AzureScout

2.10.0

manifests/collectors/Management/LighthouseDelegations.psd1

#
# GENERATED by scripts/ConvertTo-ScoutCollectorDefinition.ps1 from Modules/Public/InventoryModules/Management/LighthouseDelegations.ps1 (AB#5660).
# Field expressions are copied verbatim from the original collector and evaluate in an
# equivalent scope -- see docs/design/decisions/declarative-collectors.md.
# Review before trusting; regenerate rather than hand-patch if the source collector changes.
#
@{
    ResourceTypes = @(
        'Microsoft.ManagedServices/registrationDefinitions'
    )

    ResourceTypeMatching = 'Grouped'

    AdditionalFilter = $null

    FilterPreamble = ''

    RowLoopVariable = '1'

    Preamble = @'
$ResUCount = 1
                $sub1 = $SUB | Where-Object { $_.Id -eq $1.subscriptionId }
                $data = $1.PROPERTIES
                $Tags = if(![string]::IsNullOrEmpty($1.tags.psobject.properties)){$1.tags.psobject.properties}else{'0'}
 
                # Get registration details
                $registrationId = if ($data.registrationId) { $data.registrationId } else { 'N/A' }
                $description = if ($data.description) { $data.description } else { 'N/A' }
 
                # Get managing tenant
                $managedByTenantId = if ($data.managedByTenantId) { $data.managedByTenantId } else { 'N/A' }
                $managedByTenantName = if ($data.managedByTenantName) { $data.managedByTenantName } else { 'N/A' }
 
                # Parse authorizations (delegated permissions)
                $authorizations = @()
                if ($data.authorizations) {
                    foreach ($auth in $data.authorizations) {
                        $principalId = $auth.principalId
                        $principalIdDisplayName = if ($auth.principalIdDisplayName) {
                            $auth.principalIdDisplayName
                        } else { $principalId }
                        $roleDefinitionId = ($auth.roleDefinitionId -split '/')[-1]
 
                        # Map common role definition GUIDs to friendly names
                        $roleName = switch ($roleDefinitionId) {
                            'b24988ac-6180-42a0-ab88-20f7382dd24c' { 'Contributor' }
                            '8e3af657-a8ff-443c-a75c-2fe8c4bcb635' { 'Owner' }
                            'acdd72a7-3385-48ef-bd42-f606fba81ae7' { 'Reader' }
                            '749f88d5-cbae-40b8-bcfc-e573ddc772fa' { 'Monitoring Contributor' }
                            '43d0d8ad-25c7-4714-9337-8ba259a9fe05' { 'Monitoring Reader' }
                            '92aaf0da-9dab-42b6-94a3-d43ce8d16293' { 'Log Analytics Contributor' }
                            default { $roleDefinitionId }
                        }
 
                        $delegationType = if ($auth.delegatedRoleDefinitionIds) {
                            'Eligible (JIT)'
                        } else { 'Permanent' }
 
                        $authorizations += "$principalIdDisplayName -> $roleName ($delegationType)"
                    }
                }
                $authStr = if ($authorizations.Count -gt 0) { $authorizations -join '; ' } else { 'None' }
 
                # Get provisioning state
                $provisioningState = if ($data.provisioningState) { $data.provisioningState } else { 'Unknown' }
 
                # Check eligibility authorizations
                $eligibleAuthCount = 0
                if ($data.eligibleAuthorizations) {
                    $eligibleAuthCount = @($data.eligibleAuthorizations).Count
                }
'@

    AdditionalRowLoops = @()

    TagLoop = @{
        Variable = 'Tag'
        Source = '$Tags'
        Preamble = ''
    }

    Fields = @(
        @{
            Name = 'ID'
            Expression = '$1.id'
        }
        @{
            Name = 'Subscription'
            Expression = '$sub1.Name'
        }
        @{
            Name = 'Registration Name'
            Expression = '$1.NAME'
        }
        @{
            Name = 'Description'
            Expression = '$description'
        }
        @{
            Name = 'Registration ID'
            Expression = '$registrationId'
        }
        @{
            Name = 'Managed By Tenant ID'
            Expression = '$managedByTenantId'
        }
        @{
            Name = 'Managed By Tenant Name'
            Expression = '$managedByTenantName'
        }
        @{
            Name = 'Authorizations'
            Expression = '$authStr'
        }
        @{
            Name = 'Authorization Count'
            Expression = '$authorizations.Count'
        }
        @{
            Name = 'Eligible Authorizations'
            Expression = '$eligibleAuthCount'
        }
        @{
            Name = 'Provisioning State'
            Expression = '$provisioningState'
        }
        @{
            Name = 'Resource U'
            Expression = '$ResUCount'
        }
        @{
            Name = 'Tag Name'
            Expression = '[string]$Tag.Name'
        }
        @{
            Name = 'Tag Value'
            Expression = '[string]$Tag.Value'
        }
    )

    Export = @{
        WorksheetName = 'Lighthouse Delegations'
        TableNamePrefix = 'LighthouseTable_'
        Columns = @(
            'Subscription'
            'Registration Name'
            'Description'
            'Registration ID'
            'Managed By Tenant ID'
            'Managed By Tenant Name'
            'Authorizations'
            'Authorization Count'
            'Eligible Authorizations'
            'Provisioning State'
            'Resource U'
        )
        TagColumns = @(
            'Tag Name'
            'Tag Value'
        )
        TagColumnsBefore = 'Resource U'
        NumberFormat = '0'
        ConditionalText = @()
    }

    SourceCollector = 'Modules/Public/InventoryModules/Management/LighthouseDelegations.ps1'
}