Private/Get-NSPConditionalAccessGraphScopes.ps1
|
function Get-NSPConditionalAccessGraphScopes { <# .SYNOPSIS The Graph permission lists this module uses: one per app, and no call site builds its own. .DESCRIPTION Operator (default): the delegated scopes every routine connection requests, including the app-registration bootstrap's granted-permissions list. A narrower ad-hoc list at any call site makes whichever action runs first establish a narrow token, and the next action re-prompts (the NSP-IntuneApps lesson; see its Get-NSPGraphRoutineScopes). The signed-in operator also needs the Conditional Access Administrator or Security Administrator role; scopes alone do not authorize policy writes. Coverage: the application permissions of the unattended coverage app. It can read users and role assignments and change group membership, and nothing else. It has no policy access. .EXAMPLE Connect-MgGraph -Scopes (Get-NSPConditionalAccessGraphScopes) #> [CmdletBinding()] [OutputType([string[]])] param( [ValidateSet('Operator', 'Coverage')][string]$Purpose = 'Operator' ) if ($Purpose -eq 'Coverage') { return @( 'User.Read.All' # enabled users, their sync state, checkMemberGroups 'GroupMember.ReadWrite.All' # read coverage group members; add to MFACatchAll's cloud group 'RoleManagement.Read.Directory' # admin role holders, who are covered by their role ) } @( 'Policy.Read.All' # read policies and named locations 'Policy.ReadWrite.ConditionalAccess' # create/update policies and named locations 'Application.Read.All' # resolve service principals named in policies 'Group.ReadWrite.All' # resolve groups; planned, approved group creation 'User.Read.All' # resolve breakglass and named users 'RoleManagement.Read.Directory' # resolve directory role templates 'Organization.Read.All' # tenant identity and onPremisesSyncEnabled 'AuditLog.Read.All' # report-only sign-in results before promotion (needs Entra ID P1) ) } |