Private/Write-NSPConditionalAccessOwnership.ps1
|
function Write-NSPConditionalAccessOwnership { <# .SYNOPSIS Records that a definition owns a live policy, with the canonical hash Graph actually stored. #> [CmdletBinding()] param( [Parameter(Mandatory)][string]$TenantId, [Parameter(Mandatory)][string]$DefinitionId, [Parameter(Mandatory)][string]$ObjectId, [Parameter(Mandatory)][string]$AppliedHash, $AppliedVersion, [string]$RunId, [string]$ConfigRoot ) $path = Join-Path (Get-NSPConditionalAccessLocalPath -Kind Ownership -ConfigRoot $ConfigRoot) "$TenantId.json" $record = if (Test-Path -LiteralPath $path) { Get-Content -LiteralPath $path -Raw | ConvertFrom-Json } else { [pscustomobject]@{ TenantId = $TenantId; Policies = [pscustomobject]@{} } } if (-not $record.Policies) { $record | Add-Member -NotePropertyName Policies -NotePropertyValue ([pscustomobject]@{}) -Force } $entry = [pscustomobject]@{ ObjectId = $ObjectId AppliedHash = $AppliedHash AppliedVersion = $AppliedVersion AppliedAtUtc = (Get-Date).ToUniversalTime().ToString('o') RunId = $RunId } $record.Policies | Add-Member -NotePropertyName $DefinitionId -NotePropertyValue $entry -Force Save-NSPConditionalAccessJson -InputObject $record -Path $path } |