Network - 27022 - Microsoft 365 traffic is protected end-to-end through Global Secure Access acquisition and compliant network enforcement

code-tests/test-assessments/Test-Assessment.27022.Tests.ps1

@@ -0,0 +1,138 @@
+Describe 'Test-Assessment-27022' {
+    BeforeAll {
+        $here = $PSScriptRoot
+        $srcRoot = Join-Path $here '../../src/powershell'
+        if (-not (Get-Command Write-PSFMessage -ErrorAction SilentlyContinue)) { function global:Write-PSFMessage {} }
+        if (-not (Get-Command Write-ZtProgress -ErrorAction SilentlyContinue)) { function global:Write-ZtProgress {} }
+        if (-not (Get-Command Get-SafeMarkdown -ErrorAction SilentlyContinue)) { function global:Get-SafeMarkdown { param($Text) return $Text } }
+        if (-not (Get-Command Get-ZtTestResultDetail -ErrorAction SilentlyContinue)) { function global:Get-ZtTestResultDetail { param($TestId) } }
+        if (-not (Get-Command Add-ZtTenantInfo -ErrorAction SilentlyContinue)) { function global:Add-ZtTenantInfo { param($Name, $Value) } }
+        if (-not (Get-Command Add-ZtTestResultDetail -ErrorAction SilentlyContinue)) {
+            function global:Add-ZtTestResultDetail { param($TestId, $Status, $Result, $Data, $CustomStatus) }
+        }
+        if (-not ('ZtTest' -as [type])) { . (Join-Path $srcRoot 'classes/ZtTest.ps1') }
+        . (Join-Path $srcRoot 'tests/Test-Assessment.27022.ps1')
+        . (Join-Path $srcRoot 'private/tenantinfo/Add-ZtOverviewM365ProtectionCircuit.ps1')
+    }
+
+    BeforeEach {
+        Mock Write-PSFMessage {}
+        Mock Write-ZtProgress {}
+        Mock Get-SafeMarkdown { param($Text) return $Text }
+        Mock Add-ZtTestResultDetail {}
+    }
+
+    It 'passes when acquisition and enforcement both pass' {
+        Mock Get-ZtTestResultDetail {
+            if ($TestId -eq '25376') { return @{ TestStatus = 'Passed'; TestData = @{ totalDeviceCount = 100; activeDeviceCount = 72; profileEnabled = $true } } }
+            return @{ TestStatus = 'Passed' }
+        }
+
+        Test-Assessment-27022
+
+        Assert-MockCalled Add-ZtTestResultDetail -Scope It -ParameterFilter {
+            $Status -eq $true -and $Result -match 'acquired by Global Secure Access' -and $Data.countsAvailable
+        }
+    }
+
+    It 'fails and explains the dependency when acquisition fails' {
+        Mock Get-ZtTestResultDetail {
+            if ($TestId -eq '25376') { return @{ TestStatus = 'Failed'; TestData = @{ totalDeviceCount = 100; activeDeviceCount = 0; profileEnabled = $false } } }
+            return @{ TestStatus = 'Passed' }
+        }
+
+        Test-Assessment-27022
+
+        Assert-MockCalled Add-ZtTestResultDetail -Scope It -ParameterFilter { $Status -eq $false -and -not $CustomStatus -and $Result -match 'never generated' }
+    }
+
+    It 'fails when enforcement is open after successful acquisition' {
+        Mock Get-ZtTestResultDetail {
+            if ($TestId -eq '25376') { return @{ TestStatus = 'Passed'; TestData = @{ totalDeviceCount = 100; activeDeviceCount = 72; profileEnabled = $true } } }
+            return @{ TestStatus = 'Failed' }
+        }
+
+        Test-Assessment-27022
+
+        Assert-MockCalled Add-ZtTestResultDetail -Scope It -ParameterFilter { $Status -eq $false -and $Result -match 'uncontrolled networks' -and -not $CustomStatus }
+    }
+
+    It 'propagates an investigate result when no stage fails' {
+        Mock Get-ZtTestResultDetail {
+            if ($TestId -eq '25376') { return @{ TestStatus = 'Passed'; TestData = @{ totalDeviceCount = 0; activeDeviceCount = 0; profileEnabled = $true } } }
+            return @{ TestStatus = 'Investigate' }
+        }
+
+        Test-Assessment-27022
+
+        Assert-MockCalled Add-ZtTestResultDetail -Scope It -ParameterFilter { $Status -eq $false -and $CustomStatus -eq 'Investigate' -and -not $Data.countsAvailable }
+    }
+
+    It 'surfaces not-applicable child results as investigate rather than failing' {
+        Mock Get-ZtTestResultDetail {
+            if ($TestId -eq '25376') { return @{ TestStatus = 'Skipped'; TestData = @{ totalDeviceCount = 0; activeDeviceCount = 0; profileEnabled = $false } } }
+            return @{ TestStatus = 'Passed' }
+        }
+
+        Test-Assessment-27022
+
+        Assert-MockCalled Add-ZtTestResultDetail -Scope It -ParameterFilter { $Status -eq $false -and $CustomStatus -eq 'Investigate' }
+    }
+
+    It 'returns investigate rather than pass when a child returns Error' {
+        Mock Get-ZtTestResultDetail {
+            if ($TestId -eq '25376') { return @{ TestStatus = 'Passed'; TestData = @{ totalDeviceCount = 100; activeDeviceCount = 72; profileEnabled = $true } } }
+            return @{ TestStatus = 'Error' }
+        }
+
+        Test-Assessment-27022
+
+        Assert-MockCalled Add-ZtTestResultDetail -Scope It -ParameterFilter { $Status -eq $false -and $CustomStatus -eq 'Investigate' }
+    }
+}
+
+Describe 'Add-ZtOverviewM365ProtectionCircuit' {
+    BeforeEach {
+        Mock Add-ZtTenantInfo {}
+    }
+
+    It 'sizes the acquired and protected bands from active and total device counts' {
+        Mock Get-ZtTestResultDetail {
+            @{ TestData = @{ acquisitionStatus = 'Passed'; enforcementStatus = 'Passed'; countsAvailable = $true; totalDeviceCount = 100; activeDeviceCount = 72; profileEnabled = $true } }
+        }
+
+        Add-ZtOverviewM365ProtectionCircuit
+
+        Assert-MockCalled Add-ZtTenantInfo -Scope It -ParameterFilter {
+            $Name -eq 'OverviewM365ProtectionCircuit' -and
+            ($Value.nodes | Where-Object { $_.target -eq 'Unprotected - not acquired (25376)' }).value -eq 28 -and
+            ($Value.nodes | Where-Object { $_.target -eq 'Enforced - compliant network (25379)' }).value -eq 72
+        }
+    }
+
+    It 'routes the acquired band to the unprotected terminal when enforcement fails' {
+        Mock Get-ZtTestResultDetail {
+            @{ TestData = @{ acquisitionStatus = 'Passed'; enforcementStatus = 'Failed'; countsAvailable = $true; totalDeviceCount = 100; activeDeviceCount = 72; profileEnabled = $true } }
+        }
+
+        Add-ZtOverviewM365ProtectionCircuit
+
+        Assert-MockCalled Add-ZtTenantInfo -Scope It -ParameterFilter {
+            ($Value.nodes | Where-Object { $_.target -eq 'Acquired but not enforced (25379)' }).value -eq 72
+        }
+    }
+
+    It 'uses the normalized all-or-nothing flow when acquisition counts are unavailable' {
+        Mock Get-ZtTestResultDetail {
+            @{ TestData = @{ acquisitionStatus = 'Passed'; enforcementStatus = 'Passed'; countsAvailable = $false; totalDeviceCount = 0; activeDeviceCount = 0; profileEnabled = $true } }
+        }
+
+        Add-ZtOverviewM365ProtectionCircuit
+
+        Assert-MockCalled Add-ZtTenantInfo -Scope It -ParameterFilter {
+            $Value.totalDevices -eq 100 -and
+            ($Value.nodes | Where-Object { $_.target -eq 'Enforced - compliant network (25379)' }).value -eq 100 -and
+            $Value.description -match 'normalized all-or-nothing'
+        }
+    }
+}

src/powershell/classes/ZtTest.ps1

@@ -14,6 +14,7 @@ class ZtTest : System.Attribute
 	[string]$SfiPillar
 	[ValidateSet('Workforce','External')][string[]]$TenantType
 	[int]$TestId
+	[int[]]$DependsOn
 	[string]$Title
 	[ValidateSet('Low','Medium','High')][string]$UserImpact
 

src/powershell/private/core/Add-ZtTestResultDetail.ps1

@@ -93,6 +93,9 @@ function Add-ZtTestResultDetail {
 		[ValidateSet('Investigate','Error')]
 		[string] $CustomStatus,
 
+		# Structured assessment data that other checks or tenant-info providers can consume.
+		[hashtable] $Data,
+
 		[ValidateSet('Graph', 'Azure', 'AipService', 'ExchangeOnline', 'SecurityCompliance', 'SharePointOnline')]
 		[string[]] $NotConnectedService,
 
@@ -232,6 +235,10 @@ function Add-ZtTestResultDetail {
 		SkippedReason          = $SkippedReason
 	}
 
+	if ($Data) {
+		$testInfo.TestData = $Data
+	}
+
 	if ($testMeta.CompatibleLicense) {
 		$testInfo.TestMinimumLicense = $testMeta.CompatibleLicense.ForEach{ ($_ -split '&') -join ' AND ' }
 	}

src/powershell/private/core/Get-ZtTestResultDetail.ps1

@@ -0,0 +1,15 @@
+function Get-ZtTestResultDetail {
+    <#
+    .SYNOPSIS
+        Gets a completed assessment result from the current assessment session.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]
+        [string] $TestId
+    )
+
+    if ($script:__ZtSession -and $script:__ZtSession.TestResultDetail) {
+        return $script:__ZtSession.TestResultDetail.Value[$TestId]
+    }
+}

src/powershell/private/tenantinfo/Add-ZtOverviewM365ProtectionCircuit.ps1

@@ -0,0 +1,56 @@
+function Add-ZtOverviewM365ProtectionCircuit {
+    [CmdletBinding()]
+    param()
+
+    $tenantInfoName = 'OverviewM365ProtectionCircuit'
+    $circuitResult = Get-ZtTestResultDetail -TestId '27022'
+    if (-not $circuitResult -or -not $circuitResult.TestData) {
+        Add-ZtTenantInfo -Name $tenantInfoName -Value $null
+        return
+    }
+
+    $data = $circuitResult.TestData
+    $acquisitionStatus = $data.acquisitionStatus
+    $enforcementStatus = $data.enforcementStatus
+    $countsAvailable = [bool]$data.countsAvailable
+    $total = if ($countsAvailable) { [int]$data.totalDeviceCount } else { 100 }
+    $acquired = if ($countsAvailable) {
+        if ($data.profileEnabled) { [int]$data.activeDeviceCount } else { 0 }
+    }
+    elseif ($acquisitionStatus -eq 'Passed') { 100 } else { 0 }
+
+    $nodes = @()
+    if ($acquisitionStatus -eq 'Passed') {
+        $nodes += @{ source = 'Total M365 traffic'; target = 'Unprotected - not acquired (25376)'; value = $total - $acquired }
+        $nodes += @{ source = 'Total M365 traffic'; target = 'Acquired via Global Secure Access (25376)'; value = $acquired }
+        if ($enforcementStatus -eq 'Passed') {
+            $nodes += @{ source = 'Acquired via Global Secure Access (25376)'; target = 'Enforced - compliant network (25379)'; value = $acquired }
+        }
+        elseif ($enforcementStatus -eq 'Investigate') {
+            $nodes += @{ source = 'Acquired via Global Secure Access (25376)'; target = 'Acquired, enforcement needs review (25379)'; value = $acquired }
+        }
+        elseif ($enforcementStatus -eq 'Skipped') {
+            $nodes += @{ source = 'Acquired via Global Secure Access (25376)'; target = 'Enforcement not applicable (25379)'; value = $acquired }
+        }
+        else {
+            $nodes += @{ source = 'Acquired via Global Secure Access (25376)'; target = 'Acquired but not enforced (25379)'; value = $acquired }
+        }
+    }
+    elseif ($acquisitionStatus -eq 'Investigate') {
+        $nodes += @{ source = 'Total M365 traffic'; target = 'Acquisition needs review (25376)'; value = $total }
+    }
+    elseif ($acquisitionStatus -eq 'Skipped') {
+        $nodes += @{ source = 'Total M365 traffic'; target = 'Acquisition not applicable (25376)'; value = $total }
+    }
+    else {
+        $nodes += @{ source = 'Total M365 traffic'; target = 'Unprotected - not acquired (25376)'; value = $total }
+    }
+
+    $description = if ($countsAvailable) {
+        "Microsoft 365 traffic acquisition is sized from $total observed devices; compliant network enforcement is a tenant-wide gate over the acquired band."
+    }
+    else {
+        'Device counts are unavailable, so this flow uses a normalized all-or-nothing width of 100.'
+    }
+    Add-ZtTenantInfo -Name $tenantInfoName -Value @{ description = $description; nodes = $nodes; totalDevices = $total }
+}

src/powershell/private/tenantinfo/Invoke-ZtTenantInfo.ps1

@@ -35,4 +35,8 @@ function Invoke-ZtTenantInfo {
             Add-ZTDeviceAppProtectionPolicies
         }
     }
+
+    if ($Pillar -in ('All', 'Network')) {
+        Add-ZtOverviewM365ProtectionCircuit
+    }
 }

src/powershell/private/tests/Invoke-ZtTests.ps1

@@ -130,6 +130,9 @@
 		$_.Pillar -contains 'Data' -or
 		@($_.Service).Where({ $_ -in $mainThreadServices })
 	}, 'Split')
+	# Composite tests consume completed child results from the shared assessment session.
+	# Keep them out of worker runspaces and execute them after all parallel children finish.
+	$dependentTests, $parallelTests = $parallelTests.Where({ @($_.DependsOn).Count -gt 0 }, 'Split')
 
 	[dateTime] $startTime = [datetime]::Now
 	$workflow = $null
@@ -148,6 +151,10 @@
 				Add-ZtTestResultDetail -SkippedBecause TimeoutReached -TestId $_
 			}
 		}
+
+		foreach ($test in $dependentTests) {
+			$null = Invoke-ZtTest -Test $test -Database $Database -LogsPath $LogsPath -TestTimeout $TestTimeout
+		}
 	}
 	finally {
 		if ($workflow) {

src/powershell/tests/Test-Assessment.25376.ps1

@@ -221,6 +221,12 @@ function Test-Assessment-25376 {
         Title  = 'Microsoft 365 traffic is actively flowing through Global Secure Access'
         Status = $passed
         Result = $testResultMarkdown
+        Data   = @{
+            totalDeviceCount = $totalDeviceCount
+            activeDeviceCount = $activeDeviceCount
+            totalTransactionCount = $m365TotalCount
+            profileEnabled = $profileEnabled
+        }
     }
 
     Add-ZtTestResultDetail @params

src/powershell/tests/Test-Assessment.27022.md

@@ -0,0 +1,9 @@
+Microsoft 365 traffic is protected only when Global Secure Access acquires the traffic and Conditional Access requires the compliant network signal. Acquisition supplies the Security Service Edge visibility and signal; enforcement makes that signal mandatory before access is granted.
+
+**Remediation action**
+- Enable the Microsoft traffic forwarding profile and deploy the Global Secure Access client to managed devices.
+- Enable Global Secure Access signaling for Conditional Access and configure a compliant network named location.
+- Enable a Conditional Access policy that blocks access from all locations except the compliant network.
+
+<!--- Results --->
+%TestResult%