IntuneAccess

1.0.0

Private/Get-IntuneAccessAuditedResources.ps1

function Get-IntuneAccessAuditedResources {
    [CmdletBinding()]
    param(
        [switch] $IncludeExtended
    )

    $requiredScopes = @(
        'DeviceManagementConfiguration.Read.All', 'DeviceManagementApps.Read.All'
    )
    if ($IncludeExtended) { $requiredScopes += 'DeviceManagementScripts.Read.All' }
    $null = Assert-IntuneAccessConnection -RequiredScope $requiredScopes

    $sources = [System.Collections.Generic.List[object]]::new()
    $sources.Add([PSCustomObject] @{
        Type = 'Device configuration'
        NameProperty = 'displayName'
        StableUri = 'deviceManagement/deviceConfigurations?$select=id,displayName'
        BetaUri = 'deviceManagement/deviceConfigurations?$select=id,displayName,roleScopeTagIds,supportsScopeTags'
    })
    $sources.Add([PSCustomObject] @{
        Type = 'Mobile app'
        NameProperty = 'displayName'
        StableUri = 'deviceAppManagement/mobileApps?$select=id,displayName'
        BetaUri = 'deviceAppManagement/mobileApps?$select=id,displayName,roleScopeTagIds'
    })
    if ($IncludeExtended) {
        $sources.Add([PSCustomObject] @{
            Type = 'Compliance policy'
            NameProperty = 'displayName'
            StableUri = 'deviceManagement/deviceCompliancePolicies?$select=id,displayName'
            BetaUri = 'deviceManagement/deviceCompliancePolicies?$select=id,displayName,roleScopeTagIds'
        })
        $sources.Add([PSCustomObject] @{
            Type = 'Settings Catalog or endpoint security policy'
            NameProperty = 'name'
            StableUri = $null
            BetaUri = 'deviceManagement/configurationPolicies?$select=id,name,roleScopeTagIds,templateReference'
        })
        $sources.Add([PSCustomObject] @{
            Type = 'Remediation or device health script'
            NameProperty = 'displayName'
            StableUri = $null
            BetaUri = 'deviceManagement/deviceHealthScripts?$select=id,displayName,roleScopeTagIds,deviceHealthScriptType'
        })
    }
    $resources = [System.Collections.Generic.List[object]]::new()
    foreach ($source in $sources) {
        $stableItems = @()
        if (-not [string]::IsNullOrWhiteSpace([string] $source.StableUri)) {
            $stableItems = @(Invoke-IntuneAccessGraphRequest -Uri $source.StableUri)
        }
        $betaItems = @()
        try {
            $betaItems = @(Invoke-IntuneAccessGraphRequest -Uri $source.BetaUri -ApiVersion beta)
            if ([string]::IsNullOrWhiteSpace([string] $source.StableUri)) {
                $stableItems = @($betaItems)
            }
        }
        catch {
            Write-Warning "Beta scope-tag enrichment failed for $($source.Type) resources. Stable v1.0 objects are retained with missing tag data. $($_.Exception.Message)"
        }

        foreach ($item in $stableItems) {
            $itemId = [string] (Get-IntuneAccessProperty $item 'id')
            $betaItem = $betaItems | Where-Object {
                [string] (Get-IntuneAccessProperty $_ 'id') -eq $itemId
            } | Select-Object -First 1
            $missingValue = [object]::new()
            $tagValue = Get-IntuneAccessProperty $betaItem 'roleScopeTagIds' $missingValue
            $tagDataState = if ([object]::ReferenceEquals($tagValue, $missingValue)) { 'Missing' } else { 'Available' }
            $tagIds = @(
                $(if ($tagDataState -eq 'Missing') { @() } else { @($tagValue) }) |
                    ForEach-Object { [string] $_ } |
                    Where-Object { -not [string]::IsNullOrWhiteSpace($_) }
            )
            if ($tagDataState -eq 'Available' -and $tagIds.Count -eq 0) {
                $tagIds = @('0')
            }
            $resources.Add([PSCustomObject] @{
                ResourceType    = $source.Type
                ResourceId      = [string] (Get-IntuneAccessProperty $item 'id')
                ResourceName    = [string] (Get-IntuneAccessProperty $item $source.NameProperty)
                ScopeTagIds     = $tagIds
                ScopeTagDataState = $tagDataState
                SupportsScopeTags = Get-IntuneAccessProperty $betaItem 'supportsScopeTags' $null
                SourceApiVersion = if ([string]::IsNullOrWhiteSpace([string] $source.StableUri)) { 'beta' } else { 'v1.0+beta' }
                PropertySource = [PSCustomObject] @{
                    Identity = if ([string]::IsNullOrWhiteSpace([string] $source.StableUri)) { 'beta' } else { 'v1.0' }
                    ScopeTags = if ($tagDataState -eq 'Available') { 'beta' } else { 'Missing' }
                }
            })
        }
    }
    return $resources.ToArray()
}