Public/Connect-NSPConditionalAccessGraph.ps1
|
function Connect-NSPConditionalAccessGraph { <# .SYNOPSIS Signs in to a tenant as this tool's recorded app registration, with the tool's single scope list. .DESCRIPTION -Tenant accepts the tenant ID or the default domain recorded by Register-NSPConditionalAccessAppRegistration. An existing session that already matches the app, tenant, and scopes is reused without prompting. .EXAMPLE Connect-NSPConditionalAccessGraph -Tenant 'contoso.onmicrosoft.com' #> [CmdletBinding()] param( [Parameter(Mandatory)][string]$Tenant, [switch]$UseDeviceCode, [string]$ConfigRoot ) Import-NSPM365Graph $directory = Get-NSPConditionalAccessLocalPath -Kind AppRegistrations -ConfigRoot $ConfigRoot $records = @(if (Test-Path -LiteralPath $directory) { Get-ChildItem -LiteralPath $directory -Filter '*.json' | ForEach-Object { Get-Content -LiteralPath $_.FullName -Raw | ConvertFrom-Json } }) $record = @($records | Where-Object { $_.TenantId -eq $Tenant -or $_.TenantDomain -eq $Tenant }) if ($record.Count -eq 0) { throw "No app registration is recorded for '$Tenant'. Run Register-NSPConditionalAccessAppRegistration -Execute in that tenant first." } if ($record.Count -gt 1) { throw "More than one recorded registration matches '$Tenant'. Use the tenant ID." } $connectArgs = @{ Scopes = @(Get-NSPConditionalAccessGraphScopes) Connect = $true ClientId = $record[0].ClientId TenantId = $record[0].TenantId } if ($UseDeviceCode) { $connectArgs.UseDeviceCode = $true } Connect-NSPGraph @connectArgs } |