Network 25401: Application Proxy applications require pre-authentication to block anonymous access to on-premises resources#916
Network 25401: Application Proxy applications require pre-authentication to block anonymous access to on-premises resources#916ashwinikarke wants to merge 11 commits intomainfrom
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new Network pillar assessment (25401) that evaluates Microsoft Entra Application Proxy apps to ensure they require pre-authentication (to prevent anonymous access to on-premises resources), along with accompanying remediation guidance.
Changes:
- Introduces
Test-Assessment-25401to enumerate Application Proxy-enabled applications and evaluateexternalAuthenticationType. - Generates a markdown report table with per-app compliance status and (when possible) deep links to the Entra admin portal.
- Adds the corresponding
.mdnarrative/remediation content for test 25401.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| src/powershell/tests/Test-Assessment.25401.ps1 | New PowerShell test implementing the Application Proxy pre-authentication evaluation and report generation. |
| src/powershell/tests/Test-Assessment.25401.md | New remediation/write-up content for the assessment with %TestResult% placeholder. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
alexandair
left a comment
alexandair
left a comment
There was a problem hiding this comment.
@ashwinikarke Please, address my feedback.
|
|
||
| # Query 1: Retrieve the list of Application Proxy-enabled applications | ||
| try { | ||
| $appProxyApps = Invoke-ZtGraphRequest ` |
There was a problem hiding this comment.
This should be a database query.
| $appDetailsCollection = @() | ||
| foreach ($app in $appProxyApps) { | ||
| try { | ||
| $appDetail = Invoke-ZtGraphRequest ` |
There was a problem hiding this comment.
This should be a database query. Probably merged with the previous one, because they both will be targetting Application table.
Commands like Invoke-ZtGraphRequest and database queries don't belong to Assessment Logic region, but Data Collection.
There was a problem hiding this comment.
Restructured the test to properly separate Data Collection region and Assessment Logic region
2 participants
No description provided.