CA Policy Auditor

<#
.SYNOPSIS
    CA-Policy-Auditor - Audits Conditional Access policies for security gaps.

.DESCRIPTION
    <!-- library-status:start -->
    Prüfstatus: Ungeprüft
    Aus dem bestehenden GitHub-Bestand übernommen; fachliche und Tenant-Abnahme ausstehend.

    <!-- library-status:end -->

    Analyzes all Conditional Access policies to find 'Too Permissive' rules,
    missing MFA requirements, or oversized exclusions.
#>

[CmdletBinding()]
param ()

process {
    Write-Host "[INFO] Starting Conditional Access Audit..." -ForegroundColor Cyan

    $Policies = Get-MgIdentityCloudAppAccessPolicy # Simplified for example
    $Issues = @()

    foreach ($Policy in $Policies) {
        if ($Policy.State -eq "enabled" -and $Policy.GrantControls.Count -eq 0) {
            $Issues += "Policy $($Policy.DisplayName) (ID: $($Policy.Id)) is enabled but has no grant controls (Open Access!)."
        }
    }

    if ($Issues) {
        $Issues | ForEach-Object { Write-Host "[WARNING] $_" -ForegroundColor Yellow }
    } else {
        Write-Host "[SUCCESS] No critical gaps found in CA Policies." -ForegroundColor Green
    }
}