IDBridge

26.7.13.0

Templates/Config/IDBridgeConfig.psd1

# IDBridgeConfig.psd1 — generated by New-IDBridgeConfig
# Every feature is disabled. Replace the placeholder values, then enable features one at a time.

@{
    # ── Debug / Run Modes ─────────────────────────────────────────────────────
    Debug = @{
        ReadOnly     = $true    # Set $false to actually write changes
        TestRun      = $false   # Set $true to only process a subset of users for faster testing
        SkipADCheck  = $false   # Set $true to skip the AD module check at startup
        TraceLogging = $true   # Set $false to disable verbose/trace logging
    }

    # ── Change Safety ─────────────────────────────────────────────────────────
    ChangeThreshold = @{
        Enabled    = $true   # Set $false (or run -SkipChangeThreshold) to bypass the guard
        Percentage = 25      # Abort the run if proposed lifecycle changes exceed this % of the managed population
    }

    # ── Google Token ──────────────────────────────────────────────────────────
    GoogleToken = @{
        Enabled = $false   # Set $true once the GoogleAuth-ServiceAccount secret is seeded
    }

    # ── Google Workspace ──────────────────────────────────────────────────────
    Google = @{
        enabled                     = $false
        customerID                  = 'C00000000'         # Workspace customer ID
        userRootOU                  = '/YourDistrict'     # Managed root OU path; anchors the ChangeThreshold safety guard's population count
        enableGroupProcessing       = $false
        enableGroupProcessingWhatIf = $true    # Log-only while $true; set $false to actually apply group changes
        enableGroupProcessingRemove = $false   # Set $true to allow group membership removals
        enableGroupProcessingTrash  = $false   # Set $true to strip group memberships on deactivate
        enableLicenseRemoval        = $false   # Set $true to remove paid license assignments on deactivate (the base license self-releases when the user is archived)
        groupsExcluded              = @('classroom_teachers@*')   # Group email patterns IDBridge never touches (no adds/removes/deactivate strips)
        # licenseProductIds = @('101031', '101037') # Paid products searched for license assignments
    }

    # ── Active Directory ──────────────────────────────────────────────────────
    AD = @{
        enabled                     = $false
        userRootOU                  = 'OU=YourDistrict,DC=yourdomain,DC=local'   # Managed root OU DN; anchors the ChangeThreshold safety guard's population count
        enableGroupProcessing       = $false
        enableGroupProcessingWhatIf = $true    # Log-only while $true; set $false to actually apply group changes
        enableGroupProcessingRemove = $false   # Set $true to allow group membership removals
        enableGroupProcessingTrash  = $false   # Set $true to strip group memberships on deactivate
        groupsExcluded              = @()      # Group name patterns IDBridge never touches (no adds/removes/deactivate strips)
    }

    # ── Google Log ────────────────────────────────────────────────────────────
    Logging = @{
        GoogleSheetLoggingEnabled = $false
        SheetID                   = 'your-log-spreadsheet-id'   # Target spreadsheet ID for logs
    }

    # ── Telemetry (see PRIVACY.md) ────────────────────────────────────────────
    Telemetry = @{
        Tier = 'Basic'   # 'Basic' (default - anonymous counts) | 'Enhanced' (adds install SiteID + error class on failures) | 'Off'
    }

    # ── Secrets ───────────────────────────────────────────────────────────────
    Secrets = @{
        Provider = 'Cms'   # 'Cms' (certificate, default) | 'DpapiNG' (gMSA) | 'AzKeyVault' (Azure Key Vault, remote)

        Cms = @{
            Thumbprint = ''   # From New-IDBridgeSecretCertificate; empty = find the single 'CN=IDBridge Secrets' cert
        }

        # DpapiNG provider: uncomment and set Provider = 'DpapiNG' to use it.
        # DpapiNG = @{
        # ProtectionDescriptor = 'SID=<gMSA SID> OR SID=<admins group SID>' # AD principal(s) secrets are protected to
        # }

        # AzKeyVault provider: uncomment and set Provider = 'AzKeyVault' to use it.
        # AzKeyVault = @{
        # VaultUri = 'https://your-vault.vault.azure.net/' # Key Vault URI
        # TenantId = 'yourtenant.onmicrosoft.com' # Entra tenant ID or domain
        # ClientId = '00000000-0000-0000-0000-000000000000' # App registration (client) ID
        # CertThumbprint = '' # Auth certificate thumbprint
        # }
    }

    # ── Plugins ───────────────────────────────────────────────────────────────
    # Templates for these were copied to <RootPath>\Plugins — edit their placeholder
    # values for your district, then set Enabled = $true. (The PostRun report and
    # export plugins have no placeholders — they work as-is once enabled.)
    Plugins = @(
        @{ Enabled = $false; Type = "Source"; Function = 'Invoke-PluginGSheetStaff' }
        @{ Enabled = $false; Type = "Source"; Function = 'Invoke-PluginSkywardSMSStudents' }
        @{ Enabled = $false; Type = "Override"; Function = 'Invoke-PluginStaffOverride' }
        @{ Enabled = $false; Type = "PostRun"; Function = 'Invoke-PluginPostRunReport' }
        @{ Enabled = $false; Type = "PostRun"; Function = 'Invoke-PluginPostRunWebhook' }
        @{ Enabled = $false; Type = "PostRun"; Function = 'Invoke-PluginPostRunExport' }
    )
}