Private/Write-NSPConditionalAccessAdminNote.ps1
|
function Write-NSPConditionalAccessAdminNote { <# .SYNOPSIS Dashboard: says which cloud-only admins coverage left out (covered by their role) and whether the admin policy is On. .DESCRIPTION The policy status comes from the cached dashboard insight; it is left out when the insight cannot be built. #> [CmdletBinding()] param( [Parameter(Mandatory)]$Session, [Parameter(Mandatory)]$Coverage ) $admins = @(if ($Coverage.Cloud) { @($Coverage.Cloud.Admins) | Where-Object { $_ } }) if (-not $admins.Count) { return } # The admin MFA policy the tenant's AdminMfa option selects. $policyId = @(Get-NSPConditionalAccessDefinition | Where-Object { $_['Id'] -like 'NSP-ADMIN-MFA-*' -and (Test-NSPConditionalAccessDefinitionSelected -Definition $_ -TenantProfile $Session.State.Profile) } | ForEach-Object { $_['Id'] })[0] if (-not $policyId) { $policyId = 'NSP-ADMIN-MFA-01' } $status = try { $row = @((Get-NSPConditionalAccessDashboardInsight -State $Session.State -Cache $Session.Cache -ConfigRoot $Session.ConfigRoot).Policies | Where-Object Id -eq $policyId)[0] if ($row) { $row.Status } } catch { $null } Write-NSPConsoleLine " $($admins.Count) cloud-only admin(s) left out: their admin role is covered by $policyId (MFA at every sign-in), not a group." -Role Muted foreach ($admin in $admins) { Write-NSPConsoleLine " $($admin.UserPrincipalName) ($(@($admin.Roles) -join ', '))" -Role Muted } if ($status -and $status -ne 'On') { Write-NSPConsoleLine " ! $policyId is $($status.ToLowerInvariant()), so it does not protect them yet. Deploy and turn it on ('Deploy policies from the templates', then 'Turn policies on')." -Role Warning } } |