poiriersimon

$MailboxDatabase = Get-mailboxDatabase | where {$_.Recovery -eq $False}
$EmptyDBs = @()
foreach($DB in $MailboxDatabase){
    $Mailboxes = $DB | Get-Mailbox | select Identity -first 1
    if($Mailboxes -eq $NULL){
        $EmptyDB = New-Object PSObject
        $EmptyDB | Add-Member NoteProperty -Name "Name" -Value $DB.Name
        $EmptyDB | Add-Member NoteProperty -Name "EDBPath" -Value $DB.EdbFilePath
        $EmptyDB | Add-Member NoteProperty -Name "LogPath" -Value $DB.LogFolderPath
        $EmptyDB | Add-Member NoteProperty -Name "Servers" -Value $($DB.Servers -join ',')

poiriersimon

<#
.SYNOPSIS
  Extract Shared Mailbox Full Access to give a full list of users

.DESCRIPTION
  Extract Shared Mailbox Full Access to give a full list of users

.PARAMETER SharedMailbox
  Name of the Shared Mailbox to gather data from

poiriersimon

$IpsToCheck = @("40.107.67.0","104.47.612.0","52.100.146.0","40.107.0.0","104.47.0.0","52.100.0.0")
$domain = "spf.protection.outlook.com"
#A better approach would be to validate if the domain is user in a primary email address
$IpMissing = @()
foreach($IpToCheck in $IpsToCheck){
    $DNS = Resolve-DnsName -Type TXT -Name $domain |where{$_.Strings -like "*v=spf1*"}
    if($DNS.strings -like "*$($IpToCheck)*"){ $DNS.strings
    }elseif($DNS.strings -like "*include:*"){
        foreach($include in $($dns.Strings.split(" ")| where {$_ -like "include:*"})){
            $tDns = Resolve-DnsName -Type TXT -Name $($include.split(":")[-1])

poiriersimon

Function Get-DistributionGroupExpandedMember { 
    Param( 
            [Parameter(Mandatory=$True,ValueFromPipeline=$True)][String] $Identity 
        ) 
    BEGIN{ 
         
    } 
    PROCESS { 
        $ExpandedDLList = @() 
        [array]$DL = Get-DistributionGroupMember $Identity 

poiriersimon

$AcceptedDomains=Get-AcceptedDomain |where {$_.DomainName -notlike "*.mail.onmicrosoft.com"}
#A better approach would be to validate if the domain is user in a primary email address
$DomainWithoutSPF = @()
foreach($AcceptedDomain in $AcceptedDomains){
    $DNS = Resolve-DnsName -Type TXT -Name $AcceptedDomain.DomainName |where{$_.Strings -like "*v=spf1*"}
    if($DNS.strings -like "*include:spf.protection.outlook.com*"){Return
    }elseif($DNS.strings -like "*include:*"){
        foreach($include in $($dns.Strings.split(" ")| where {$_ -like "include:*"})){
            $tDns = Resolve-DnsName -Type TXT -Name $($include.split(":")[-1])
            if($tDNS.strings -like "*include:spf.protection.outlook.com*"){Return}

poiriersimon

#1 - List Managed Domain
$ManagedDomain = Get-MSOLDomain |where {$_.AuthenticationType -eq "Managed"}
#2 - Check if 1 users exist in those domain
$UsedManagedDomains = @()
foreach ($ManagedDomain in $ManagedDomains){$Users = @(); $users= Get-MSOLUser -All | where {$_.UserPrincipalName -like "*$($ManagedDomain.name)"}}
#3 - for each of those domain - Get-MSOLUser | where{$_.PasswordNeverExpire -eq $TRUE}
[array]$UnsafeUsers = $Users |  where {$_.PasswordNeverExpires -eq $True -and StrongPasswordRequired -eq $False}
#4 - if any Trigger
If($UnsafeUsers.count -eq 0){Write-host "Pass"} Else {Write-host "Fail : You have $($UnsafeUsers.count) account"}

poiriersimon

#1 - List Managed Domain
$ManagedDomain = Get-MSOLDomain |where {$_.AuthenticationType -eq "Managed"}
#2 - Check if 1 users exist in those domain
$UsedManagedDomains = @()
foreach ($ManagedDomain in $ManagedDomains){$Users = @(); $users= Get-MSOLUser -All | where {$_.UserPrincipalName -like "*$($ManagedDomain.name)"} | select -First 1;if($Users.count -gt 0){$UsedManagedDomains+=$ManagedDomain}}
#3 - List Password Policies for all managed domain with at least 1 user
$NoPasswordPolicyDomain = @()
foreach($UsedManagedDomain in $UsedManagedDomain){$PasswordPolicy = Get-MsolPasswordPolicy -DomainName $ManagedDomain.name; if($PasswordPolicy.NotificationDays -eq $NULL -and $PasswordPolicy.ValidityPeriod -eq $NULL){$NoPasswordPolicyDomain += $UsedManagedDomain}}
#4 - If Password policy is not complex - Trigger 
If($NoPasswordPolicyDomain.count -eq 0){Write-host "PASS"}Else{Write-host "FAIL for Domain(s) : $($NoPasswordPolicyDomain.name -join ', ')" }

poiriersimon

$CollectorIp = Invoke-RestMethod -Uri 'http://ipinfo.io'
$DNSName = Resolve-DnsName "outlook.office365.com.g.office365.com"
$EXOIpsLocation = $(foreach($ip in $DNSName.ip4Address){Invoke-RestMethod -Uri "http://ipinfo.io/$($Ip)"}) |select -expandproperty Country -Unique
if($EXOIpsLocation -contains $CollectorIp.Country){Write-host "Ok"}

poiriersimon

# Based on : https://docs.microsoft.com/en-us/office365/enterprise/office-365-ip-web-service

# webservice root URL
$ws = "https://endpoints.office.com"
$clientRequestId = [GUID]::NewGuid().Guid

# invoke endpoints method to get the new data
$endpointSets = Invoke-RestMethod -Uri ($ws + "/endpoints/Worldwide?clientRequestId=" + $clientRequestId)
# filter results for Allow and Optimize endpoints, and transform these into custom objects with port and category
$flatUrls = $endpointSets | where{$_.serviceArea -eq "Exchange" -or $_.serviceArea -eq "Common"}| ForEach-Object {

poiriersimon

#You need AzureAD Module (Save-Module AzureAD -Path C:\temp)
#You need EWS API 2.2 (www.microsoft.com/en-us/download/details.aspx?id=35371)


$UserPrincipalName = "[email protected]"
$resourceUri = "https://outlook.office365.com"
$AzureADDLLPath = "C:\Temp\AzureAD"

#EWSEditor ClientId used since it was already registered with the right permission
$clientid = "0e4bf2e2-aa7d-46e8-aa12-263adeb3a62b"