Freigeben über

Hinzufügen einer benutzerdefinierten Umgehungsregel zum Global Secure Access Internet Access

Dieses PowerShell-Skript veranschaulicht, wie Sie der Microsoft Entra Internet Access-Weiterleitungsrichtlinie programmgesteuert eine benutzerdefinierte Umgehungsregel hinzufügen. Das Skript findet die Weiterleitungsrichtlinie "Benutzerdefinierte Umgehung" und fügt eine Beispielregel hinzu, um angegebene Domänen zu umgehen.

Für das Beispiel ist das Microsoft Graph Beta PowerShell-Modul 2.10 oder höher erforderlich.

Wichtige Überlegungen

  • Führen Sie das PowerShell-Skript als Administrator aus einer PowerShell-Sitzung mit erhöhten Rechten aus.
  • Stellen Sie sicher, dass Sie das Microsoft.Graph.Beta-Modul installieren: 
    Install-Module Microsoft.Graph.Beta -AllowClobber -Force
  • Das für Connect-MgGraph verwendete Konto muss über die folgenden Berechtigungen verfügen:
    • Policy.Read.All
    • Netzwerkzugriff.LesenSchreiben.Alle

Beispielskript

# bypassscript.ps1 adds sample endpoints to the custom bypass policy in the internet access forwarding profile
# 
# Version 1.0
# 
# This script requires following 
#    - PowerShell 5.1 (x64) or beyond
#    - Module: Microsoft.Graph.Beta
#
# Before you begin:
# - Make sure you are running PowerShell as an Administrator
# - Make sure you run: Install-Module Microsoft.Graph.Beta -AllowClobber -Force
# - Make sure the account used for Connect-MgGraph has the following permissions:
#   - Policy.Read.All
#   - NetworkAccess.ReadWrite.All
# 
if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Beta.Identity.SignIns)) {
    Write-Host "Module Microsoft.Graph.Beta.Identity.SignIns is not installed. Please install it using: Install-Module Microsoft.Graph.Beta -AllowClobber"
    exit
}
Import-Module Microsoft.Graph.Beta.Identity.SignIns
Connect-MgGraph -Scopes "Policy.Read.All,NetworkAccess.ReadWrite.All"

# Find out custom bypass forwarding policy id
$custombypass = $null
$forwardingpolicies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/networkaccess/forwardingpolicies"
foreach ($policy in $forwardingpolicies.value) {
	if ($policy.name -eq "Custom Bypass"){
		$custombypass = $policy.id
	}
}
if ($custombypass -eq $null) {
	Write-Host "Could not find the IA custom bypass forwarding policy. Exiting."
	exit
}

# First, Bypass the Intune endpoints
$samplerule = [PSCustomObject]@{
    name = "Sample FQDN bypass rule"
    action = "bypass"
    destinations = @()
    ruleType = "fqdn"
    ports = @("80", "443")
    protocol = "tcp"
    '@odata.type' = "#microsoft.graph.networkaccess.internetAccessForwardingRule"
}
$sampledomains = @(
	"bing.com",
	"*.bing.com"
)

foreach ($sampledomain in $sampledomains) {
	$fqdn = [PSCustomObject]@{
	   '@odata.type' = "#microsoft.graph.networkaccess.fqdn"
	   value = $sampledomain
	}
	$samplerule.destinations += $fqdn
}
$body = $samplerule | ConvertTo-Json
Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/networkaccess/forwardingPolicies('$($custombypass)')/policyRules" -Body $body -ContentType "application/json"

# Next, Bypass the sample IP-based endpoints
$sampleipbypassrule = [PSCustomObject]@{
    name = "Sample IP bypass rule"
    action = "bypass"
    destinations = @()
    ruleType = "ipSubnet"
    ports = @("80", "443")
    protocol = "tcp"
    '@odata.type' = "#microsoft.graph.networkaccess.internetAccessForwardingRule"
}
$sampleipbypassdomains = @(
	"1.2.3.4/32"
)
foreach ($sampleipbypassdomain in $sampleipbypassdomains) {
	$ip = [PSCustomObject]@{
	   '@odata.type' = "#microsoft.graph.networkaccess.ipSubnet"
	   value = $sampleipbypassdomain
	}
	$sampleipbypassrule.destinations += $ip
}
$body = $sampleipbypassrule | ConvertTo-Json
Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/networkaccess/forwardingPolicies('$($custombypass)')/policyRules" -Body $body -ContentType "application/json"

Nächste Schritte