Private/Select-NSPConditionalAccessDirectoryObject.ps1
|
function Select-NSPConditionalAccessDirectoryObject { <# .SYNOPSIS Dashboard: finds one user (Graph, read-only) or one security group (the saved inventory) by the start of its name, and returns Id and Label. .DESCRIPTION Users are searched by the start of the sign-in address or display name (up to 15 shown), or taken by object ID; this needs a session (User.Read.All, already in the tool's scopes). Groups come from the inventory's security groups, matched anywhere in the name. Returns $null when the operator gives up. #> [CmdletBinding()] param( [Parameter(Mandatory)]$Session, [Parameter(Mandatory)][ValidateSet('User', 'Group')][string]$Kind, $Inventory ) while ($true) { $prompt = if ($Kind -eq 'User') { 'User: the start of the name or sign-in address (Enter to go back)' } else { 'Group: part of its name (Enter to go back)' } $query = Read-NSPConditionalAccessText -Prompt $prompt if (-not $query) { return $null } $query = $query.Trim() if ($Kind -eq 'User') { if (-not $Session.State.Connected) { throw 'Finding a user needs a session. Sign in (C) first.' } $found = if ($query -match '^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$') { @(try { Invoke-NSPGraphRequest -Uri "users/$query`?`$select=id,displayName,userPrincipalName,accountEnabled" } catch { $null }) | Where-Object { $_ } } else { $escaped = $query -replace "'", "''" @(Get-NSPConditionalAccessMapValue (Invoke-NSPGraphRequest -Uri "users?`$filter=startswith(userPrincipalName,'$escaped') or startswith(displayName,'$escaped')&`$select=id,displayName,userPrincipalName,accountEnabled&`$top=15") 'value') } $choices = @($found | Where-Object { $_ } | ForEach-Object { $enabled = if (Get-NSPConditionalAccessMapValue $_ 'accountEnabled') { '' } else { ' (disabled)' } [pscustomobject]@{ Label = "$(Get-NSPConditionalAccessMapValue $_ 'displayName') $(Get-NSPConditionalAccessMapValue $_ 'userPrincipalName')$enabled" Value = [pscustomobject]@{ Id = [string](Get-NSPConditionalAccessMapValue $_ 'id'); Label = [string](Get-NSPConditionalAccessMapValue $_ 'userPrincipalName') } } }) } else { $choices = @(Get-NSPConditionalAccessMapValue $Inventory 'Groups' | Where-Object { ([string](Get-NSPConditionalAccessMapValue $_ 'displayName')).IndexOf($query, [StringComparison]::OrdinalIgnoreCase) -ge 0 } | Sort-Object { [string](Get-NSPConditionalAccessMapValue $_ 'displayName') } | Select-Object -First 15 | ForEach-Object { $synced = if (Get-NSPConditionalAccessMapValue $_ 'onPremisesSyncEnabled') { ' (synced from AD)' } else { '' } [pscustomobject]@{ Label = "$(Get-NSPConditionalAccessMapValue $_ 'displayName')$synced" Value = [pscustomobject]@{ Id = [string](Get-NSPConditionalAccessMapValue $_ 'id'); Label = [string](Get-NSPConditionalAccessMapValue $_ 'displayName') } } }) } if (-not $choices.Count) { Write-NSPConsoleLine " No $($Kind.ToLowerInvariant()) matches '$query'. Try again." -Role Warning; continue } $picked = Read-NSPMenu -Prompt "Which $($Kind.ToLowerInvariant())?" -CancelLabel 'Search again' -Choices $choices if ($picked) { return $picked } } } |