control 'microsoft-365-foundations-7.2.1' do
  title 'Ensure modern authentication for SharePoint applications is required'
  desc 'Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third-party SAML identity providers.'

  desc 'check',
       "To audit using the UI:
        1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint.
        2. Click to expand Policies select Access control.
        3. Select Apps that don't use modern authentication and ensure that it is set to Block access.
    To audit using PowerShell:
        1. Connect to SharePoint Online using Connect-SPOService -Url https://tenant-admin.sharepoint.com replacing tenant with your value.
        2. Run the following SharePoint Online PowerShell command:
            Get-SPOTenant | ft LegacyAuthProtocolsEnabled
        3. Ensure the returned value is False."

  desc 'fix',
       "To remediate using the UI:
        1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint.
        2. Click to expand Policies select Access control.
        3. Select Apps that don't use modern authentication.
        4. Select the radio button for Block access.
        5. Click Save.
    To remediate using PowerShell:
        1. Connect to SharePoint Online using Connect-SPOService -Url https://tenant-admin.sharepoint.com replacing tenant with your value.
        2. Run the following SharePoint Online PowerShell command:
            Set-SPOTenant -LegacyAuthProtocolsEnabled $false"

  desc 'rationale',
       'Strong authentication controls, such as the use of multifactor authentication, may be
        circumvented if basic authentication is used by SharePoint applications. Requiring
        modern authentication for SharePoint applications ensures strong authentication
        mechanisms are used when establishing sessions between these applications,
        SharePoint, and connecting users.'

  impact 0.5
  tag severity: 'medium'
  tag cis_controls: [{ '8' => ['3.10'] }, { '7' => ['16.3'] }]
  tag nist: ['AC-17(2)', 'IA-5', 'IA-5(1)', 'SC-8', 'SC-8(1)', 'SI-2']

  ref 'https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps'

  ensure_modern_authentication_spo_applications_required_script = %{
	  (Get-PnPTenant).LegacyAuthProtocolsEnabled
  }
  powershell_output = pwsh_single_session_executor(ensure_modern_authentication_spo_applications_required_script).run_script_in_teams_pnp
  raise Inspec::Error, "The powershell output returned the following error:  #{powershell_output.stderr}" if powershell_output.exit_status != 0

  describe 'Ensure the LegacyAuthProtocolsEnabled option for SharePoint' do
    subject { powershell_output.stdout.strip }
    it 'is set to False' do
      expect(subject).to eq('False')
    end
  end
end
