Public/SubnetInjection/Diagnostics/Test-AccountPermissions.ps1
|
<#
SAMPLE CODE NOTICE THIS SAMPLE CODE IS MADE AVAILABLE AS IS. MICROSOFT MAKES NO WARRANTIES, WHETHER EXPRESS OR IMPLIED, OF FITNESS FOR A PARTICULAR PURPOSE, OF ACCURACY OR COMPLETENESS OF RESPONSES, OF RESULTS, OR CONDITIONS OF MERCHANTABILITY. THE ENTIRE RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS SAMPLE CODE REMAINS WITH THE USER. NO TECHNICAL SUPPORT IS PROVIDED. YOU MAY NOT DISTRIBUTE THIS CODE UNLESS YOU HAVE A LICENSE AGREEMENT WITH MICROSOFT THAT ALLOWS YOU TO DO SO. #> <# .SYNOPSIS Validates that the account has the correct permissions to run diagnostic commands. .DESCRIPTION Tests that the generated Bearer token for the logged in account has the claim that is necessary to be able to call the diagnostic APIs. The necessary permission is the Power Platform Administrator role which is assigned through the Entra portal. .OUTPUTS System.Boolean Whether the account has the required permissions. .EXAMPLE Test-AccountPermissions .EXAMPLE Test-AccountPermissions -TenantId "00000000-0000-0000-0000-000000000000" -Endpoint [BAPEndpoint]::Prod #> function Test-AccountPermissions{ param( [Parameter(Mandatory=$false, HelpMessage="The id of the tenant that the environment belongs to.")] [string]$TenantId, [Parameter(Mandatory=$false, HelpMessage="The BAP endpoint to connect to. Default is 'prod'.")] [BAPEndpoint]$Endpoint = [BAPEndpoint]::Prod ) $ErrorActionPreference = "Stop" if (-not(Connect-Azure -Endpoint $Endpoint -TenantId $TenantId)) { throw "Failed to connect to Azure. Please check your credentials and try again." } $token = ConvertFrom-SecureStringInternal -SecureString (Get-AccessToken -TenantId $TenantId -Endpoint $Endpoint) $parts = $token.Split('.') if ($parts.Count -ne 3) { throw "Token is not in an expected format." } $pad = '=' * ((4 - $parts[1].Length % 4) % 4) $base64 = ($parts[1] + $pad).Replace('-', '+').Replace('_', '/') $payload = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($base64)) | ConvertFrom-Json if(-not($payload.wids)){ Write-Host "Token does not contain wids claim. Check that the user has roles assigned in Entra." -ForegroundColor Red return $false } if($payload.wids | Where-Object { $_ -eq "11648597-926c-4cf3-9c36-bcebb0ba8dcc"} ){ Write-Host "Token contains Power Platform Administrator role." -ForegroundColor Green return $true } else { Write-Host "Token does not contain required Power Platform Administrator role." -ForegroundColor Red return $false } } |