|
| 1 | +<# |
| 2 | +.SYNOPSIS |
| 3 | + Builds the Private Access Zero Trust posture funnel (spec 27021). |
| 4 | +
|
| 5 | +.DESCRIPTION |
| 6 | + Aggregates the per-item rows published by the segmentation (25395), authentication (25396) |
| 7 | + and administration (25384) checks into a Sankey funnel. |
| 8 | +
|
| 9 | + Every Private Access application enters at the source node and flows through two sequential |
| 10 | + gates. Segmentation and authentication share the application denominator and are joined on |
| 11 | + App ID, so only apps that clear segmentation are partitioned by the authentication gate. |
| 12 | + Administration is denominated in role assignments, not applications, so it is rendered as a |
| 13 | + separate band. |
| 14 | +#> |
| 15 | + |
| 16 | +function Add-ZtOverviewPrivateAccess { |
| 17 | + [CmdletBinding()] |
| 18 | + param() |
| 19 | + |
| 20 | + $tenantInfoName = 'OverviewPrivateAccess' |
| 21 | + |
| 22 | + $activity = 'Building Private Access Zero Trust posture' |
| 23 | + Write-ZtProgress -Activity $activity -Status 'Processing' |
| 24 | + |
| 25 | + $segmentation = @(Get-ZtTestData -Name 'PrivateAccessSegmentation') |
| 26 | + $authentication = @(Get-ZtTestData -Name 'PrivateAccessAuthentication') |
| 27 | + $administration = Get-ZtTestData -Name 'PrivateAccessAdministration' |
| 28 | + |
| 29 | + if ($segmentation.Count -eq 0 -and $authentication.Count -eq 0 -and $null -eq $administration) { |
| 30 | + Write-PSFMessage '🟦 Skipping: No Private Access check results available' -Tag Test -Level VeryVerbose |
| 31 | + Add-ZtTenantInfo -Name $tenantInfoName -Value $null |
| 32 | + return |
| 33 | + } |
| 34 | + |
| 35 | + # Gate 1 - partition every Private Access app by its segmentation status |
| 36 | + $broadSegments = @($segmentation | Where-Object { $_.Status -eq 'Fail' }).Count |
| 37 | + $segmentationReview = @($segmentation | Where-Object { $_.Status -eq 'ManualReview' }).Count |
| 38 | + $leastPrivilegeApps = @($segmentation | Where-Object { $_.Status -eq 'Pass' }) |
| 39 | + |
| 40 | + # Gate 2 - partition only the segmentation-clean apps, joined to the auth gate on App ID |
| 41 | + $authByAppId = @{} |
| 42 | + foreach ($row in $authentication) { |
| 43 | + if ($row.AppId) { $authByAppId[[string]$row.AppId] = $row.Status } |
| 44 | + } |
| 45 | + |
| 46 | + $passwordOnly = 0 |
| 47 | + $authenticationReview = 0 |
| 48 | + $strongAuth = 0 |
| 49 | + foreach ($app in $leastPrivilegeApps) { |
| 50 | + switch ($authByAppId[[string]$app.AppId]) { |
| 51 | + 'Pass' { $strongAuth++ } |
| 52 | + 'Fail' { $passwordOnly++ } |
| 53 | + # An app with no matching authentication row was not evaluated by 25396 |
| 54 | + default { $authenticationReview++ } |
| 55 | + } |
| 56 | + } |
| 57 | + |
| 58 | + # Gate 3 - separate band denominated in Application Administrator assignments |
| 59 | + $tenantWideAdmin = ($administration.TenantWide -as [int]) ?? 0 |
| 60 | + $scopedAdmin = ($administration.Scoped -as [int]) ?? 0 |
| 61 | + |
| 62 | + $nodes = @( |
| 63 | + @{ source = 'Private Access apps'; target = 'Broad segments - at-risk'; value = $broadSegments } |
| 64 | + @{ source = 'Private Access apps'; target = 'Segmentation manual review'; value = $segmentationReview } |
| 65 | + @{ source = 'Private Access apps'; target = 'Least-privilege segments'; value = $leastPrivilegeApps.Count } |
| 66 | + @{ source = 'Least-privilege segments'; target = 'Password-only - at-risk'; value = $passwordOnly } |
| 67 | + @{ source = 'Least-privilege segments'; target = 'Authentication manual review'; value = $authenticationReview } |
| 68 | + @{ source = 'Least-privilege segments'; target = 'Strong auth - Zero Trust'; value = $strongAuth } |
| 69 | + @{ source = 'Application Administrator assignments'; target = 'Tenant-wide admin - at-risk'; value = $tenantWideAdmin } |
| 70 | + @{ source = 'Application Administrator assignments'; target = 'App-scoped admin - Zero Trust'; value = $scopedAdmin } |
| 71 | + ) |
| 72 | + |
| 73 | + $summary = @{ |
| 74 | + description = "$($segmentation.Count) Private Access application(s) evaluated. $strongAuth reached the Zero Trust set by clearing both least-privilege segmentation and strong authentication." |
| 75 | + nodes = $nodes |
| 76 | + # A tenant-wide Application Administrator can rewrite segments and authentication for every app |
| 77 | + adminAtRisk = $tenantWideAdmin -gt 0 |
| 78 | + # The two gates disagree on the app population, so unmatched apps need review |
| 79 | + populationMismatch = ($segmentation.Count -ne $authentication.Count) |
| 80 | + } |
| 81 | + |
| 82 | + Add-ZtTenantInfo -Name $tenantInfoName -Value $summary |
| 83 | +} |
0 commit comments