BOD-25-01-CSA-Microsoft-Policy-MCP

Instructions

Implementation Reference

• cisa-powerplatform/src/index.ts:172-186 (handler)

  Handler function for get_policy_status in Power Platform server that returns a mock status of security policies (TODO: real implementation).

  private async getPolicyStatus() {
    // TODO: Implement policy status check logic
    return {
      content: [
        {
          type: 'text',
          text: JSON.stringify({
            environmentCreation: 'Restricted to admins',
            dlpPolicy: 'Configured',
            tenantIsolation: 'Enabled',
          }, null, 2),
        },
      ],
    };
  }

• cisa-defender/cisa-exchange/src/index.ts:274-308 (handler)

  Handler for get_policy_status in Exchange Online server that queries Microsoft Graph API for various Exchange policy statuses and returns them in JSON.

  private async getPolicyStatus() {
    try {
      if (!this.graphClient) {
        throw new Error('Graph client not initialized');
      }
  
      const results = {
        policies: EXO_POLICIES,
        currentStatus: {
          externalForwarding: await this.graphClient.api('/admin/exchangeSettings/externalForwarding').get(),
          spfPolicies: await this.graphClient.api('/admin/domains/spfRecords').get(),
          dmarcPolicies: await this.graphClient.api('/admin/domains/dmarcRecords').get(),
          smtpAuth: await this.graphClient.api('/admin/exchangeSettings/smtpAuth').get(),
          sharingPolicies: await this.graphClient.api('/admin/exchangeSettings/sharingPolicies').get(),
          externalSenderWarning: await this.graphClient.api('/admin/exchangeSettings/externalSenderWarning').get(),
          mailboxAudit: await this.graphClient.api('/admin/exchangeSettings/mailboxAudit').get()
        }
      };
  
      return {
        content: [
          {
            type: 'text',
            text: JSON.stringify(results, null, 2)
          }
        ]
      };
    } catch (error) {
      const errorMessage = error instanceof Error ? error.message : 'Unknown error occurred';
      throw new McpError(
        ErrorCode.InternalError,
        `Failed to get policy status: ${errorMessage}`
      );
    }
  }

• cisa-defender/src/index.ts:324-354 (handler)

  Handler for get_policy_status in Defender server that fetches current Defender policy statuses via Microsoft Graph API.

  private async getPolicyStatus() {
    try {
      if (!this.graphClient) {
        throw new Error('Graph client not initialized');
      }
  
      const results = {
        policies: DEFENDER_POLICIES,
        currentStatus: {
          securityPolicies: await this.graphClient.api('/security/securityPresetPolicies').get(),
          piiProtection: await this.graphClient.api('/security/sensitiveTypes').get(),
          auditConfig: await this.graphClient.api('/security/auditLogs/config').get()
        }
      };
  
      return {
        content: [
          {
            type: 'text',
            text: JSON.stringify(results, null, 2)
          }
        ]
      };
    } catch (error) {
      const errorMessage = error instanceof Error ? error.message : 'Unknown error occurred';
      throw new McpError(
        ErrorCode.InternalError,
        `Failed to get policy status: ${errorMessage}`
      );
    }
  }

• cisa-teams/src/index.ts:337-390 (handler)

  Handler for get_policy_status in Teams server that queries multiple Teams policies via Graph API and computes their compliance status.

  private async getPolicyStatus() {
    try {
      // Get current settings using Microsoft Graph API
      const [
        meetingPolicy,
        federationSettings,
        externalUserSettings,
        emailSettings,
      ] = await Promise.all([
        this.graphClient.api('/policies/teamsAppSetupPolicies/global').get(),
        this.graphClient.api('/policies/teamsFederationSettings').get(),
        this.graphClient.api('/policies/teamsExternalUserSettings').get(),
        this.graphClient.api('/policies/teamsEmailSettings').get(),
      ]);
  
      const status = {
        anonymousMeetings: {
          disabled: !meetingPolicy.allowAnonymousUsersToStartMeeting,
          compliant: !meetingPolicy.allowAnonymousUsersToStartMeeting,
        },
        externalAccess: {
          allowedDomains: federationSettings.allowedDomains,
          compliant: federationSettings.allowedDomains.length > 0 &&
                    !federationSettings.allowTeamsConsumer,
        },
        unmanagedUsers: {
          disabled: !externalUserSettings.allowUnmanagedUsersToStartChat,
          compliant: !externalUserSettings.allowUnmanagedUsersToStartChat,
        },
        skypeUsers: {
          blocked: !federationSettings.allowSkypeUsers,
          compliant: !federationSettings.allowSkypeUsers,
        },
        emailIntegration: {
          disabled: !emailSettings.allowEmailIntegration,
          compliant: !emailSettings.allowEmailIntegration,
        },
      };
  
      return {
        content: [
          {
            type: 'text',
            text: JSON.stringify(status, null, 2),
          },
        ],
      };
    } catch (error: unknown) {
      throw new McpError(
        ErrorCode.InternalError,
        `Failed to get policy status: ${error instanceof Error ? error.message : 'Unknown error'}`
      );
    }
  }