Private/Get-NSPConditionalAccessRoleTable.ps1
|
function Get-NSPConditionalAccessRoleTable { <# .SYNOPSIS Directory role names usable as {Role:<Name>} references, mapped to their role template IDs. .DESCRIPTION Role template IDs are the same in every tenant. This table covers the 16 roles the legacy admin MFA policy targeted (the parity tests confirm it reproduces that policy's exact ID set), plus the other administrator roles NSP-BASE-PORTAL-01 lets into the admin portals. The inventory checks every ID against the tenant's role templates. Add roles here when a definition needs them. .EXAMPLE (Get-NSPConditionalAccessRoleTable)['GlobalAdministrator'] #> [CmdletBinding()] [OutputType([hashtable])] param() @{ GlobalAdministrator = '62e90394-69f5-4237-9190-012177145e10' PrivilegedRoleAdministrator = 'e8611ab8-c189-46e8-94e1-60213ab1f814' PrivilegedAuthenticationAdministrator = '7be44c8a-adaf-4e2a-84d6-ab2649e08a13' SecurityAdministrator = '194ae4cb-b126-40b2-bd5b-6091b380977d' ConditionalAccessAdministrator = 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9' ExchangeAdministrator = '29232cdf-9323-42fd-ade2-1d097af3e4de' SharePointAdministrator = 'f28a1f50-f6e7-4571-818b-6a12f2af6b6c' TeamsAdministrator = '69091246-20e8-4a56-aa4d-066075b2a7a8' UserAdministrator = 'fe930be7-5e62-47db-91af-98c3a49a38b1' HelpdeskAdministrator = '729827e3-9c14-49f7-bb1b-9608f156bbb8' PasswordAdministrator = '966707d0-3269-4727-9be2-8c3a10f19b9d' AuthenticationAdministrator = 'c4e39bd9-1100-46d3-8c65-fb160da0071f' AuthenticationPolicyAdministrator = '0526716b-113d-4c15-b2c8-68e3c22b9f80' ApplicationAdministrator = '9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3' CloudApplicationAdministrator = '158c047a-c907-4556-b7ef-446551a6b5f7' BillingAdministrator = 'b0f54661-2d74-4c50-afa3-1ec803f12efe' # Not admin-MFA targets, but administrators NSP-BASE-PORTAL-01 lets into the admin portals. GlobalReader = 'f2ef992c-3afb-46b9-b7cf-a126ee74c451' SecurityReader = '5d6b6bb7-de71-4623-b4af-96380a352509' ReportsReader = '4a5d8f65-41da-4de4-8968-e035b65339cf' IntuneAdministrator = '3a2c62db-5318-420d-8d74-23affee5d9d5' CloudDeviceAdministrator = '7698a772-787b-4ac8-901f-60d6b08affd2' LicenseAdministrator = '4d6ac14f-3453-41d0-bef9-a3e0c569773a' GroupsAdministrator = 'fdd7a751-b60b-444a-984c-02652fe8fa1c' ComplianceAdministrator = '17315797-102d-40b4-93e0-432062caca18' ExchangeRecipientAdministrator = '31392ffb-586c-42d1-9346-e59415a2cc4e' } } |