Merge pull request #632 from weyCC81/wey-EntraCa-Major-v1

Update for CA Test - Major Changes (Connect Sync)
maester365 · Feb 13, 2025 · a15cc7f · a15cc7f
2 parents 7e302c1 + ca251ac
commit a15cc7f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/powershell/public/Test-MtCaExclusionForDirectorySyncAccount.ps1 b/powershell/public/Test-MtCaExclusionForDirectorySyncAccount.ps1
@@ -62,6 +62,15 @@ function Test-MtCaExclusionForDirectorySyncAccount {
             continue
         }
 
+        if ( $policy.grantcontrols.builtincontrols -contains 'block' `
+            -and "exchangeActiveSync" -in $policy.conditions.clientAppTypes `
+            -and "other" -in $policy.conditions.clientAppTypes){
+            # Skip this policy, because it just blocks legacy authentication
+            $currentresult = $true
+            Write-Verbose "Skipping $($policy.displayName) legacy auth is not used for sync - $currentresult"
+            continue
+        }
+
         $PolicyIncludesAllUsers = $false
         $PolicyIncludesRole = $false
         $DirectorySynchronizationAccounts | ForEach-Object {

diff --git a/powershell/public/Test-MtCaGap.ps1 b/powershell/public/Test-MtCaGap.ps1
@@ -132,7 +132,11 @@ function Test-MtCaGap {
         $_.Conditions.Users.IncludeUsers | ForEach-Object { $includedUsers.Add($_) | Out-Null }
         $_.Conditions.Users.ExcludeGroups | ForEach-Object { $excludedGroups.Add($_) | Out-Null }
         $_.Conditions.Users.IncludeGroups | ForEach-Object { $includedGroups.Add($_) | Out-Null }
-        $_.Conditions.Users.ExcludeRoles | ForEach-Object { $excludedRoles.Add($_) | Out-Null }
+        If ($_ -ne "d29b2b05-8046-44ba-8758-1e26182fcf32") {
+            # Role: 'Directory Synchronization Accounts' excluded
+            # Policy: 'Multifactor authentication for Microsoft partners and vendors'
+            $_.Conditions.Users.ExcludeRoles | ForEach-Object { $excludedRoles.Add($_) | Out-Null }
+        }
         $_.Conditions.Users.IncludeRoles | ForEach-Object { $includedRoles.Add($_) | Out-Null }
         $_.Conditions.Applications.ExcludeApplications | ForEach-Object { $excludedApplications.Add($_) | Out-Null }
         $_.Conditions.Applications.IncludeApplications | ForEach-Object { $includedApplications.Add($_) | Out-Null }