AutoAcceptSsoPermission policy for Windows 11, version 24H2 and 25H2 (KB5101650 is required)

Detection-AutoAcceptSsoPermission.ps1

# Check: AutoAcceptSsoPermission policy for Windows 11, version 24H2 and 25H2 (KB5101650 is required)
# Detection-AutoAcceptSsoPermission.ps1

# https://learn.microsoft.com/en-us/entra/identity/devices/sso-admin-control
# https://techcommunity.microsoft.com/blog/windows-itpro-blog/now-available-admin-control-for-sso-prompts-in-windows/4534613

$RegPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\AAD'

try
{
   if (!(Test-Path -LiteralPath $RegPath -ErrorAction SilentlyContinue))
   {
      exit 1
   }

   if (!((Get-ItemPropertyValue -LiteralPath $RegPath -Name 'AutoAcceptSsoPermission' -ErrorAction SilentlyContinue) -eq 1))
   {
      exit 1
   }
}
catch
{
   exit 1
}

exit 0

Remediation-AutoAcceptSsoPermission.ps1

# Remediate: AutoAcceptSsoPermission policy for Windows 11, version 24H2 and 25H2 (KB5101650 is required)
# Remediation-AutoAcceptSsoPermission.ps1

# https://learn.microsoft.com/en-us/entra/identity/devices/sso-admin-control
# https://techcommunity.microsoft.com/blog/windows-itpro-blog/now-available-admin-control-for-sso-prompts-in-windows/4534613

$RegPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\AAD'

if ((Test-Path -LiteralPath $RegPath -ErrorAction SilentlyContinue) -ne $true)
{
   $null = (New-Item -Path $RegPath -Force -Confirm:$false -ErrorAction SilentlyContinue)
}

$paramNewItemProperty = @{
   LiteralPath  = $RegPath
   Name         = 'AutoAcceptSsoPermission'
   Value        = 1
   PropertyType = 'DWord'
   Force        = $true
   Confirm      = $false
   ErrorAction  = 'SilentlyContinue'
}
$null = (New-ItemProperty @paramNewItemProperty)
$paramNewItemProperty = $null