add Infrastructure pillar changes (#1410)

fixes #1408
changes as per microsoft/ztspecs#942

Author: astaykov

README.md

@@ -17,6 +17,10 @@ Connect-ZtAssessment
 Invoke-ZtAssessment
 ```
 
+## Infrastructure Pillar Scope
+
+Infrastructure pillar results are based on Microsoft Defender for Cloud recommendations and only include Azure subscriptions tagged with `ZeroTrustAssessment:Infrastructure`.
+
 ## Quicklinks
 
 * [aka.ms/zerotrust/assessment](https://aka.ms/zerotrust/assessment) → Microsoft Learn docs page for the assessment (includes install guide).

src/powershell/assets/ReportTemplate.html

@@ -40,6 +40,8 @@
         (microsoft.security/securescores/securescorecontrols
          + microsoft.security/assessments
          + microsoft.security/regulatorycompliancestandards/.../regulatorycomplianceassessments)
+    MDC Query Reference: https://github.com/microsoft/ESA/blob/main/src/MDC.kql
+    MCSB Query Reference: https://github.com/microsoft/ESA/blob/main/src/MCSB.kql
 #>
 
 function Test-Assessment-50001 {
@@ -116,12 +118,49 @@ function Test-Assessment-50001 {
 
     $activity = 'Checking Microsoft Defender for Cloud Recommendations'
 
-    Write-ZtProgress -Activity $activity -Status 'Checking Azure connection'
+    $taggedSubscriptionQuery = @'
+resourcecontainers
+| where type == 'microsoft.resources/subscriptions'
+| where tags['ZeroTrustAssessment'] =~ 'Infrastructure'
+| project subscriptionId, subscriptionName = name
+'@
+
+    Write-ZtProgress -Activity $activity -Status 'Finding subscriptions tagged for Infrastructure scan'
+    $taggedSubscriptions = @()
+    try {
+        $taggedSubscriptions = @(Invoke-ZtAzureResourceGraphRequest -Query $taggedSubscriptionQuery)
+        Write-PSFMessage "Infrastructure tag query returned $($taggedSubscriptions.Count) subscriptions" -Tag Test -Level VeryVerbose
+    }
+    catch {
+        Write-PSFMessage "Infrastructure tag ARG query failed: $($_.Exception.Message)" -Tag Test -Level Warning
+        $httpStatusCode = $null
+        # Invoke-ZtAzureRequestCache throws a string like:
+        # "Azure REST request failed with status 403: ..."
+        # so there is no .Response property. Parse the message instead.
+        if ($_.Exception.Message -match 'with status (\d+):') {
+            $httpStatusCode = [int]$Matches[1]
+        }
+
+        if ($httpStatusCode -in @(401, 403)) {
+            Write-PSFMessage "Infrastructure tag ARG query returned (HTTP $httpStatusCode) — insufficient permissions." -Tag Test -Level Warning
+            Add-ZtTestResultDetail -SkippedBecause NoAzureAccess -Result 'Unable to query tagged subscriptions for Infrastructure scan due to insufficient Azure permissions. Ensure you have Azure Resource Graph read access and the subscriptions are tagged with ZeroTrustAssessment:Infrastructure.'
+            return
+        }
+        Write-PSFMessage "Infrastructure tag ARG query returned (HTTP $httpStatusCode) — unexpected error." -Tag Test -Level Warning
+        Add-ZtTestResultDetail -SkippedBecause NotSupported -Result 'Unable to query tagged subscriptions for Infrastructure scan due to an Azure Resource Graph error. Ensure Azure Resource Graph access is available and subscriptions are tagged with ZeroTrustAssessment:Infrastructure.'
+        return
+    }
+
+    [string[]] $taggedSubscriptionIds = @(
+        $taggedSubscriptions |
+            Select-Object -ExpandProperty subscriptionId |
+            Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+            Sort-Object -Unique
+    )
 
-    $azContext = Get-AzContext -ErrorAction SilentlyContinue
-    if (-not $azContext) {
-        Write-PSFMessage 'Not connected to Azure.' -Level Warning
-        Add-ZtTestResultDetail -SkippedBecause NotConnectedAzure
+    if ($taggedSubscriptionIds.Count -eq 0) {
+        Write-PSFMessage 'No subscriptions found with Infrastructure scan tag.' -Tag Test -Level Verbose
+        Add-ZtTestResultDetail -SkippedBecause NotApplicable -Result 'No subscriptions are tagged for Infrastructure scan. Apply the tag ZeroTrustAssessment:Infrastructure to each subscription that should be included.'
         return
     }
 
@@ -350,7 +389,7 @@ securityresources
     Write-ZtProgress -Activity $activity -Status 'Querying Azure Resource Graph for secure score recommendations'
     $secureScoreRecs = @()
     try {
-        $secureScoreRecs = @(Invoke-ZtAzureResourceGraphRequest -Query $secureScoreQuery)
+        $secureScoreRecs = @(Invoke-ZtAzureResourceGraphRequest -Query $secureScoreQuery -SubscriptionId $taggedSubscriptionIds)
         Write-PSFMessage "Secure Score query returned $($secureScoreRecs.Count) records" -Tag Test -Level VeryVerbose
     }
     catch {
@@ -360,7 +399,7 @@ securityresources
     Write-ZtProgress -Activity $activity -Status 'Querying Azure Resource Graph for MCSB compliance assessments'
     $mcsbRecs = @()
     try {
-        $mcsbRecs = @(Invoke-ZtAzureResourceGraphRequest -Query $mcsbQuery)
+        $mcsbRecs = @(Invoke-ZtAzureResourceGraphRequest -Query $mcsbQuery -SubscriptionId $taggedSubscriptionIds)
         Write-PSFMessage "MCSB query returned $($mcsbRecs.Count) records" -Tag Test -Level VeryVerbose
     }
     catch {

src/powershell/tests/Test-Assessment.50001.ps1

@@ -14,7 +14,7 @@ export default function Infrastructure() {
                 <CardHeader>
                     <CardTitle className="mb-3">Assessment results</CardTitle>
                     <CardDescription>
-                        The results below are based on Microsoft Defender for Cloud recommendations identified in the scanned environment.
+                        The results below are based on Microsoft Defender for Cloud recommendations identified in the scanned environment. You must apply the following tag to each Azure subscription which you want to be included in the scan: ZeroTrustAssessment:Infrastructure.
                     </CardDescription>
                 </CardHeader>
                 <CardContent className="gap-4 px-4 pb-4 pt-1">