpEnabled = $true  # Real-time protection

    # Firewall
    firewallEnabled = $true

    # Device health attestation
    deviceThreatProtectionEnabled = $true
    deviceThreatProtectionRequiredSecurityLevel = "secured"
}

# Create the compliance policy via Graph API
Invoke-MgGraphRequest -Method POST `
    -Uri "https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies" `
    -Body ($compliancePolicy | ConvertTo-Json -Depth 10)

# ============================================================
# Configure certificate-based authentication for device trust
# ============================================================

# Step 2a: Create a certificate authority configuration
$certAuthConfig = @{
    "@odata.type" = "#microsoft.graph.certificateBasedAuthConfiguration"
    certificateAuthorities = @(
        @{
            isRootAuthority = $true
            certificate = "MIIEYzCCA0ugAwIBAgIQAYL4..."  # SYNTHETIC — Base64 root CA cert
            issuer = "CN=Apex-Root-CA, O=Apex Financial Services, C=US"
            issuerSki = "A1B2C3D4E5F6..."  # SYNTHETIC
        }
        @{
            isRootAuthority = $false
            certificate = "MIIEczCCA1ugAwIBAgIQBZM5..."  # SYNTHETIC — Base64 issuing CA cert
            issuer = "CN=Apex-Issuing-CA, O=Apex Financial Services, C=US"
            issuerSki = "F6E5D4C3B2A1..."  # SYNTHETIC
        }
    )
}

# Upload CA certificates to Azure AD
Invoke-MgGraphRequest -Method POST `
    -Uri "https://graph.microsoft.com/v1.0/organization/{tenant-id}/certificateBasedAuthConfiguration" `
    -Body ($certAuthConfig | ConvertTo-Json -Depth 10)

# Step 2b: Map certificate fields to user attributes
# Configure certificate user mapping
$certUserMapping = @{
    x509CertificateAuthenticationModeConfiguration = @{
        x509CertificateAuthenticationDefaultMode = "x509CertificateSingleFactor"
        rules = @(
            @{
                x509CertificateRuleType = "issuerSubject"
                identifier = "CN=Apex-Issuing-CA"
                x509CertificateAuthenticationMode = "x509CertificateMultiFactor"
            }
        )
    }
    certificateUserBindings = @(
        @{
            x509CertificateField = "PrincipalName"
            userProperty = "onPremisesUserPrincipalName"
            priority = 1
        }
        @{
            x509CertificateField = "RFC822Name"
            userProperty = "userPrincipalName"
            priority = 2
        }
    )
}

# ============================================================
# Query device compliance state from Intune/Endpoint Manager
# ============================================================

# Get all managed devices and their compliance state
$devices = Get-MgDeviceManagementManagedDevice -All `
    -Filter "operatingSystem eq 'Windows'" `
    -Select "deviceName,complianceState,lastSyncDateTime,
    osVersion,isEncrypted,managedDeviceOwnerType"

# Identify non-compliant devices
$nonCompliantDevices = $devices | Where-Object {
    $_.ComplianceState -ne "compliant"
}

Write-Host "`n=== NON-COMPLIANT DEVICE REPORT ===" -ForegroundColor Red
Write-Host "Total Managed Devices: $($devices.Count)"
Write-Host "Non-Compliant: $($nonCompliantDevices.Count)"
Write-Host "Compliance Rate: $([math]::Round((($devices.Count - $nonCompliantDevices.Count) / $devices.Count) * 100, 1))%"
Write-Host ""

$nonCompliantDevices | ForEach-Object {
    Write-Host "Device: $($_.DeviceName)" -ForegroundColor Yellow
    Write-Host "  OS Version: $($_.OsVersion)"
    Write-Host "  Last Sync: $($_.LastSyncDateTime)"
    Write-Host "  Encrypted: $($_.IsEncrypted)"
    Write-Host "  Compliance: $($_.ComplianceState)"
    Write-Host ""
}

# ============================================================
# Device Health Attestation — Verify TPM and Secure Boot
# ============================================================

# Query Windows Security Health Attestation
$healthReport = @{
    DeviceName    = "APEX-WS-1042"          # SYNTHETIC
    SerialNumber  = "SN-APEX-2026-1042"     # SYNTHETIC
    TPMVersion    = "2.0"
    SecureBoot    = $true
    BitLocker     = $true
    CodeIntegrity = $true
    ELAM          = $true   # Early Launch Anti-Malware
    VSM           = $true   # Virtual Secure Mode
    BootDebugging = $false  # Should be false in production
    OSKernelDebugging = $false
    TestSigning   = $false
}

# Validate health attestation
function Test-DeviceHealthAttestation {
    param([hashtable]$Report)

    $failures = @()

    if (-not $Report.SecureBoot) { $failures += "SecureBoot disabled" }
    if (-not $Report.BitLocker) { $failures += "BitLocker not enabled" }
    if (-not $Report.CodeIntegrity) { $failures += "Code Integrity disabled" }
    if (-not $Report.ELAM) { $failures += "Early Launch Anti-Malware not present" }
    if ($Report.BootDebugging) { $failures += "Boot debugging enabled (suspicious)" }
    if ($Report.OSKernelDebugging) { $failures += "Kernel debugging enabled (suspicious)" }
    if ($Report.TestSigning) { $failures += "Test signing enabled (suspicious)" }
    if ($Report.TPMVersion -lt "2.0") { $failures += "TPM version below 2.0" }

    if ($failures.Count -eq 0) {
        Write-Host "DEVICE HEALTH: PASSED" -ForegroundColor Green
        return $true
    } else {
        Write-Host "DEVICE HEALTH: FAILED" -ForegroundColor Red
        $failures | ForEach-Object { Write-Host "  FAIL: $_" -ForegroundColor Red }
        return $false
    }
}

Test-DeviceHealthAttestation -Report $healthReport

# ============================================================
# Windows Host-Based Firewall Microsegmentation
# For non-containerized environments
# ============================================================

# Define application segments
$segments = @{
    "WebTier" = @{
        Servers = @("10.10.10.10", "10.10.10.11")  # SYNTHETIC
        AllowedInbound = @{
            Source = @("198.51.100.0/24")  # SYNTHETIC — Load balancer
            Ports = @(443)
        }
        AllowedOutbound = @{
            Destination = @("10.10.20.10", "10.10.20.11")  # API tier
            Ports = @(8443)
        }
    }
    "ApiTier" = @{
        Servers = @("10.10.20.10", "10.10.20.11")  # SYNTHETIC
        AllowedInbound = @{
            Source = @("10.10.10.10", "10.10.10.11")  # Web tier only
            Ports = @(8443)
        }
        AllowedOutbound = @{
            Destination = @("10.10.30.10")  # Database tier
            Ports = @(5432)
        }
    }
    "DatabaseTier" = @{
        Servers = @("10.10.30.10")  # SYNTHETIC
        AllowedInbound = @{
            Source = @("10.10.20.10", "10.10.20.11")  # API tier only
            Ports = @(5432)
        }
        AllowedOutbound = @{
            Destination = @()  # NO outbound allowed
            Ports = @()
        }
    }
}

# Create firewall rules for each segment
foreach ($segmentName in $segments.Keys) {
    $segment = $segments[$segmentName]

    # Block all inbound by default
    New-NetFirewallRule -DisplayName "ZT-$segmentName-DenyAllInbound" `
        -Direction Inbound -Action Block -Profile Any `
        -Enabled True -Description "Zero Trust: Default deny inbound for $segmentName"

    # Allow specific inbound
    if ($segment.AllowedInbound.Ports.Count -gt 0) {
        New-NetFirewallRule -DisplayName "ZT-$segmentName-AllowInbound" `
            -Direction Inbound -Action Allow -Profile Any `
            -RemoteAddress $segment.AllowedInbound.Source `
            -LocalPort $segment.AllowedInbound.Ports `
            -Protocol TCP `
            -Enabled True `
            -Description "Zero Trust: Allowed inbound for $segmentName"
    }

    # Block all outbound by default
    New-NetFirewallRule -DisplayName "ZT-$segmentName-DenyAllOutbound" `
        -Direction Outbound -Action Block -Profile Any `
        -Enabled True -Description "Zero Trust: Default deny outbound for $segmentName"

    # Allow specific outbound
    if ($segment.AllowedOutbound.Ports.Count -gt 0) {
        New-NetFirewallRule -DisplayName "ZT-$segmentName-AllowOutbound" `
            -Direction Outbound -Action Allow -Profile Any `
            -RemoteAddress $segment.AllowedOutbound.Destination `
            -RemotePort $segment.AllowedOutbound.Ports `
            -Protocol TCP `
            -Enabled True `
            -Description "Zero Trust: Allowed outbound for $segmentName"
    }

    Write-Host "Segment '$segmentName' configured: $($segment.AllowedInbound.Ports.Count) inbound rules, $($segment.AllowedOutbound.Ports.Count) outbound rules" -ForegroundColor Green
}