Invoke-ConditionalAccessDocumentation.ps1

<#PSScriptInfo
 
.VERSION 1.1.8
 
.GUID 6c861af7-d12e-4ea2-b5dc-56fee16e0107
 
.AUTHOR Nicola Suter
 
.TAGS ConditionalAccess, AzureAD, Identity
     
.PROJECTURI https://github.com/nicolonsky/ConditionalAccessDocumentation
 
.ICONURI https://raw.githubusercontent.com/microsoftgraph/g-raph/master/g-raph.png
 
.DESCRIPTION This script documents Azure AD Conditional Access Policies.
 
.SYNOPSIS This script retrieves all Conditional Access Policies and translates Azure AD Object ID's to display names for users, groups, directory roles, locations...
.EXAMPLE
    & "C:\Repos\GitHub\ConditionalAccessDocumentation\Invoke-ConditionalAccessDocumentation.ps1"
    Generates the documentation and exports the csv to the script directory.
.NOTES
    Author: Nicola Suter
    Creation Date: 05.05.2020
    Purpose/Change: Initial script development
#>


#Requires -Module @{ ModuleName = 'Microsoft.Graph.Identity.ConditionalAccess'; ModuleVersion = '0.5.1'}, @{ ModuleName = 'Microsoft.Graph.Authentication'; ModuleVersion = '0.5.1'}, @{ ModuleName = 'Microsoft.Graph.Identity.ServicePrincipal'; ModuleVersion = '0.5.1'}, @{ ModuleName = 'Microsoft.Graph.Identity.DirectoryRoleTemplates'; ModuleVersion = '0.5.1'}, @{ ModuleName = 'Microsoft.Graph.Users.User'; ModuleVersion = '0.5.1'}, @{ ModuleName = 'Microsoft.Graph.Groups.Group'; ModuleVersion = '0.5.1'}

function Test-Guid
{
    <#
    .SYNOPSIS
    Validates a given input string and checks string is a valid GUID
    .DESCRIPTION
    Validates a given input string and checks string is a valid GUID by using the .NET method Guid.TryParse
    .EXAMPLE
    Test-Guid -InputObject "3363e9e1-00d8-45a1-9c0c-b93ee03f8c13"
    .NOTES
    Uses .NET method [guid]::TryParse()
    #>

    [Cmdletbinding()]
    [OutputType([bool])]
    param
    (
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipelineByPropertyName = $true)]
        [AllowEmptyString()]
        [string]$InputObject
    )
    process{
        return [guid]::TryParse($InputObject, $([ref][guid]::Empty))
    }
}

if ($null -eq $(Get-MgContext)){
    Throw "Authentication needed, call 'Connect-Graph -Scopes @(`"Application.Read.All`", `"Group.Read.All`", `"Policy.Read.All`", `"RoleManagement.Read.Directory`", `"User.Read.All`")'."
}

# Lookup table for application ID's
$lookupTable = @{
    "00000004-0000-0ff1-ce00-000000000000" ="Microsoft.Lync"
    "00000006-0000-0ff1-ce00-000000000000" ="Microsoft.Office365Portal"
    "00000003-0000-0ff1-ce00-000000000000" ="Microsoft.SharePoint"
    "00000005-0000-0000-c000-000000000000" ="Microsoft.Azure.Workflow"
    "00000009-0000-0000-c000-000000000000" ="Microsoft.Azure.AnalysisServices"
    "00000002-0000-0ff1-ce00-000000000000" ="Microsoft.Exchange"
    "00000007-0000-0ff1-ce00-000000000000" ="Microsoft.ExchangeOnlineProtection"
    "00000002-0000-0000-c000-000000000000" ="Microsoft.Azure.ActiveDirectory"
    "8fca0a66-c008-4564-a876-ab3ae0fd5cff" ="Microsoft.SMIT"
    "0000000b-0000-0000-c000-000000000000" ="Microsoft.SellerDashboard"
    "0000000f-0000-0000-c000-000000000000" ="Microsoft.Azure.GraphExplorer"
    "0000000c-0000-0000-c000-000000000000" ="MicrosoftAppAccessPanel"
    "00000013-0000-0000-c000-000000000000" ="Microsoft.Azure.Portal"
    "00000010-0000-0000-c000-000000000000" ="Microsoft.Azure.GraphStore"
    "93ee9413-cf4c-4d4e-814b-a91ff20a01bd" ="Workflow"
    "aa9ecb1e-fd53-4aaa-a8fe-7a54de2c1334" ="Microsoft.Office365.Configure"
    "797f4846-ba00-4fd7-ba43-dac1f8f63013" ="WindowsAzureServiceManagementAPI"
    "00000005-0000-0ff1-ce00-000000000000" ="Microsoft.YammerEnterprise"
    "601d4e27-7bb3-4dee-8199-90d47d527e1c" ="Microsoft.Office365.ChangeManagement"
    "6f82282e-0070-4e78-bc23-e6320c5fa7de" ="Microsoft.DiscoveryService"
    "0f698dd4-f011-4d23-a33e-b36416dcb1e6" ="Microsoft.OfficeClientService"
    "67e3df25-268a-4324-a550-0de1c7f97287" ="Microsoft.OfficeWebAppsService"
    "ab27a73e-a3ba-4e43-8360-8bcc717114d8" ="Microsoft.OfficeModernCalendar"
    "aedca418-a84d-430d-ab84-0b1ef06f318f" ="Workflow"
    "595d87a1-277b-4c0a-aa7f-44f8a068eafc" ="Microsoft.SupportTicketSubmission"
    "e3583ad2-c781-4224-9b91-ad15a8179ba0" ="Microsoft.ExtensibleRealUserMonitoring"
    "b645896d-566e-447e-8f7f-e2e663b5d182" ="OpsDashSharePointApp"
    "48229a4a-9f1d-413a-8b96-4c02462c0360" ="OpsDashSharePointApp"
    "48717084-a59c-4306-9dc4-3f618dbecdf9" ="Office365DevelopmentTools"
    "c859ff33-eb41-4ba6-8093-a2c5153bbd7c" ="Workflow"
    "67cad61c-3411-48d7-ab73-561c64f11ed6" ="Workflow"
    "914ed757-9257-4200-b68e-a2bed2f12c5a" ="RbacBackfill"
    "499b84ac-1321-427f-aa17-267ca6975798" ="Microsoft.VisualStudio.Online"
    "b2590339-0887-4e94-93aa-13357eb510d7" ="Workflow"
    "0000001b-0000-0000-c000-000000000000" ="MicrosoftPowerBIInformationService"
    "89f80565-bfac-4c01-9535-9f0eba332ffe" ="PowerBI"
    "433895fb-4ec7-45c3-a53c-c44d10f80d5b" ="CompromisedAccountService"
    "d7c17728-4f1e-4a1e-86cf-7e0adf3fe903" ="Workflow"
    "17ef6d31-381f-4783-b186-7b440a3c85c1" ="Workflow"
    "00000012-0000-0000-c000-000000000000" ="Microsoft.Azure.RMS"
    "81ce94d4-9422-4c0d-a4b9-3250659366ce" ="Workflow"
    "8d3a7d3c-c034-4f19-a2ef-8412952a9671" ="MicrosoftOffice"
    "0469d4cd-df37-4d93-8a61-f8c75b809164" ="MicrosoftPolicyAdministrationService"
    "31d3f3f5-7267-45a8-9549-affb00110054" ="WindowsAzureRemoteAppService"
    "4e004241-32db-46c2-a86f-aaaba29bea9c" ="Workflow"
    "748d098e-7a3b-436d-8b0a-006a58b29647" ="Workflow"
    "dbf08535-1d3b-4f89-bf54-1d48dd613a61" ="Workflow"
    "ed9fe1ef-25a4-482f-9981-2b60f91e2448" ="Workflow"
    "8ad28d50-ee26-42fc-8a29-e41ea38461f2" ="Office365RESTAPIExplorer.Office365App"
    "38285dce-a13d-4107-9b04-3016b941bb3a" ="BasicDataOperationsREST"
    "92bb96c8-321c-47f9-bcc5-8849490c2b07" ="BasicSelfHostedAppREST"
    "488a57a0-00e2-4817-8c8d-cf8a15a994d2" ="WindowsFormsApplication2.Office365App"
    "11c174dc-1945-4a9a-a36b-c79a0f246b9b" ="AzureApplicationInsights"
    "e6acb561-0d94-4287-bd3a-3169f421b112" ="Tutum"
    "7b77b3a2-8490-49e1-8842-207cd0899af9" ="Nearpod"
    "0000000a-0000-0000-c000-000000000000" ="Microsoft.Intune"
    "93625bc8-bfe2-437a-97e0-3d0060024faa" ="SelfServicePasswordReset"
    "dee7ba80-6a55-4f3b-a86c-746a9231ae49" ="MicrosoftAppPlatEMA"
    "803ee9ca-3f7f-4824-bd6e-0b99d720c35c" ="AzureMediaService"
    "2d4d3d8e-2be3-4bef-9f87-7875a61c29de" ="OneNote"
    "8d40666e-5abf-45f6-a5e7-b7192d6d56ed" ="Workflow"
    "262044b1-e2ce-469f-a196-69ab7ada62d3" ="BackupManagementService"
    "087a2c70-c89e-463f-8dd3-e3959eabb1a9" ="MicrosoftProfileServicePlatformService"
    "7cd684f4-8a78-49b0-91ec-6a35d38739ba" ="AzureLogicApps"
    "c5393580-f805-4401-95e8-94b7a6ef2fc2" ="Office365ManagementAPIs"
    "96231a05-34ce-4eb4-aa6a-70759cbb5e83" ="MicrosoftAzureRedisCache"
    "b8340c3b-9267-498f-b21a-15d5547fd85e" ="Hyper-VRecoveryManager"
    "abfa0a7c-a6b6-4736-8310-5855508787cd" ="Microsoft.Azure.WebSites"
    "c44b4083-3bb0-49c1-b47d-974e53cbdf3c" ="IbizaPortal"
    "905fcf26-4eb7-48a0-9ff0-8dcc7194b5ba" ="Sway"
    "b10686fd-6ba8-49f2-a3cd-67e4d2f52ac8" ="NovoEd"
    "c606301c-f764-4e6b-aa45-7caaaea93c9a" ="OfficeStore"
    "569e8598-685b-4ba2-8bff-5bced483ac46" ="Evercontact"
    "20a23a2f-8c32-4de7-8063-8c8f909602c0" ="Workflow"
    "aaf214cc-8013-4b95-975f-13203ae36039" ="PowerBITiles"
    "d88a361a-d488-4271-a13f-a83df7dd99c2" ="IDMLGraphResolverServiceandCAD"
    "dff9b531-6290-4620-afce-26826a62a4e7" ="DocuSign"
    "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9" ="DeviceRegistrationService"
    "3290e3f7-d3ac-4165-bcef-cf4874fc4270" ="Smartsheet"
    "a4ee6867-8640-4495-b1fd-8b26037a5bd3" ="Workflow"
    "aa0e3dd4-df02-478d-869e-fc61dd71b6e8" ="Workflow"
    "0f6edad5-48f2-4585-a609-d252b1c52770" ="AIGraphClient"
    "0c8139b5-d545-4448-8d2b-2121bb242680" ="BillingExtension"
    "475226c6-020e-4fb2-8a90-7a972cbfc1d4" ="KratosAppsService"
    "39624784-6cbe-4a60-afbe-9f46d10fdb27" ="SkypeForBusinessRemotePowershell"
    "8bdebf23-c0fe-4187-a378-717ad86f6a53" ="ResourceHealthRP"
    "c161e42e-d4df-4a3d-9b42-e7a3c31f59d4" ="MicrosoftIntuneAPI"
    "9cb77803-d937-493e-9a3b-4b49de3f5a74" ="MicrosoftIntuneServiceDiscovery"
    "ddbf3205-c6bd-46ae-8127-60eb93363864" ="MicrosoftAzureBatch"
    "80ccca67-54bd-44ab-8625-4b79c4dc7775" ="ComplianceCenter"
    "0a5f63c0-b750-4f38-a71c-4fc0d58b89e2" ="MicrosoftMobileApplicationManagement"
    "e1335bb1-2aec-4f92-8140-0e6e61ae77e5" ="CIWebService"
    "75018fbe-21fe-4a57-b63c-83252b5eaf16" ="TeamImprover-TeamOrganizationChart"
    "a393296b-5695-4463-97cb-9fa8638a494a" ="MySharePointSites"
    "fe217466-5583-431c-9531-14ff7268b7b3" ="MicrosoftEducation"
    "5bfe8a29-054e-4348-9e7a-3981b26b125f" ="BingPlacesforBusiness"
    "eaf8a961-f56e-47eb-9ffd-936e22a554ef" ="DevilFish"
    "4b4b1d56-1f03-47d9-a0a3-87d4afc913c9" ="Wunderlist"
    "00000003-0000-0000-c000-000000000000" ="MicrosoftGraph"
    "60e6cd67-9c8c-4951-9b3c-23c25a2169af" ="ComputeResourceProvider"
    "507bc9da-c4e2-40cb-96a7-ac90df92685c" ="Office365Reports"
    "09abbdfd-ed23-44ee-a2d9-a627aa1c90f3" ="ProjectWorkManagement"
    "28ec9756-deaf-48b2-84d5-a623b99af263" ="OfficePersonalAssistantatWorkService"
    "9e4a5442-a5c9-4f6f-b03f-5b9fcaaf24b1" ="OfficeServicesManager"
    "3138fe80-4087-4b04-80a6-8866c738028a" ="SharePointNotificationService"
    "d2a0a418-0aac-4541-82b2-b3142c89da77" ="MicrosoftAzureOperationalInsights"
    "2cf9eb86-36b5-49dc-86ae-9a63135dfa8c" ="AzureTrafficManagerandDNS"
    "32613fc5-e7ac-4894-ac94-fbc39c9f3e4a" ="OAuthSandbox"
    "925eb0d0-da50-4604-a19f-bd8de9147958" ="GroupiesWebService"
    "e4ab13ed-33cb-41b4-9140-6e264582cf85" ="AzureSQLDatabaseBackupToAzureBackupVault"
    "ad230543-afbe-4bb4-ac4f-d94d101704f8" ="ApiaryforPowerBI"
    "11cd3e2e-fccb-42ad-ad00-878b93575e07" ="AutomatedCallDistribution"
    "de17788e-c765-4d31-aba4-fb837cfff174" ="SkypeforBusinessManagementReportingandAnalytics"
    "65d91a3d-ab74-42e6-8a2f-0add61688c74" ="MicrosoftApprovalManagement"
    "5225545c-3ebd-400f-b668-c8d78550d776" ="OfficeAgentService"
    "1cda9b54-9852-4a5a-96d4-c2ab174f9edf" ="O365Account"
    "4747d38e-36c5-4bc3-979b-b0ef74df54d1" ="PushChannel"
    "b97b6bd4-a49f-4a0c-af18-af507d1da76c" ="OfficeShreddingService"
    "d4ebce55-015a-49b5-a083-c84d1797ae8c" ="MicrosoftIntuneEnrollment"
    "5b20c633-9a48-4a5f-95f6-dae91879051f" ="AzureInformationProtection"
    "441509e5-a165-4363-8ee7-bcf0b7d26739" ="EnterpriseAgentPlatform"
    "e691bce4-6612-4025-b94c-81372a99f77e" ="Boomerang"
    "8edd93e1-2103-40b4-bd70-6e34e586362d" ="WindowsAzureSecurityResourceProvider"
    "94c63fef-13a3-47bc-8074-75af8c65887a" ="OfficeDelve"
    "e95d8bee-4725-4f59-910d-94d415da51b9" ="SkypeforBusinessNameDictionaryService"
    "e3c5dbcd-bb5f-4bda-b943-adc7a5bbc65e" ="Workflow"
    "8602e328-9b72-4f2d-a4ae-1387d013a2b3" ="AzureAPIManagement"
    "8b3391f4-af01-4ee8-b4ea-9871b2499735" ="O365SecureScore"
    "c26550d6-bc82-4484-82ca-ac1c75308ca3" ="Office365YammerOnOls"
    "33be1cef-03fb-444b-8fd3-08ca1b4d803f" ="OneDriveWeb"
    "dcad865d-9257-4521-ad4d-bae3e137b345" ="MicrosoftSharePointOnline-SharePointHome"
    "b2cc270f-563e-4d8a-af47-f00963a71dcd" ="OneProfileService"
    "4660504c-45b3-4674-a709-71951a6b0763" ="MicrosoftInvitationAcceptancePortal"
    "ba23cd2a-306c-48f2-9d62-d3ecd372dfe4" ="OfficeGraph"
    "d52485ee-4609-4f6b-b3a3-68b6f841fa23" ="On-PremisesDataGatewayConnector"
    "996def3d-b36c-4153-8607-a6fd3c01b89f" ="Dynamics365forFinancials"
    "b6b84568-6c01-4981-a80f-09da9a20bbed" ="MicrosoftInvoicing"
    "9d3e55ba-79e0-4b7c-af50-dc460b81dca1" ="MicrosoftAzureDataCatalog"
    "4345a7b9-9a63-4910-a426-35363201d503" ="O365SuiteUX"
    "ac815d4a-573b-4174-b38e-46490d19f894" ="Workflow"
    "bb8f18b0-9c38-48c9-a847-e1ef3af0602d" ="Microsoft.Azure.ActiveDirectoryIUX"
    "cc15fd57-2c6c-4117-a88c-83b1d56b4bbe" ="MicrosoftTeamsServices"
    "5e3ce6c0-2b1f-4285-8d4b-75ee78787346" ="SkypeTeams"
    "1fec8e78-bce4-4aaf-ab1b-5451cc387264" ="MicrosoftTeams"
    "6d32b7f8-782e-43e0-ac47-aaad9f4eb839" ="PermissionServiceO365"
    "cdccd920-384b-4a25-897d-75161a4b74c1" ="SkypeTeamsFirehose"
    "1c0ae35a-e2ec-4592-8e08-c40884656fa5" ="SkypeTeamSubstrateconnector"
    "cf6c77f8-914f-4078-baef-e39a5181158b" ="SkypeTeamsSettingsStore"
    "64f79cb9-9c82-4199-b85b-77e35b7dcbcb" ="MicrosoftTeamsBots"
    "b7912db9-aa33-4820-9d4f-709830fdd78f" ="ConnectionsService"
    "82f77645-8a66-4745-bcdf-9706824f9ad0" ="PowerAppsRuntimeService"
    "6204c1d1-4712-4c46-a7d9-3ed63d992682" ="MicrosoftFlowPortal"
    "7df0a125-d3be-4c96-aa54-591f83ff541c" ="MicrosoftFlowService"
    "331cc017-5973-4173-b270-f0042fddfd75" ="PowerAppsService"
    "0a0e9e37-25e3-47d4-964c-5b8237cad19a" ="CloudSponge"
    "df09ff61-2178-45d8-888c-4210c1c7b0b2" ="O365UAPProcessor"
    "8338dec2-e1b3-48f7-8438-20c30a534458" ="ViewPoint"
    "00000001-0000-0000-c000-000000000000" ="AzureESTSService"
    "394866fc-eedb-4f01-8536-3ff84b16be2a" ="MicrosoftPeopleCardsService"
    "0a0a29f9-0a25-49c7-94bf-c53c3f8fa69d" ="CortanaExperiencewithO365"
    "bb2a2e3a-c5e7-4f0a-88e0-8e01fd3fc1f4" ="CPIMService"
    "0004c632-673b-4105-9bb6-f3bbd2a927fe" ="PowerAppsandFlow"
    "d3ce4cf8-6810-442d-b42e-375e14710095" ="GraphExplorer"
    "3aa5c166-136f-40eb-9066-33ac63099211" ="O365CustomerMonitoring"
    "d6fdaa33-e821-4211-83d0-cf74736489e1" ="MicrosoftServiceTrust"
    "ef4a2a24-4b4e-4abf-93ba-cc11c5bd442c" ="Edmodo"
    "b692184e-b47f-4706-b352-84b288d2d9ee" ="Microsoft.MileIQ.RESTService"
    "a25dbca8-4e60-48e5-80a2-0664fdb5c9b6" ="Microsoft.MileIQ"
    "f7069a8d-9edc-4300-b365-ae53c9627fc4" ="Microsoft.MileIQ.Dashboard"
    "02e3ae74-c151-4bda-b8f0-55fbf341de08" ="ApplicationRegistrationPortal"
    "1f5530b3-261a-47a9-b357-ded261e17918" ="AzureMulti-FactorAuthConnector"
    "981f26a1-7f43-403b-a875-f8b09b8cd720" ="AzureMulti-FactorAuthClient"
    "6ea8091b-151d-447a-9013-6845b83ba57b" ="ADHybridHealth"
    "fc68d9e5-1f76-45ef-99aa-214805418498" ="AzureADIdentityProtection"
    "01fc33a7-78ba-4d2f-a4b7-768e336e890e" ="MS-PIM"
    "a6aa9161-5291-40bb-8c5c-923b567bee3b" ="StorageResourceProvider"
    "4e9b8b9a-1001-4017-8dd1-6e8f25e19d13" ="AdobeAcrobat"
    "159b90bb-bb28-4568-ad7c-adad6b814a2f" ="LastPass"
    "b4bddae8-ab25-483e-8670-df09b9f1d0ea" ="Signup"
    "aa580612-c342-4ace-9055-8edee43ccb89" ="MicrosoftStaffHub"
    "51133ff5-8e0d-4078-bcca-84fb7f905b64" ="MicrosoftTeamsMailhook"
    "ab3be6b7-f5df-413d-ac2d-abf1e3fd9c0b" ="MicrosoftTeamsGraphService"
    "b1379a75-ce5e-4fa3-80c6-89bb39bf646c" ="MicrosoftTeamsChatAggregator"
    "48af08dc-f6d2-435f-b2a7-069abd99c086" ="Connectors"
    "d676e816-a17b-416b-ac1a-05ad96f43686" ="Workflow"
    "cfa8b339-82a2-471a-a3c9-0fc0be7a4093" ="AzureKeyVault"
    "c2f89f53-3971-4e09-8656-18eed74aee10" ="calendly"
    "6da466b6-1d13-4a2c-97bd-51a99e8d4d74" ="ExchangeOfficeGraphClientforAAD-Interactive"
    "0eda3b13-ddc9-4c25-b7dd-2f6ea073d6b7" ="MicrosoftFlowCDSIntegrationService"
    "eacba838-453c-4d3e-8c6a-eb815d3469a3" ="MicrosoftFlowCDSIntegrationServiceTIP1"
    "4ac7d521-0382-477b-b0f8-7e1d95f85ca2" ="SQLServerAnalysisServicesAzure"
    "b4114287-89e4-4209-bd99-b7d4919bcf64" ="OfficeDelve"
    "4580fd1d-e5a3-4f56-9ad1-aab0e3bf8f76" ="CallRecorder"
    "a855a166-fd92-4c76-b60d-a791e0762432" ="MicrosoftTeamsVSTS"
    "c37c294f-eec8-47d2-b3e2-fc3daa8f77d3" ="Workflow"
    "fc75330b-179d-49af-87dd-3b1acf6827fa" ="AzureAutomationAADPatchS2S"
    "766d89a4-d6a6-444d-8a5e-e1a18622288a" ="OneDrive"
    "f16c4a38-5aff-4549-8199-ee7d3c5bd8dc" ="Workflow"
    "4c4f550b-42b2-4a16-93f9-fdb9e01bb6ed" ="TargetedMessagingService"
    "765fe668-04e7-42ba-aec0-2c96f1d8b652" ="ExchangeOfficeGraphClientforAAD-Noninteractive"
    "0130cc9f-7ac5-4026-bd5f-80a08a54e6d9" ="AzureDataWarehousePolybase"
    "a1cf9e0a-fe14-487c-beb9-dd3360921173" ="Meetup"
    "76cd24bf-a9fc-4344-b1dc-908275de6d6d" ="AzureSQLVirtualNetworktoNetworkResourceProvider"
    "9f505dbd-a32c-4685-b1c6-72e4ef704cb0" ="AmazonAlexa"
    "1e2ca66a-c176-45ea-a877-e87f7231e0ee" ="MicrosoftB2BAdminWorker"
    "2634dd23-5e5a-431c-81ca-11710d9079f4" ="MicrosoftStreamService"
    "cf53fce8-def6-4aeb-8d30-b158e7b1cf83" ="MicrosoftStreamPortal"
    "c9a559d2-7aab-4f13-a6ed-e7e9c52aec87" ="MicrosoftForms"
    "978877ea-b2d6-458b-80c7-05df932f3723" ="MicrosoftTeamsAuditService"
    "dbc36ae1-c097-4df9-8d94-343c3d091a76" ="ServiceEncryption"
    "fa7ff576-8e31-4a58-a5e5-780c1cd57caa" ="OneNote"
    "cb4dc29f-0bf4-402a-8b30-7511498ed654" ="PowerBIPremium"
    "f5aeb603-2a64-4f37-b9a8-b544f3542865" ="MicrosoftTeamsRetentionHookService"
    "da109bdd-abda-4c06-8808-4655199420f8" ="GlipContacts"
    "76c7f279-7959-468f-8943-3954880e0d8c" ="AzureSQLManagedInstancetoMicrosoft.Network"
    "3a9ddf38-83f3-4ea1-a33a-ecf934644e2d" ="ProtectedMessageViewer"
    "5635d99c-c364-4411-90eb-764a511b5fdf" ="ResponsiveBannerSlider"
    "a43e5392-f48b-46a4-a0f1-098b5eeb4757" ="Cloudsponge"
    "d73f4b35-55c9-48c7-8b10-651f6f2acb2e" ="MCAPIAuthorizationProd"
    "166f1b03-5b19-416f-a94b-1d7aa2d247dc" ="OfficeHive"
    "b815ce1c-748f-4b1e-9270-a42c1fa4485a" ="Workflow"
    "bd7b778b-4aa8-4cde-8d90-8aeb821c0bd2" ="Workflow"
    "9d06afd9-66c9-49a6-b385-ea7509332b0b" ="O365SBRMService"
    "9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7" ="Bing"
    "57fb890c-0dab-4253-a5e0-7188c88b2bb4" ="SharePointOnlineClient"
    "45c10911-200f-4e27-a666-9e9fca147395" ="drawio"
    "b73f62d0-210b-4396-a4c5-ea50c4fab79b" ="SkypeBusinessVoiceFraudDetectionandPrevention"
    "bc59ab01-8403-45c6-8796-ac3ef710b3e3" ="OutlookOnlineAdd-inApp"
    "035f9e1d-4f00-4419-bf50-bf2d87eb4878" ="AzureMonitorRestricted"
    "7c33bfcb-8d33-48d6-8e60-dc6404003489" ="NetworkWatcher"
    "a0be0c72-870e-46f0-9c49-c98333a996f7" ="AzureDnsFrontendApp"
    "1e3e4475-288f-4018-a376-df66fd7fac5f" ="NetworkTrafficAnalyticsService"
    "7557eb47-c689-4224-abcf-aef9bd7573df" ="SkypeforBusiness"
    "c39c9bac-9d1f-4dfb-aa29-27f6365e5cb7" ="AzureAdvisor"
    "2087bd82-7206-4c0a-b305-1321a39e5926" ="MicrosoftTo-Do"
    "f8d98a96-0999-43f5-8af3-69971c7bb423" ="iOSAccounts"
    "c27373d3-335f-4b45-8af9-fe81c240d377" ="P2PServer"
    "5c2ffddc-f1d7-4dc3-926e-3c1bd98e32bd" ="RITSDev"
    "982bda36-4632-4165-a46a-9863b1bbcf7d" ="O365Demeter"
    "98c8388a-4e86-424f-a176-d1288462816f" ="OfficeFeedProcessors"
    "bf9fc203-c1ff-4fd4-878b-323642e462ec" ="JarvisTransactionService"
    "257601fd-462f-4a21-b623-7f719f0f90f4" ="CentralizedDeployment"
    "2a486b53-dbd2-49c0-a2bc-278bdfc30833" ="CortanaatWorkService"
    "22d7579f-06c2-4baa-89d2-e844486adb9d" ="CortanaatWorkBingServices"
    "4c8f074c-e32b-4ba7-b072-0f39d71daf51" ="IPSubstrate"
    "a164aee5-7d0a-46bb-9404-37421d58bdf7" ="MicrosoftTeamsAuthSvc"
    "354b5b6d-abd6-4736-9f51-1be80049b91f" ="MicrosoftMobileApplicationManagementBackend"
    "82b293b2-d54d-4d59-9a95-39c1c97954a7" ="TasksinaBox"
    "fdc83783-b652-4258-a622-66bc85f1a871" ="FedExPackageTracking"
    "d0597157-f0ae-4e23-b06c-9e65de434c4f" ="MicrosoftTeamsTaskService"
    "f5c26e74-f226-4ae8-85f0-b4af0080ac9e" ="ApplicationInsightsAPI"
    "57c0fc58-a83a-41d0-8ae9-08952659bdfd" ="AzureCosmosDBVirtualNetworkToNetworkResourceProvider"
    "744e50be-c4ff-4e90-8061-cd7f1fabac0b" ="LinkedInMicrosoftGraphConnector"
    "823dfde0-1b9a-415a-a35a-1ad34e16dd44" ="MicrosoftTeamsWikiImagesMigration"
    "3ab9b3bc-762f-4d62-82f7-7e1d653ce29f" ="MicrosoftVolumeLicensing"
    "44eb7794-0e11-42b6-800b-dc31874f9f60" ="Alignable"
    "c58637bb-e2e1-4312-8a00-04b5ffcd3403" ="SharePointOnlineClientExtensibility"
    "62b732f7-fc71-40bc-b27d-35efcb0509de" ="MicrosoftTeamsAadSync"
    "07978fee-621a-42df-82bb-3eabc6511c26" ="SurveyMonkey"
    "47ee738b-3f1a-4fc7-ab11-37e4822b007e" ="AzureADApplicationProxy"
    "00000007-0000-0000-c000-000000000000" ="DynamicsCRMOnline"
    "913c6de4-2a4a-4a61-a9ce-945d2b2ce2e0" ="DynamicsLifecycleservices"
    "f217ad13-46b8-4c5b-b661-876ccdf37302" ="AttachOneDrivefilestoAsana"
    "00000008-0000-0000-c000-000000000000" ="Microsoft.Azure.DataMarket"
    "9b06ebd4-9068-486b-bdd2-dac26b8a5a7a" ="Microsoft.DynamicsMarketing"
    "e8ab36af-d4be-4833-a38b-4d6cf1cfd525" ="MicrosoftSocialEngagement"
    "8909aac3-be91-470c-8a0b-ff09d669af91" ="MicrosoftParatureDynamicsCRM"
    "71234da4-b92f-429d-b8ec-6e62652e50d7" ="MicrosoftCustomerEngagementPortal"
    "b861dbcc-a7ef-4219-a005-0e4de4ea7dcf" ="DataExportServiceforMicrosoftDynamics365"
    "2db8cb1d-fb6c-450b-ab09-49b6ae35186b" ="MicrosoftDynamicsCRMLearningPath"
    "2e49aa60-1bd3-43b6-8ab6-03ada3d9f08b" ="DynamicsDataIntegration"
    "d1ddf0e4-d672-4dae-b554-9d5bdfd93547" ="Microsoft Intune Powershell" 
}

# Get Conditional Access Policies
$conditionalAccessPolicies = Get-MgConditionalAccessPolicy
#Get Conditional Access Named / Trusted Locations
$namedLocations = Get-MgConditionalAccessNamedLocation
# Get Azure AD Directory Role Templates
$directoryRoleTemplates = Get-MgDirectoryRoleTemplate
# Get Azure AD Service Principals
$servicePrincipals = Get-MgServicePrincipal
# Init report
$conditionalAccessDocumentation = @()

# Process all Conditional Access Policies
foreach ($conditionalAccessPolicy in $conditionalAccessPolicies){

    # Display some progress (based on policy count)
    $currentIndex = $conditionalAccessPolicies.indexOf($conditionalAccessPolicy)
    Write-Progress -Activity "Generating Conditional Access Documentation..." -PercentComplete (($currentIndex + 1) / $conditionalAccessPolicies.Count * 100) `
    -CurrentOperation "Processing Policy '$($conditionalAccessPolicy.DisplayName)' ($currentIndex/$($conditionalAccessPolicies.Count))"

    try{
        # Resolve object ID's of included users
        $includeUsers = @() 
        $conditionalAccessPolicy.Conditions.UserIncludeUsers | ForEach-Object {
            if (Test-Guid $PSItem){
                $includeUsers += Get-MgUser -userId $PSItem | Select-Object -ExpandProperty DisplayName -ErrorAction Stop
            }else{
                $includeUsers += $PSItem
            }
        }
        # Resolve object ID's of excluded users
        $excludeUsers = @()
        $conditionalAccessPolicy.Conditions.UserExcludeUsers | ForEach-Object {
            if (Test-Guid $PSItem){
                $excludeUsers += Get-MgUser -userId $PSItem | Select-Object -ExpandProperty DisplayName -ErrorAction Stop
            }else{
                $excludeUsers += $PSItem
            }
        }
        # Resolve object ID's of included groups
        $includeGroups = @() 
        $conditionalAccessPolicy.Conditions.UserIncludeGroups | ForEach-Object {
            $includeGroups += Get-MgGroup -groupId $PSItem | Select-Object -ExpandProperty DisplayName
        }
        # Resolve object ID's of excluded groups
        $excludeGroups = @() 
        $conditionalAccessPolicy.Conditions.UserExcludeGroups | ForEach-Object {
            $excludeGroups += Get-MgGroup -groupId $PSItem | Select-Object -ExpandProperty DisplayName
        }
        # Resolve object ID's of included roles
        $includeRoles = @()
        $conditionalAccessPolicy.Conditions.UserIncludeRoles | ForEach-Object {
            $roleId = $PSItem
            $includeRoles += $directoryRoleTemplates | Where-Object {$PSItem.Id -eq $roleId} | Select-Object -ExpandProperty DisplayName
        }
        # Replace role display names if all selected
        $maxRoles = 56
        if ($includeRoles.Count -eq $maxRoles){
        $includeRoles = "All ($maxRoles)"
        }
        # Resolve object ID's of excluded roles
        $excludeRoles = @()
        $conditionalAccessPolicy.Conditions.UserExcludeRoles | ForEach-Object {
            $roleId = $PSItem
            $excludeRoles += $directoryRoleTemplates | Where-Object {$PSItem.Id -eq $roleId} | Select-Object -ExpandProperty DisplayName
        }
        # Resolve object ID's of included apps
        $includeApps = @()
        $conditionalAccessPolicy.Conditions.ApplicationIncludeApplications | ForEach-Object {
            $servicePrincipalId = $PSItem
            if (Test-Guid $PSItem){
                $res = $servicePrincipals | Where-Object {$PSItem.AppId -eq $servicePrincipalId} | Select-Object -ExpandProperty DisplayName
                if ($null -ne $res){
                    $includeApps += $res
                }else{

                    $res = $lookupTable[$servicePrincipalId]

                    if ($null -ne $res){
                        $includeApps += $res
                    }else{
                        $includeApps += $servicePrincipalId
                    }
                }
            } else {
                $includeApps += $servicePrincipalId
            }
        }
        # Resolve object ID's of excluded apps
        $excludeApps = @()
        $conditionalAccessPolicy.Conditions.ApplicationExcludeApplications | ForEach-Object {
            $servicePrincipalId = $PSItem
            if (Test-Guid $PSItem){
                $res = $servicePrincipals | Where-Object {$PSItem.AppId -eq $servicePrincipalId} | Select-Object -ExpandProperty DisplayName
                if ($null -ne $res){
                    $excludeApps += $res
                }else{

                    $res = $lookupTable[$servicePrincipalId]

                    if ($null -ne $res){
                        $excludeApps += $res
                    }else{
                        $excludeApps += $servicePrincipalId
                    }
                }
            } else {
                $excludeApps += $servicePrincipalId
            }
        }
        # Resolve object ID's of included locations
        $includeLocations = @()
        $conditionalAccessPolicy.Conditions.LocationIncludeLocations | ForEach-Object {
            $locationId = $PSItem
            if (Test-Guid $PSItem){
                $includeLocations += $namedLocations | Where-Object {$PSItem.Id -eq $locationId} | Select-Object -ExpandProperty DisplayName
            }else{
                $includeLocations += $locationId
            }
        }
        # Resolve object ID's of excluded locations
        $excludeLocations = @()
        $conditionalAccessPolicy.Conditions.LocationExcludeLocations | ForEach-Object {
            $locationId = $PSItem
            if (Test-Guid $PSItem){
                $excludeLocations += $namedLocations | Where-Object {$PSItem.Id -eq $locationId} | Select-Object -ExpandProperty DisplayName
            }else{
                $excludeLocations += $locationId
            }
        }

        # delimiter for arrays in csv report
        $separator = "`r`n"

        # Build custom object with properties
        $entry = [PSCustomObject]@{

            Name = $conditionalAccessPolicy.DisplayName
            State =  $conditionalAccessPolicy.State

            IncludeUsers = $includeUsers -join $separator
            IncludeGroups = $includeGroups -join $separator
            IncludeRoles = $includeRoles  -join $separator

            ExcludeUsers = $excludeUsers-join $separator
            ExcludeGroups = $excludeGroups -join $separator
            ExcludeRoles = $excludeRoles -join $separator

            IncludeApps = $includeApps -join $separator
            ExcludeApps = $excludeApps -join $separator

            IncludeUserActions = $conditionalAccessPolicy.Conditions.ApplicationIncludeUserActions -join $separator
            ClientAppTypes = $conditionalAccessPolicy.Conditions.ClientAppTypes -join $separator

            IncludePlatforms = $conditionalAccessPolicy.Conditions.PlatformIncludePlatforms -join $separator
            ExcludePlatforms = $conditionalAccessPolicy.Conditions.PlatformExcludePlatforms -join $separator

            IncludeLocations = $includeLocations -join $separator
            ExcludeLocations = $excludeLocations -join $separator

            IncludeDeviceStates = $conditionalAccessPolicy.Conditions.DeviceIncludeDeviceStates -join $separator
            ExcludeDeviceStates = $conditionalAccessPolicy.Conditions.DeviceExcludeDeviceStates -join $separator

            GrantControls = $conditionalAccessPolicy.GrantControlBuiltInControls -join $separator
            GrantControlsOperator = $conditionalAccessPolicy.GrantControlOperator

            ApplicationEnforcedRestrictions = $conditionalAccessPolicy.ApplicationEnforcedRestrictionIsEnabled
            CloudAppSecurity = $conditionalAccessPolicy.CloudAppSecurityIsEnabled
            PersistentBrowser = $conditionalAccessPolicy.PersistentBrowserMode
            SignInFrequency = "$($conditionalAccessPolicy.SignInFrequencyValue) $($conditionalAccessPolicy.SignInFrequencyType)"
        }
        # Add entry to report
        $conditionalAccessDocumentation += $entry
    }catch{
        Write-Error $PSItem
    }  
}

# Build export path (script directory)
$exportPath = Join-Path $PSScriptRoot "ConditionalAccessDocumentation.csv"
# Export report as csv
$conditionalAccessDocumentation | Export-Csv -Path $exportPath -NoTypeInformation

Write-Output "Exported Documentation to '$($exportPath)'"