Giter VIP home page Giter VIP logo

Comments (20)

LiamRomanis-at-RootshellSecurity avatar LiamRomanis-at-RootshellSecurity commented on July 25, 2024 1

OK, think I figured it out.. my account has MFA enforced

from 365inspect.

ThoughtContagion avatar ThoughtContagion commented on July 25, 2024 1

That would certainly do it. If your session wasn't authed to the Security and Compliance module you wouldn't see some of those commands.
Thanks for hanging in there!

from 365inspect.

ThoughtContagion avatar ThoughtContagion commented on July 25, 2024

Hi there!
Thank you for using 365Inspect!
These cmdlets all rely on the user running the scripts having the proper permissions, and connecting to the Security and Compliance Center via PowerShell. The script handles these session connections, but cannot determine if the user running them has the correct permissions to run each command - in the case of these particular cmdlets, ATP/Defender licensing and permissions. If you could validate that those licenses and permissions are correct, we can begin to look further into this issue.

I can confirm that the cmdlets are still present in the Exchange PowerShell module version 2.0.5
image
image
image

The cmdlets listed with tmp_* as the source, are imported functions from the Exchange Online module
Get-SafeLinksPolicy
Get-DlpCompliancePolicy

from 365inspect.

LiamRomanis-at-RootshellSecurity avatar LiamRomanis-at-RootshellSecurity commented on July 25, 2024

from 365inspect.

ThoughtContagion avatar ThoughtContagion commented on July 25, 2024

Your license structure looks correct - both the RIGHTSMANAGEMENT_ADHOC and O365_BUSINESS_PREMIUM licenses should grant you access to these cmdlets if you have the appropriate roles. Due to the use of the two Graph modules and the requirement of admin consent, we recommend Global Admin role (we are actively working towards reducing the required permissions as much as possible), but for those specific cmdlets Security Reader or Global Reader roles should be sufficient to return the results of inspectors. Security and Compliance Permissions
If you are able to retrieve the results when running the tool, and hold the appropriate roles, then the error messages are just odd. Unfortunately, we cannot troubleshoot the modules themselves, but we're always happy to try to help as much as possible to get you into a good spot while using our tool!

from 365inspect.

LiamRomanis-at-RootshellSecurity avatar LiamRomanis-at-RootshellSecurity commented on July 25, 2024

from 365inspect.

ThoughtContagion avatar ThoughtContagion commented on July 25, 2024

Interesting.
What results do you get when you run this?

$Username = Read-Host -Prompt "Enter your UserPrincipalName (eg [email protected] or user @mycompany.onmicrosoft.com)"
Connect-ExchangeOnline -UserPrincipalName $Username -ShowBanner:$false
Connect-IPPSSession

$cmdlets = @("Get-DlpCompliancePolicy","Get-DlpSensitiveInformationType","Get-SafeLinksPolicy","Get-SafeAttachmentPolicy")

Foreach ($cmdlet in $cmdlets){
    Try{
        Get-Command $cmdlet
    }
    Catch{
        Write-Warning "$cmdlet not found."
    }
}

I would expect something like this (source names will likely be different)
image

from 365inspect.

LiamRomanis-at-RootshellSecurity avatar LiamRomanis-at-RootshellSecurity commented on July 25, 2024

from 365inspect.

ThoughtContagion avatar ThoughtContagion commented on July 25, 2024

Unfortunately, it looks like reply by email drops the attachments. Could you paste it into the Issue?

from 365inspect.

LiamRomanis-at-RootshellSecurity avatar LiamRomanis-at-RootshellSecurity commented on July 25, 2024

Screenshot from 2022-05-12 18-01-05

from 365inspect.

ThoughtContagion avatar ThoughtContagion commented on July 25, 2024

Can you try the following?

Disconnect-ExchangeOnline 

$Username = Read-Host -Prompt "Enter your UserPrincipalName (eg ***@***.*** or user @mycompany.onmicrosoft.com)"

Connect-ExchangeOnline -UserPrincipalName $Username -ShowBanner:$false

Connect-IPPSSession

Import-Module ExchangeOnlineManagement -Force

$cmdlets = @("Get-DlpCompliancePolicy","Get-DlpSensitiveInformationType","Get-SafeLinksPolicy","Get-SafeAttachmentPolicy")

Foreach ($cmdlet in $cmdlets){
    Try{
        Get-Command $cmdlet
    }
    Catch{
        Write-Warning "$cmdlet not found."
    }
}

from 365inspect.

LiamRomanis-at-RootshellSecurity avatar LiamRomanis-at-RootshellSecurity commented on July 25, 2024

from 365inspect.

ThoughtContagion avatar ThoughtContagion commented on July 25, 2024

Ok, how about running Disconnect-ExchangeOnline by itself, and then the above commands?

from 365inspect.

LiamRomanis-at-RootshellSecurity avatar LiamRomanis-at-RootshellSecurity commented on July 25, 2024

same error I'm affraid

from 365inspect.

LiamRomanis-at-RootshellSecurity avatar LiamRomanis-at-RootshellSecurity commented on July 25, 2024

maybe I should uninstall Powershell and start again. Up early tomorrow so got to go to bed, sorry. Thanks for you help so far

from 365inspect.

ThoughtContagion avatar ThoughtContagion commented on July 25, 2024

No problem.
You can also try installing the modules system-wide as an admin if you haven't already. The script prompt installs for the current user only.

from 365inspect.

LiamRomanis-at-RootshellSecurity avatar LiamRomanis-at-RootshellSecurity commented on July 25, 2024

Morning. After re-installing Powershell (rebooting in between) I installed ExchangeOnlineManagement and ran the set of commands you sent over. This was the result:

Screenshot from 2022-05-13 08-41-48

from 365inspect.

LiamRomanis-at-RootshellSecurity avatar LiamRomanis-at-RootshellSecurity commented on July 25, 2024

from 365inspect.

ThoughtContagion avatar ThoughtContagion commented on July 25, 2024

Hi there!

This seems like an authentication issue to the Security and Compliance center.
This may be due to a difference in your connection URI. Please see Microsoft's documentation about the differences in parameters.

image

from 365inspect.

ThoughtContagion avatar ThoughtContagion commented on July 25, 2024

Unable to replicate the issue and no response since October. Will reopen in the future if the issue is not resolved.

from 365inspect.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.