Skip to content

ASD iOS Compliance Policy Check

Jump to bottom
directorcia edited this page Nov 24, 2025 · 1 revision

Overview

The asd-ioscomp-get.ps1 script is an automated compliance validation tool that checks your Microsoft Intune iOS/iPadOS compliance policies against the Australian Signals Directorate (ASD) Blueprint for Secure Cloud baseline requirements. It compares each policy setting with the recommended configuration and generates detailed compliance reports.

Script Version: 1.0
Last Updated: November 25, 2025
Author: CIAOPS

Table of Contents

Features

Core Capabilities

✅ Automated Compliance Checking

  • Compares Intune iOS compliance policies against ASD Blueprint baseline
  • Validates all critical security settings
  • Reports PASS/FAIL status for each setting

✅ Flexible Baseline Sources

  • Download latest baseline from GitHub (default)
  • Use custom local JSON baseline files
  • Support for organization-specific baselines

✅ Comprehensive Reporting

  • Professional HTML reports with visual dashboard
  • Optional CSV export for data analysis
  • Detailed logging for troubleshooting

✅ Multi-Policy Support

  • Check all iOS compliance policies in tenant
  • Target specific policy by name
  • Compare multiple policies in single run

✅ Enterprise Features

  • Microsoft Graph API integration
  • Domain identification in reports
  • Detailed audit logging
  • Error handling and validation

Prerequisites

Required Software

  1. PowerShell 5.1 or later

    • Windows PowerShell 5.1
    • PowerShell 7+ (recommended)

  2. Microsoft.Graph PowerShell Module

    Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

Required Permissions

Microsoft Graph API Permissions:

  • DeviceManagementConfiguration.Read.All (required)
  • OR Global Reader role (minimum)
  • Organization.Read.All (for domain identification)

Azure AD Roles (minimum):

  • Global Reader
  • Intune Administrator (read-only)
  • Security Reader

Network Requirements

  • Internet connectivity to download baseline from GitHub
  • Access to Microsoft Graph API endpoints:
    • https://graph.microsoft.com
    • https://login.microsoftonline.com

Operating System

  • Windows 10/11
  • Windows Server 2016 or later
  • macOS (with PowerShell 7+)
  • Linux (with PowerShell 7+)

Installation

Step 1: Install Microsoft Graph Module

# Install the Microsoft Graph Authentication module
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force

# Verify installation
Get-Module Microsoft.Graph.Authentication -ListAvailable

Step 2: Download the Script

Option A: Clone the repository

git clone https://github.com/directorcia/office365.git
cd office365

Option B: Direct download

Invoke-WebRequest -Uri "https://raw.githubusercontent.com/directorcia/office365/master/asd-ioscomp-get.ps1" -OutFile "asd-ioscomp-get.ps1"

Step 3: Verify Script Integrity

# Check script content
Get-Content .\asd-ioscomp-get.ps1 | Select-Object -First 20

# Review execution policy
Get-ExecutionPolicy

# Set execution policy if needed (run as Administrator)
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Usage

Basic Usage

Run with default settings (GitHub baseline):

.\asd-ioscomp-get.ps1

This will:

  1. Prompt for Microsoft Graph authentication
  2. Download the latest ASD baseline from GitHub
  3. Check all iOS compliance policies in your tenant
  4. Generate HTML report in parent directory
  5. Open report in default browser

Advanced Usage

Export results to CSV:

.\asd-ioscomp-get.ps1 -ExportToCSV

Use custom baseline file:

.\asd-ioscomp-get.ps1 -BaselinePath "C:\Baselines\custom-ios-baseline.json"

Check specific policy by name:

.\asd-ioscomp-get.ps1 -PolicyName "ASD iOS Compliance"

Enable detailed logging:

.\asd-ioscomp-get.ps1 -DetailedLogging

Custom output paths:

.\asd-ioscomp-get.ps1 -HTMLPath "C:\Reports\ios-compliance.html" -CSVPath "C:\Reports\ios-compliance.csv" -ExportToCSV

Combined example:

.\asd-ioscomp-get.ps1 -ExportToCSV -DetailedLogging -PolicyName "Production iOS Policy"

Parameters

Parameter Type Required Default Description
-ExportToCSV Switch No False Export results to CSV file
-CSVPath String No Auto-generated Custom path for CSV export
-BaselinePath String No GitHub URL Path or URL to baseline JSON
-DetailedLogging Switch No False Enable detailed logging to file
-LogPath String No Auto-generated Custom path for log file
-HTMLPath String No Auto-generated Custom path for HTML report
-PolicyName String No (all policies) Target specific policy by name

Baseline Configuration

Default ASD Baseline

The script uses the official ASD Blueprint baseline by default:

URL: https://raw.githubusercontent.com/directorcia/bp/main/Intune/Policies/ASD/ios-compliance.json

Baseline includes:

  • Passcode requirements (15+ characters, alphanumeric)
  • Device security settings (jailbreak detection)
  • OS version requirements (iOS 14.8.1+)
  • Threat protection settings
  • Mobile threat defense configuration

Custom Baseline

Create a custom baseline JSON file following this structure:

{
  "@odata.type": "#microsoft.graph.iosCompliancePolicy",
  "displayName": "Custom iOS Baseline",
  "description": "Custom compliance requirements",
  "passcodeRequired": true,
  "passcodeBlockSimple": true,
  "passcodeMinimumLength": 15,
  "passcodeRequiredType": "alphanumeric",
  "passcodeMinutesOfInactivityBeforeLock": 0,
  "passcodeExpirationDays": 365,
  "passcodePreviousPasscodeBlockCount": 5,
  "passcodeMinimumCharacterSetCount": 1,
  "securityBlockJailbrokenDevices": true,
  "deviceThreatProtectionEnabled": true,
  "deviceThreatProtectionRequiredSecurityLevel": "medium",
  "osMinimumVersion": "14.8.1",
  "osMinimumBuildVersion": "18H107",
  "managedEmailProfileRequired": false,
  "advancedThreatProtectionRequiredSecurityLevel": "medium"
}

Usage:

.\asd-ioscomp-get.ps1 -BaselinePath "C:\Baselines\custom-ios-baseline.json"

Output Files

HTML Report

Location: Parent directory with timestamp (e.g., asd-ioscomp-get-20251125-143022.html)

Contents:

  • Executive summary dashboard
    • Total checks performed
    • Pass/fail counts
    • Compliance percentage
    • Overall status
  • Connected organization domain
  • Generation timestamp
  • Detailed results table
    • Policy name
    • Setting name
    • Current value
    • Required value
    • Compliance status
  • Reference links to ASD Blueprint

Features:

  • Professional styling with color-coded results
  • Responsive design for mobile viewing
  • Sortable/filterable table
  • Printable format
  • Hover effects for better UX

Example Output:

🛡️ ASD iOS Compliance Policy Report
Domain: contoso.onmicrosoft.com
Generated: 25 November 2025 - 14:30:22

Summary:
Total Checks: 45
Passed: 42
Failed: 3
Compliance: 93.33%

Overall Status: NON-COMPLIANT

CSV Export

Location: Parent directory with timestamp (e.g., asd-ioscomp-get-20251125-143022.csv)

Columns:

  • Policy
  • Setting
  • CurrentValue
  • RequiredValue
  • Status

Usage:

# Import and analyze in PowerShell
$results = Import-Csv "asd-ioscomp-get-20251125-143022.csv"
$results | Where-Object Status -eq "FAIL" | Format-Table

# Open in Excel for analysis
Invoke-Item "asd-ioscomp-get-20251125-143022.csv"

Log Files

Location: Parent directory with timestamp (e.g., asd-ioscomp-get-20251125-143022.log)

Enabled by: -DetailedLogging parameter

Contents:

  • Timestamp for each operation
  • Baseline loading details
  • Graph API connection logs
  • Policy retrieval information
  • Setting comparison details
  • Error messages and stack traces

Example log entries:

[2025-11-25 14:30:15] [INFO] Loading baseline from: https://raw.githubusercontent.com/...
[2025-11-25 14:30:16] [INFO] Baseline loaded successfully
[2025-11-25 14:30:18] [INFO] Retrieved 3 iOS compliance policies
[2025-11-25 14:30:19] [INFO] Check [ASD iOS Policy] passcodeRequired - Current: True, Required: True, Status: PASS
[2025-11-25 14:30:19] [WARN] Check [ASD iOS Policy] passcodeMinimumLength - Current: 10, Required: 15, Status: FAIL

Understanding Results

Compliance Status

PASS (✓)

  • Current setting matches required value
  • Setting is compliant with ASD baseline
  • No action required

FAIL (✗)

  • Current setting does NOT match required value
  • Setting is non-compliant
  • Remediation required

Common Result Patterns

"Not set" vs Required Value

  • Setting is not configured in policy
  • Requires configuration to meet baseline
  • May indicate default values in use

Value Mismatches

  • Current: 10 vs Required: 15
  • Current: false vs Required: true
  • Current: numeric vs Required: alphanumeric

Array/Object Comparisons

  • Complex settings compared as JSON strings
  • Arrays must match exactly (order matters)
  • Empty arrays shown as []

Compliance Percentage Interpretation

Percentage Status Action Required
100% Fully Compliant Maintain configuration
95-99% Nearly Compliant Minor adjustments needed
85-94% Mostly Compliant Several settings need attention
70-84% Partially Compliant Significant gaps to address
<70% Non-Compliant Major remediation required

Compliance Checks

Passcode Security Settings

Setting ASD Requirement Purpose
passcodeRequired true Enforce device passcode
passcodeBlockSimple true Block simple patterns
passcodeMinimumLength 15 Strong passcode length
passcodeRequiredType alphanumeric Complex passcode type
passcodeMinutesOfInactivityBeforeLock 0 Immediate lock on idle
passcodeExpirationDays 365 Annual passcode change
passcodePreviousPasscodeBlockCount 5 Prevent reuse
passcodeMinimumCharacterSetCount 1 Character diversity

Device Security Settings

Setting ASD Requirement Purpose
securityBlockJailbrokenDevices true Block compromised devices
deviceThreatProtectionEnabled true Enable mobile threat defense
deviceThreatProtectionRequiredSecurityLevel medium MTD threshold

OS Version Requirements

Setting ASD Requirement Purpose
osMinimumVersion 14.8.1 Minimum iOS version
osMinimumBuildVersion 18H107 Specific security patches
osMaximumVersion null No maximum restriction

Advanced Protection

Setting ASD Requirement Purpose
advancedThreatProtectionRequiredSecurityLevel medium Defender for Endpoint
managedEmailProfileRequired false Email profile requirement

Troubleshooting

Common Issues and Solutions

Issue: "Failed to import Microsoft.Graph.Authentication module"

Cause: Module not installed or not in module path

Solution:

# Install the module
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force

# Verify installation
Get-Module Microsoft.Graph.Authentication -ListAvailable

# Import manually if needed
Import-Module Microsoft.Graph.Authentication

Issue: "Failed to connect to Microsoft Graph"

Cause: Authentication failure or network issues

Solution:

# Disconnect and reconnect
Disconnect-MgGraph
Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"

# Check connection
Get-MgContext

# Verify network connectivity
Test-NetConnection graph.microsoft.com -Port 443

Issue: "Permission validation failed"

Cause: Insufficient permissions

Solution:

  1. Verify you have required permissions:

    • DeviceManagementConfiguration.Read.All
    • OR Global Reader role

  2. Request admin consent if needed:

    Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All" -UseDeviceCode

  3. Contact your tenant administrator for permission assignment

Issue: "Failed to download JSON"

Cause: Network connectivity or GitHub access issues

Solution:

# Test GitHub connectivity
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/directorcia/bp/main/Intune/Policies/ASD/ios-compliance.json" -UseBasicParsing

# Use local baseline file as fallback
.\asd-ioscomp-get.ps1 -BaselinePath "C:\Baselines\ios-compliance.json"

# Check proxy settings if behind corporate proxy

Issue: "No iOS compliance policies found"

Cause: No iOS policies exist in tenant or filter issue

Solution:

  1. Verify policies exist in Intune portal
  2. Check Graph API connectivity: 
    Connect-MgGraph
Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies"
  3. Ensure policies are iOS type (not Android/Windows)

Issue: "Baseline JSON schema validation failed"

Cause: Invalid or corrupted baseline JSON

Solution:

  1. Validate JSON syntax: 
    Get-Content baseline.json -Raw | ConvertFrom-Json
  2. Ensure @odata.type is #microsoft.graph.iosCompliancePolicy
  3. Re-download baseline from GitHub
  4. Check for manual edits that broke JSON structure

Issue: "Failed to generate HTML report"

Cause: File permissions or path issues

Solution:

# Check write permissions to parent directory
Test-Path -Path ".." -PathType Container

# Specify custom output path
.\asd-ioscomp-get.ps1 -HTMLPath "C:\Temp\report.html"

# Run PowerShell as administrator if needed

Debug Mode

Enable verbose output for troubleshooting:

# Enable PowerShell verbose output
$VerbosePreference = "Continue"
.\asd-ioscomp-get.ps1 -DetailedLogging -Verbose

# Review log file
Get-Content .\asd-ioscomp-get-*.log | Select-Object -Last 50

Get Help

# View script help
Get-Help .\asd-ioscomp-get.ps1 -Full

# View examples
Get-Help .\asd-ioscomp-get.ps1 -Examples

# View parameters
Get-Help .\asd-ioscomp-get.ps1 -Parameter *

Best Practices

Regular Compliance Checks

Schedule regular reviews:

# Weekly compliance check
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Monday -At 9am
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\asd-ioscomp-get.ps1 -ExportToCSV"
Register-ScheduledTask -TaskName "iOS Compliance Check" -Trigger $trigger -Action $action

Version Control for Baselines

Store custom baselines in version control:

# Git workflow
git add custom-ios-baseline.json
git commit -m "Updated iOS baseline - increased passcode length to 16"
git push

Document Exceptions

If certain settings cannot meet baseline:

# Document in compliance report
# Add notes to CSV export for audit trail
$results = Import-Csv report.csv
$results | Where-Object Status -eq "FAIL" | 
    Add-Member -NotePropertyName "Exception" -NotePropertyValue "Business justification here" -PassThru |
    Export-Csv report-with-notes.csv -NoTypeInformation

Automate Remediation Workflow

  1. Run compliance check
  2. Export failures to CSV
  3. Review with security team
  4. Use asd-ioscomp-set.ps1 to apply compliant settings
  5. Re-run check to verify
# Check compliance
.\asd-ioscomp-get.ps1 -ExportToCSV

# Review failures
Import-Csv .\asd-ioscomp-get-*.csv | Where-Object Status -eq "FAIL"

# Apply compliant settings (if safe to do so)
.\asd-ioscomp-set.ps1 -PolicyName "ASD iOS Compliance"

# Verify compliance
.\asd-ioscomp-get.ps1

Multi-Tenant Management

For MSPs managing multiple tenants:

# Loop through tenants
$tenants = @("contoso.onmicrosoft.com", "fabrikam.onmicrosoft.com")

foreach ($tenant in $tenants) {
    Write-Host "Checking compliance for $tenant"
    
    # Connect to tenant
    Connect-MgGraph -TenantId $tenant -Scopes "DeviceManagementConfiguration.Read.All"
    
    # Run check with tenant-specific output
    $timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
    .\asd-ioscomp-get.ps1 -HTMLPath "C:\Reports\$tenant-$timestamp.html" -ExportToCSV
    
    # Disconnect
    Disconnect-MgGraph
}

Integration with CI/CD

Azure DevOps Pipeline

trigger:
- main

pool:
  vmImage: 'windows-latest'

steps:
- task: PowerShell@2
  inputs:
    targetType: 'inline'
    script: |
      Install-Module Microsoft.Graph.Authentication -Force -Scope CurrentUser
      Connect-MgGraph -TenantId $(TenantId) -ClientId $(ClientId) -CertificateThumbprint $(CertThumbprint)
      .\asd-ioscomp-get.ps1 -ExportToCSV -DetailedLogging
      
- task: PublishBuildArtifacts@1
  inputs:
    pathToPublish: '$(Build.SourcesDirectory)'
    artifactName: 'ComplianceReports'

GitHub Actions

name: iOS Compliance Check

on:
  schedule:
    - cron: '0 9 * * 1'  # Every Monday at 9 AM
  workflow_dispatch:

jobs:
  compliance-check:
    runs-on: windows-latest
    
    steps:
    - uses: actions/checkout@v2
    
    - name: Install Microsoft Graph
      run: Install-Module Microsoft.Graph.Authentication -Force -Scope CurrentUser
      shell: pwsh
    
    - name: Run Compliance Check
      run: |
        Connect-MgGraph -TenantId ${{ secrets.TENANT_ID }} -ClientId ${{ secrets.CLIENT_ID }} -CertificateThumbprint ${{ secrets.CERT_THUMBPRINT }}
        .\asd-ioscomp-get.ps1 -ExportToCSV
      shell: pwsh
    
    - name: Upload Reports
      uses: actions/upload-artifact@v2
      with:
        name: compliance-reports
        path: '*.html'

Security Considerations

Authentication

Use certificate-based authentication for automation:

# Create and register app with certificate
$cert = New-SelfSignedCertificate -Subject "CN=ComplianceChecker" -CertStoreLocation "Cert:\CurrentUser\My" -KeySpec Signature

# Connect using certificate
Connect-MgGraph -ClientId "app-id" -TenantId "tenant-id" -CertificateThumbprint $cert.Thumbprint

Credential Storage

Never store credentials in scripts

  • Use managed identities in Azure
  • Use certificate-based authentication
  • Store secrets in Azure Key Vault
  • Use Windows Credential Manager for interactive runs

Least Privilege

Grant minimum required permissions:

  • Use DeviceManagementConfiguration.Read.All (read-only)
  • Avoid Global Administrator role
  • Use Azure AD PIM for time-limited access
  • Audit permission usage regularly

Report Security

Protect compliance reports:

  • Store in secure locations
  • Limit access to security team
  • Encrypt reports if containing sensitive data
  • Implement retention policies

FAQ

Q: How often should I run compliance checks?

A:

  • Production: Weekly or after policy changes
  • Development/Test: Daily or on-demand
  • After incidents: Immediately
  • Audit preparation: Before scheduled audits

Q: Can I run this on macOS or Linux?

A: Yes, with PowerShell 7+. Install PowerShell Core and the Microsoft.Graph module:

# macOS
brew install powershell

# Linux (Ubuntu)
sudo apt-get install -y powershell

# Then install Graph module
pwsh -Command "Install-Module Microsoft.Graph.Authentication -Scope CurrentUser"

Q: What if I have multiple iOS compliance policies?

A: The script checks all iOS policies by default. Use -PolicyName to target specific policy:

.\asd-ioscomp-get.ps1 -PolicyName "Production iOS Policy"

Q: How do I customize the baseline requirements?

A:

  1. Download the baseline JSON from GitHub
  2. Edit settings to match your requirements
  3. Run script with custom baseline:
.\asd-ioscomp-get.ps1 -BaselinePath "C:\custom-baseline.json"

Q: Can I automate remediation of failed settings?

A: Yes, use the companion script asd-ioscomp-set.ps1 to create/update policies with compliant settings. Always review changes before applying.

Q: What if my organization can't meet certain baseline requirements?

A:

  1. Document business justification
  2. Create custom baseline excluding those settings
  3. Implement compensating controls
  4. Review with security team regularly

Q: Does this work with Configuration Manager co-management?

A: Yes, the script checks Intune policies regardless of co-management status. Ensure the device compliance workload is assigned to Intune.

Q: How do I interpret array/object comparisons?

A: Arrays and complex objects are compared as JSON strings. They must match exactly (including order) to pass. Review the HTML report for detailed current vs required values.

References

Official Documentation

Related Scripts

  • asd-ioscomp-set.ps1 - Apply ASD iOS compliance settings
  • asd-wincomp-get.ps1 - Windows compliance checking
  • asd-wincomp-set.ps1 - Windows compliance configuration

Security Rationale

  • iOS Compliance Policy Settings - Security Rationale
    • [Link to comprehensive security rationale document]
    • Explains why each setting matters
    • Real-world attack scenarios
    • Implementation guidance

GitHub Repository

Community and Support

Change Log

Version 1.0 (November 25, 2025)

  • Initial release
  • Support for iOS/iPadOS compliance policies
  • GitHub baseline integration
  • HTML and CSV reporting
  • Domain identification
  • Detailed logging
  • Multi-policy support
  • Custom baseline support

License

Script provided as-is. Use at own risk. No guarantees or warranty provided.

© CIAOPS 2025

Support

For issues, questions, or contributions:

Document Version: 1.0
Last Updated: November 25, 2025
Maintained by: CIAOPS

Clone this wiki locally