1414
1515function Test-Assessment-25376 {
1616 [ZtTest (
17- Category = ' Traffic Acquisition ' ,
17+ Category = ' Network security ' ,
1818 ImplementationCost = ' Medium' ,
19- MinimumLicense = ( ' P1 ' , ' E3 ' ) ,
19+ MinimumLicense = ' Entra_Suite ' ,
2020 Pillar = ' Network' ,
2121 RiskLevel = ' High' ,
2222 SfiPillar = ' Protect networks' ,
@@ -39,12 +39,13 @@ function Test-Assessment-25376 {
3939 $startDateTime = $endDateTime.AddDays (-7 )
4040 $startDateTimeStr = $startDateTime.ToString (' yyyy-MM-ddTHH:mm:ssZ' )
4141 $endDateTimeStr = $endDateTime.ToString (' yyyy-MM-ddTHH:mm:ssZ' )
42+ $activityPivotDateTime = $endDateTime.AddDays (-1 )
43+ $activityPivotDateTimeStr = $activityPivotDateTime.ToString (' yyyy-MM-ddTHH:mm:ssZ' )
4244
4345 # Query 3: Verify Microsoft 365 traffic forwarding profile is enabled
4446 $m365Profile = $null
4547 try {
46- $allProfiles = Invoke-ZtGraphRequest - RelativeUri " networkAccess/forwardingProfiles" - ApiVersion beta
47- $m365Profile = $allProfiles | Where-Object { $_.trafficForwardingType -eq ' m365' }
48+ $m365Profile = Invoke-ZtGraphRequest - RelativeUri " networkAccess/forwardingProfiles?`$ filter=trafficForwardingType eq 'm365'" - ApiVersion beta
4849 } catch {
4950 Write-PSFMessage " Unable to retrieve M365 forwarding profile: $_ " - Level Warning
5051 }
@@ -63,7 +64,9 @@ function Test-Assessment-25376 {
6364 # Query 2: Get device usage summary
6465 $deviceUsage = $null
6566 try {
66- $deviceUsage = Invoke-ZtGraphRequest - RelativeUri " networkAccess/reports/getDeviceUsageSummary(startDateTime=$startDateTimeStr ,endDateTime=$endDateTimeStr )" - ApiVersion beta
67+ $deviceUsage = Invoke-ZtGraphRequest `
68+ - RelativeUri " networkAccess/reports/getDeviceUsageSummary(startDateTime=$startDateTimeStr ,endDateTime=$endDateTimeStr ,activityPivotDateTime=$activityPivotDateTimeStr )" `
69+ - ApiVersion beta
6770 } catch {
6871 Write-PSFMessage " Unable to retrieve device usage summary: $_ " - Level Warning
6972 }
@@ -123,7 +126,7 @@ function Test-Assessment-25376 {
123126 $warnings.Add (" No active devices detected despite $totalDeviceCount total devices registered" )
124127 }
125128
126- if ($activeDeviceCount -lt 10 -and $profileEnabled ) {
129+ if ($activeDeviceCount -lt 10 -and $profileEnabled -and $totalDeviceCount -gt 0 ) {
127130 $warnings.Add (" Low active device count ($activeDeviceCount ) - verify client deployment across endpoints" )
128131 }
129132
@@ -183,13 +186,15 @@ function Test-Assessment-25376 {
183186 $mdInfo += " `n "
184187 $mdInfo += " *Evaluation Period: $ ( $startDateTime.ToString (' yyyy-MM-dd' )) to $ ( $endDateTime.ToString (' yyyy-MM-dd' )) *`n`n "
185188
186- # Device Usage Section
187- $mdInfo += " `n ## Device Usage`n`n "
188- $mdInfo += " | Metric | Count |`n "
189- $mdInfo += " | :--- | ---: |`n "
190- $mdInfo += " | Total Devices | $totalDeviceCount |`n "
191- $mdInfo += " | Active Devices | $activeDeviceCount |`n "
192- $mdInfo += " | Inactive Devices | $inactiveDeviceCount |`n`n "
189+ # Device Usage Section (only shown when API returned data)
190+ if ($deviceUsage ) {
191+ $mdInfo += " `n ## Device Usage`n`n "
192+ $mdInfo += " | Metric | Count |`n "
193+ $mdInfo += " | :--- | ---: |`n "
194+ $mdInfo += " | Total Devices | $totalDeviceCount |`n "
195+ $mdInfo += " | Active Devices | $activeDeviceCount |`n "
196+ $mdInfo += " | Inactive Devices | $inactiveDeviceCount |`n`n "
197+ }
193198 }
194199
195200 # Warnings Section
0 commit comments