Skip to content

SafeLinksPolicy Standard #687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Mar 25, 2024

Conversation

OfficialEsco
Copy link
Contributor

This PR adds a way to set or create a SafeLinks Policy.
Currently i need feedback on how you want to handle these things as i've made every option selectable by the user.
There does also appear to be a bug where if you create a policy by script it does not appear in the M365 UI?

You can implement this by adding this to your CIPP/src/data/standards.json
(I've used Defender Standards as it seemed fitting)

{
    "name": "standards.SafeLinksPolicy",
    "cat": "Defender Standards",
    "tag": ["lowimpact", "CIS"],
    "helpText": "Creates a SafeLinks Policy",
    "addedComponent": [
      {
        "type": "input",
        "name": "standards.SafeLinksPolicy.Name",
        "label": "SafeLink Policy Name"
      },
      {
        "type": "boolean",
        "label": "EnableSafeLinksForEmail",
        "name": "standards.SafeLinksPolicy.EnableSafeLinksForEmail",
        "default": true
      },
      {
        "type": "boolean",
        "label": "EnableSafeLinksForTeams",
        "name": "standards.SafeLinksPolicy.EnableSafeLinksForTeams",
        "default": true
      },
      {
        "type": "boolean",
        "label": "EnableSafeLinksForOffice",
        "name": "standards.SafeLinksPolicy.EnableSafeLinksForOffice",
        "default": true
      },
      {
        "type": "boolean",
        "label": "TrackClicks",
        "name": "standards.SafeLinksPolicy.TrackClicks",
        "default": true
      },
      {
        "type": "boolean",
        "label": "ScanUrls",
        "name": "standards.SafeLinksPolicy.ScanUrls",
        "default": true
      },
      {
        "type": "boolean",
        "label": "EnableForInternalSenders",
        "name": "standards.SafeLinksPolicy.EnableForInternalSenders",
        "default": true
      },
      {
        "type": "boolean",
        "label": "DeliverMessageAfterScan",
        "name": "standards.SafeLinksPolicy.DeliverMessageAfterScan",
        "default": true
      },
      {
        "type": "boolean",
        "label": "AllowClickThrough",
        "name": "standards.SafeLinksPolicy.AllowClickThrough",
        "default": false
      },
      {
        "type": "boolean",
        "label": "DisableUrlRewrite",
        "name": "standards.SafeLinksPolicy.DisableUrlRewrite"
      },
      {
        "type": "boolean",
        "label": "EnableOrganizationBranding",
        "name": "standards.SafeLinksPolicy.EnableOrganizationBranding"
      }
    ],
    "label": "SafeLinks Policy",
    "impact": "Low Impact",
    "impactColour": "info"
  },

image

* Created SafeLinks Policy
* Safe Links use Optional Variable
* Added Set-SafeLinksPolicy and EnableOrganizationBranding
* Updated SafeLink logging
* Changed Name to Identity for Set-SafeLinksPolicy
* Update Invoke-CIPPStandardSafeLinksPolicy.ps1
* Update Invoke-CIPPStandardSafeLinksPolicy.ps1
* Rename CreateSafeLinksPolicy to SafeLinksPolicy
* Update Invoke-CIPPStandardSafeLinksPolicy.ps1
@KelvinTegelaar
Copy link
Owner

For standards we try to enforce the most secure policy with as little options as possible, for example on this one we'd create a standard without any switches. enable most settings and call it "SafeLinks Policy".

The problem with allowing MSPs to configure things, is that they'll always choose the least secure option, so not making that an option often works better. All your selected options are the ones I'd select aswell so if you resubmit with those as default, allowing the three lower options as optional inputs we're good.

The description would have to change a little bit to "This creates a safelink policy that automatically scans, tracks, and and enables safe links for Email, Office, and Teams for both external and internal senders".

@OfficialEsco
Copy link
Contributor Author

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants