Private/Get-EMOSCATargetedGroupIds.ps1
|
function Get-EMOSCATargetedGroupIds { <# .SYNOPSIS Returns a list of group IDs targeted by any Conditional Access policy. Used for blast-radius enrichment. #> [OutputType([string[]])] param() $groupIds = [System.Collections.Generic.HashSet[string]]::new() try { $policies = Invoke-EMOSGraphRequest -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies?`$select=id,displayName,conditions" foreach ($policy in $policies) { $includeGroups = $policy.conditions?.users?.includeGroups $excludeGroups = $policy.conditions?.users?.excludeGroups foreach ($g in @($includeGroups) + @($excludeGroups)) { if ($g) { [void]$groupIds.Add($g) } } } } catch { Write-Warning "Could not retrieve CA policies for blast-radius analysis: $_" } return [string[]]$groupIds } |