Microsoft Entra Backup : auditer et préparer la reprise

1$Root = 'C:\EntraRecovery'
2$ExportPath = Join-Path $Root 'Exports'
3$OutputPath = Join-Path $Root 'Evidence'
4$CatalogPath = Join-Path $Root 'recovery-catalog.csv'
5 
6New-Item -ItemType Directory -Path $ExportPath -Force | Out-Null
7New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null
8 
9$Catalog = @(
10    [pscustomobject]@{
11        ObjectType       = 'ManagedIdentities'
12        NativeBackup     = 'Oui'
13        SoftDelete       = 'A_documenter'
14        Authority        = 'Cloud'
15        RecoveryOwner    = 'EquipeIdentite'
16        RunbookDecision  = 'Valider_objet_et_proprietes_avant_restauration'
17    }
18    [pscustomobject]@{
19        ObjectType       = 'SyncedFromADDS'
20        NativeBackup     = 'Non'
21        SoftDelete       = 'Voie_non_autoritative'
22        Authority        = 'ADDS'
23        RecoveryOwner    = 'EquipeAD'
24        RunbookDecision  = 'Restaurer_dans_ADDS_puis_synchroniser'
25    }
26    [pscustomobject]@{
27        ObjectType       = 'OtherCloudObjects'
28        NativeBackup     = 'A_verifier'
29        SoftDelete       = 'A_verifier'
30        Authority        = 'Cloud'
31        RecoveryOwner    = 'EquipeIdentite'
32        RunbookDecision  = 'Verifier_la_documentation_en_vigueur'
33    }
34)
35 
36$Catalog | Export-Csv -LiteralPath $CatalogPath -NoTypeInformation -Encoding utf8

1[CmdletBinding()]
2param(
3    [Parameter(Mandatory)]
4    [string]$ExportPath,
5 
6    [Parameter(Mandatory)]
7    [string]$CatalogPath,
8 
9    [Parameter(Mandatory)]
10    [string]$OutputPath
11)
12 
13Set-StrictMode -Version Latest
14$ErrorActionPreference = 'Stop'
15 
16# Vérifie les entrées avant de créer les preuves.
17if (-not (Test-Path -LiteralPath $ExportPath -PathType Container)) {
18    throw "Le répertoire d'exports est introuvable : $ExportPath"
19}
20if (-not (Test-Path -LiteralPath $CatalogPath -PathType Leaf)) {
21    throw "Le catalogue est introuvable : $CatalogPath"
22}
23 
24New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null
25 
26$ResolvedExport = (Resolve-Path -LiteralPath $ExportPath).Path.TrimEnd(
27    [IO.Path]::DirectorySeparatorChar,
28    [IO.Path]::AltDirectorySeparatorChar
29)
30$ResolvedCatalog = (Resolve-Path -LiteralPath $CatalogPath).Path
31$ResolvedOutput = (Resolve-Path -LiteralPath $OutputPath).Path
32 
33$Catalog = Import-Csv -LiteralPath $ResolvedCatalog
34$RequiredColumns = @(
35    'ObjectType',
36    'NativeBackup',
37    'SoftDelete',
38    'Authority',
39    'RecoveryOwner',
40    'RunbookDecision'
41)
42 
43foreach ($Column in $RequiredColumns) {
44    if ($Catalog.Count -gt 0 -and $Column -notin $Catalog[0].PSObject.Properties.Name) {
45        throw "Colonne obligatoire absente du catalogue : $Column"
46    }
47}
48 
49# Calcule une empreinte SHA-256 pour chaque export et applique la décision du catalogue.
50$Files = Get-ChildItem -LiteralPath $ResolvedExport -File -Recurse
51$Manifest = foreach ($File in $Files) {
52    $RelativePath = $File.FullName.Substring($ResolvedExport.Length).TrimStart(
53        [char[]]@([IO.Path]::DirectorySeparatorChar, [IO.Path]::AltDirectorySeparatorChar)
54    )
55    $ObjectType = ($RelativePath -split '[\\/]')[0]
56    $CatalogEntry = $Catalog |
57        Where-Object { $_.ObjectType -eq $ObjectType } |
58        Select-Object -First 1
59 
60    if ($null -eq $CatalogEntry) {
61        $CatalogEntry = [pscustomobject]@{
62            ObjectType      = $ObjectType
63            NativeBackup    = 'NON_CLASSE'
64            SoftDelete      = 'NON_CLASSE'
65            Authority       = 'NON_CLASSEE'
66            RecoveryOwner   = 'NON_ASSIGNE'
67            RunbookDecision = 'REVUE_OBLIGATOIRE'
68        }
69    }
70 
71    $Hash = Get-FileHash -LiteralPath $File.FullName -Algorithm SHA256
72 
73    [pscustomobject]@{
74        ObjectType      = $ObjectType
75        RelativePath    = $RelativePath
76        SizeBytes       = $File.Length
77        LastWriteUtc    = $File.LastWriteTimeUtc.ToString('o')
78        SHA256          = $Hash.Hash
79        NativeBackup    = $CatalogEntry.NativeBackup
80        SoftDelete      = $CatalogEntry.SoftDelete
81        Authority       = $CatalogEntry.Authority
82        RecoveryOwner   = $CatalogEntry.RecoveryOwner
83        RunbookDecision = $CatalogEntry.RunbookDecision
84    }
85}
86 
87$Timestamp = Get-Date -Format 'yyyyMMdd-HHmmss'
88$ManifestPath = Join-Path $ResolvedOutput "manifest-$Timestamp.csv"
89$SummaryPath = Join-Path $ResolvedOutput "summary-$Timestamp.json"
90$RunbookPath = Join-Path $ResolvedOutput "runbook-$Timestamp.md"
91$ArchivePath = Join-Path $ResolvedOutput "entra-recovery-evidence-$Timestamp.zip"
92 
93$Manifest | Export-Csv -LiteralPath $ManifestPath -NoTypeInformation -Encoding utf8
94 
95$UnclassifiedCount = @($Manifest | Where-Object { $_.NativeBackup -eq 'NON_CLASSE' }).Count
96$Summary = [pscustomobject]@{
97    GeneratedUtc      = (Get-Date).ToUniversalTime().ToString('o')
98    ExportRoot        = $ResolvedExport
99    TotalFiles        = @($Manifest).Count
100    UnclassifiedFiles = $UnclassifiedCount
101    ObjectTypes       = @($Manifest.ObjectType | Sort-Object -Unique)
102    Manifest          = $ManifestPath
103}
104$Summary | ConvertTo-Json -Depth 4 | Out-File -LiteralPath $SummaryPath -Encoding utf8
105 
106$Runbook = @(
107    '# Runbook de reprise Microsoft Entra ID'
108    ''
109    "Généré le : $($Summary.GeneratedUtc)"
110    "Nombre de fichiers : $($Summary.TotalFiles)"
111    "Éléments non classés : $($Summary.UnclassifiedFiles)"
112    ''
113    '## Contrôles avant restauration'
114    '- Confirmer la date et l’heure de la sauvegarde.'
115    '- Archiver le rapport de différences.'
116    '- Vérifier l’autorité de chaque objet.'
117    '- Obtenir l’approbation du propriétaire de service.'
118    '- Confirmer l’identité du Backup Administrator.'
119    ''
120    '## Contrôles après restauration'
121    '- Vérifier la présence des objets attendus.'
122    '- Valider les propriétés critiques avec le propriétaire.'
123    '- Contrôler les dépendances applicatives.'
124    '- Archiver les journaux et la durée observée.'
125)
126$Runbook | Out-File -LiteralPath $RunbookPath -Encoding utf8
127 
128# Assemble les exports et les preuves sans modifier les données sources.
129$ArchiveInputs = @(
130    $ResolvedExport,
131    $ResolvedCatalog,
132    $ManifestPath,
133    $SummaryPath,
134    $RunbookPath
135)
136Compress-Archive -Path $ArchiveInputs -DestinationPath $ArchivePath -Force
137 
138[pscustomobject]@{
139    Manifest            = $ManifestPath
140    Summary             = $SummaryPath
141    Runbook             = $RunbookPath
142    Archive             = $ArchivePath
143    UnclassifiedFiles   = $UnclassifiedCount
144}

1C:\EntraRecovery\New-EntraRecoveryEvidence.ps1 `
2    -ExportPath 'C:\EntraRecovery\Exports' `
3    -CatalogPath 'C:\EntraRecovery\recovery-catalog.csv' `
4    -OutputPath 'C:\EntraRecovery\Evidence'

1$LatestSummary = Get-ChildItem 'C:\EntraRecovery\Evidence\summary-*.json' |
2    Sort-Object LastWriteTimeUtc -Descending |
3    Select-Object -First 1
4 
5$Result = Get-Content -LiteralPath $LatestSummary.FullName -Raw | ConvertFrom-Json
6$Result
7 
8if ($Result.UnclassifiedFiles -ne 0) {
9    throw "Audit incomplet : $($Result.UnclassifiedFiles) fichier(s) non classé(s)."
10}