Conditional Access theo Device Compliance

Connect-MgGraph -Scopes "Device.Read.All"

# Xem tất cả thiết bị và trạng thái compliance
Get-MgDevice -All |
  Select-Object DisplayName,
    @{N="JoinType";E={$_.TrustType}},           # AzureAD, ServerAD, Workplace
    @{N="MDM";E={$_.ManagementType}},            # MDM = Intune managed
    @{N="Compliant";E={$_.IsCompliant}},
    @{N="Enabled";E={$_.AccountEnabled}},
    OperatingSystem, OperatingSystemVersion |
  Format-Table -AutoSize

# Chỉ xem device đang Compliant
Get-MgDevice -Filter "isCompliant eq true" |
  Select-Object DisplayName, TrustType, OperatingSystem |
  Format-Table -AutoSize

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"

$groupId = (Get-MgGroup -Filter "DisplayName eq 'GRP-AZ500-PrivilegedAdmins'").Id
$bgId    = (Get-MgUser  -Filter "UserPrincipalName eq '[email protected]'").Id

$params = @{
    displayName = "CA-AZ500-RequireCompliantDevice-AdminPortals"
    state = "enabledForReportingButNotEnforced"   # Report-only
    conditions = @{
        users = @{
            includeGroups = @($groupId)
            excludeUsers  = @($bgId)
        }
        applications = @{
            includeApplications = @(
                "797f4846-ba00-4fd7-ba43-dac1f8f63013",  # Azure Management
                "adminPortals"                            # Microsoft Admin Portals
            )
        }
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @(
            "compliantDevice",          # Intune compliant
            "domainJoinedDevice"        # Hybrid Entra ID joined
        )
    }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params
Write-Host "CA-AZ500-RequireCompliantDevice created (Report-only)"

Connect-MgGraph -Scopes "AuditLog.Read.All"

# Xem sign-in log với CA report-only results cho admin user
$userId = (Get-MgUser -Filter "UserPrincipalName eq '[email protected]'").Id
$since  = (Get-Date).AddHours(-24).ToString("yyyy-MM-ddTHH:mm:ssZ")

Get-MgAuditLogSignIn `
  -Filter "userId eq '$userId' and createdDateTime ge $since" `
  -Top 10 |
  Select-Object CreatedDateTime,
    @{N="App";E={$_.AppDisplayName}},
    @{N="Device";E={$_.DeviceDetail.DisplayName}},
    @{N="DeviceCompliant";E={$_.DeviceDetail.IsCompliant}},
    @{N="CAReportOnly";E={
      ($_.AppliedConditionalAccessPolicies |
        Where-Object { $_.DisplayName -like "*CompliantDevice*" }).Result
    }} |
  Format-Table -AutoSize