Private/Invoke-NSPConditionalAccessDashboardRun.ps1
|
function Invoke-NSPConditionalAccessDashboardRun { <# .SYNOPSIS Dashboard: journals a plan's approved items, previews them, and runs them after confirmation. .DESCRIPTION The executor still confirms each item (answer A for all). Pass -RunPath to resume an existing journal instead of creating one. Returns $true when the run was executed (whatever its result), so the caller knows the tenant may have changed. #> [CmdletBinding()] [OutputType([bool])] param( [string]$PlanPath, [string]$RunPath, [string]$TenantProfile, [string]$ConfigRoot ) if (-not $RunPath) { $plan = Get-Content -LiteralPath $PlanPath -Raw | ConvertFrom-Json if (-not @($plan.Items | Where-Object Decision -eq 'Approved').Count) { Write-NSPConsoleLine ' No item is approved; nothing to run.' -Role Warning return $false } $runArgs = @{ Plan = $PlanPath; ConfigRoot = $ConfigRoot } if ($TenantProfile) { $runArgs.TenantProfile = $TenantProfile } $RunPath = (New-NSPConditionalAccessDeploymentRun @runArgs).Path } Write-NSPConsoleRule -Title 'Will run, in this order' Invoke-NSPConditionalAccessDeploymentRun -Run $RunPath -ConfigRoot $ConfigRoot | Format-Table ItemId, Action, Target, NextStage -Wrap | Out-Host Write-NSPConsoleLine ' Each item re-reads the tenant first and stops if anything changed since the plan.' -Role Muted if (-not (Read-NSPConfirm -Prompt 'Run these against the tenant now?')) { Write-NSPConsoleLine " Not run. The approved run is saved and shows under 'Undo or resume a run': $RunPath" -Role Muted return $false } Write-NSPConsoleRule -Title 'Running' Write-NSPConsoleLine ' Writing to the tenant through Graph, one item at a time. The progress bar shows each step; each item asks first (A answers yes to all).' -Role Heading try { Invoke-NSPConditionalAccessDeploymentRun -Run $RunPath -Execute -ConfigRoot $ConfigRoot | Format-Table ItemId, Result, Message, Notes -Wrap | Out-Host } catch { Write-NSPConsoleLine " $_" -Role Error } $true } |