Private/Get-NSPConditionalAccessCoverageSetting.ps1
|
function Get-NSPConditionalAccessCoverageSetting { <# .SYNOPSIS The tenant profile's coverage settings, with defaults for anything not set. .DESCRIPTION ExemptGroup On-premises group of accounts that are not synced and are ignored by the ActiveDirectory side. Default 'Group-MFAExempt'; an empty string means none. IncludeGuests Evaluate guest users on the Cloud side. Default false. MaxAdds Rail: more proposed adds than this holds the whole plan. Default 25. MaxAddsPercent Rail: more than this percentage of evaluated users holds the plan. Default 20. Scheduled Opt-in unattended settings (see Install-NSPConditionalAccessCoverageTask). #> [CmdletBinding()] param( [Parameter(Mandatory)]$TenantProfile ) $stored = Get-NSPConditionalAccessMapValue $TenantProfile 'Coverage' function Get-Setting { param([string]$Name, $Default) if ($null -eq $stored) { return $Default } $value = Get-NSPConditionalAccessMapValue $stored $Name if ($null -eq $value) { $Default } else { $value } } [pscustomobject][ordered]@{ ExemptGroup = [string](Get-Setting 'ExemptGroup' 'Group-MFAExempt') IncludeGuests = [bool](Get-Setting 'IncludeGuests' $false) MaxAdds = [int](Get-Setting 'MaxAdds' 25) MaxAddsPercent = [int](Get-Setting 'MaxAddsPercent' 20) Scheduled = Get-Setting 'Scheduled' $null } } |