Private/Remove-NSPConditionalAccessProfileBinding.ps1
|
function Remove-NSPConditionalAccessProfileBinding { <# .SYNOPSIS Undo of Write-NSPConditionalAccessProfileBinding: removes one object ID from a group slot, travel entry, country, or authentication strength binding. The profile is rewritten atomically. #> [CmdletBinding(SupportsShouldProcess)] param( [Parameter(Mandatory)][string]$ProfilePath, [Parameter(Mandatory)][ValidateSet('Group', 'TravelGroup', 'Country', 'Strength')][string]$Kind, [Parameter(Mandatory)][string]$Key, [Parameter(Mandatory)][string]$ObjectId ) $tenantProfile = Get-Content -LiteralPath $ProfilePath -Raw | ConvertFrom-Json if ($Kind -eq 'Strength') { $strengths = $tenantProfile.PSObject.Properties['AuthenticationStrengths'] if ($strengths -and $strengths.Value -and $strengths.Value.PSObject.Properties[$Key] -and $strengths.Value.$Key -eq $ObjectId) { $strengths.Value.PSObject.Properties.Remove($Key) } } elseif ($Kind -eq 'Country') { $countries = $tenantProfile.NamedLocations.Countries if ($countries.PSObject.Properties[$Key] -and $countries.$Key -eq $ObjectId) { $countries.PSObject.Properties.Remove($Key) $tenantProfile.MissingCountries = @(@($tenantProfile.MissingCountries | Where-Object { $_ }) + $Key | Select-Object -Unique) } } else { $entry = if ($Kind -eq 'Group') { $tenantProfile.Groups.$Key } elseif ($tenantProfile.Travel -and $tenantProfile.Travel.Entries) { $tenantProfile.Travel.Entries.$Key } else { $null } if (-not $entry) { return } $ids = @($entry.Ids) $labels = @($entry.Labels) $keep = @(for ($i = 0; $i -lt $ids.Count; $i++) { if ($ids[$i] -ne $ObjectId) { $i } }) $entry.Ids = @($keep | ForEach-Object { $ids[$_] }) $entry.Labels = @($keep | Where-Object { $_ -lt $labels.Count } | ForEach-Object { $labels[$_] }) $entry.Missing = -not @($entry.Ids).Count } if ($PSCmdlet.ShouldProcess($ProfilePath, "Unbind $ObjectId from $Kind $Key")) { Save-NSPConditionalAccessJson -InputObject $tenantProfile -Path $ProfilePath } } |