Zero Trust: Okta-IG + Azure AD SaaS Security

#!/bin/bash

# This script creates a fundamental Azure AD Conditional Access policy to enforce MFA for all users and all cloud applications.
# It's designed to be a plug-and-play starting point for the "Zero Trust: Okta-IG + Azure AD SaaS Security" blueprint.

# --- Configuration --- 
# Replace with your Azure AD Tenant ID if not running in the correct context
# AZURE_TENANT_ID="YOUR_TENANT_ID"

# Policy Name
POLICY_NAME="Require MFA for All Users and Cloud Apps"

# Description for the policy
POLICY_DESCRIPTION="Enforces Multi-Factor Authentication for all users accessing any cloud application, a core Zero Trust principle."

# --- Prerequisites ---
# 1. Ensure you are logged into Azure CLI with sufficient permissions to manage Conditional Access policies.
#    Run: az login
# 2. Ensure the Azure AD Conditional Access API is enabled for your tenant.
# 3. This script assumes you have Azure AD Premium P1 or P2 licenses.

# --- Script Logic ---

echo "Creating Azure AD Conditional Access Policy: '$POLICY_NAME'"

# Define the policy JSON payload
# This payload targets all users, all cloud apps, and requires MFA as the grant control.
POLICY_PAYLOAD=$(cat <<EOF
{
  "displayName": "$POLICY_NAME",
  "description": "$POLICY_DESCRIPTION",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeUsers": [
        "All"
      ],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": []
    },
    "applications": {
      "includeApplications": [
        "All"
      ],
      "excludeApplications": [],
      "includeUserActions": []
    },
    "platforms": {
      "includePlatforms": [
        "All"
      ],
      "excludePlatforms": []
    },
    "locations": {
      "includeLocations": [],
      "excludeLocations": [],
      "areMappedLocationsIncluded": false
    },
    "clientAppTypes": [
      "all"
    ],
    "deviceState": {
      "filter": null,
      "includeState": null,
      "excludeState": null
    },
    "devicePlatformDetails": [],
    "riskDistributions": [],
    "signInRiskLevels": [],
    "userRiskLevels": [],
    "authenticationStrength": {
      "includeAuthenticationStrengths": [],
      "excludeAuthenticationStrengths": []
    },
    "ipRanges": {
      "includeIpRanges": [],
      "excludeIpRanges": []
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": [
      "mfa"
    ],
    "customControls": []
  },
  "sessionControls": {
    "applicationEnforcedControls": null,
    "persistentBrowser": null,
    "signOutTabSessionManagement": null,
    "disableResilienceDefault": null,
    "enableTokenLifetimePolicy": null
  }
}
EOF
)

# Attempt to create the policy using Azure CLI
# The API version might need adjustment based on your Azure AD environment and CLI version. Common recent versions are 2020-01-01 or 2021-03-01.
# You may need to use 'az rest' if 'az ca policy create' is not directly available or has limitations.
# As of recent Azure CLI versions, direct creation of CA policies is not a standard command group. We will use 'az rest'.

# Get the access token for the Graph API
TOKEN=$(az account get-access-token --resource https://graph.microsoft.com --output tsv | awk '{print $1}')

# Construct the request URL for creating a conditional access policy
# The endpoint is /identity/conditionalAccess/policies
REQUEST_URL="https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies"

# Execute the POST request to create the policy
RESPONSE=$(curl -s -X POST "$REQUEST_URL" \
     -H "Authorization: Bearer $TOKEN" \
     -H "Content-Type: application/json" \
     -d "$POLICY_PAYLOAD")

# Check the response for success or failure
if echo $RESPONSE | grep -q '"id":'; then
  POLICY_ID=$(echo $RESPONSE | jq -r '.id')
  echo "SUCCESS: Conditional Access Policy '$POLICY_NAME' created successfully."
  echo "Policy ID: $POLICY_ID"
else
  echo "ERROR: Failed to create Conditional Access Policy '$POLICY_NAME'."
  echo "Response: $RESPONSE"
  exit 1
fi

exit 0