Public/Get-NSPConditionalAccessPolicyTarget.ps1
|
function Get-NSPConditionalAccessPolicyTarget { <# .SYNOPSIS Lists the users and groups added to policies in the tenant profile, and the service accounts every policy leaves out. .DESCRIPTION Offline. One row per addition: PolicyId, Field (IncludeUsers, IncludeGroups, ExcludeUsers, ExcludeGroups), Id, Label, AddedAtUtc. Service accounts come as PolicyId '(every policy)' and Field 'ServiceAccounts'. -PolicyId limits the rows to one policy (service accounts included, since they apply to it too). .EXAMPLE Get-NSPConditionalAccessPolicyTarget -TenantProfile $profilePath -PolicyId 'NSP-BASE-GEO-01' | Format-Table #> [CmdletBinding()] param( [Parameter(Mandatory)]$TenantProfile, [string]$PolicyId ) if ($TenantProfile -is [string]) { $TenantProfile = Get-Content -LiteralPath $TenantProfile -Raw | ConvertFrom-Json } $targets = Get-NSPConditionalAccessMapValue $TenantProfile 'PolicyTargets' $policies = if ($null -eq $targets) { @() } elseif ($targets -is [System.Collections.IDictionary]) { @($targets.Keys) } else { @($targets.PSObject.Properties.Name) } foreach ($policy in ($policies | Sort-Object)) { if ($PolicyId -and $policy -ne $PolicyId) { continue } $added = Get-NSPConditionalAccessMapValue $targets $policy foreach ($field in 'IncludeUsers', 'IncludeGroups', 'ExcludeUsers', 'ExcludeGroups') { foreach ($entry in @(Get-NSPConditionalAccessMapValue $added $field | Where-Object { $_ })) { [pscustomobject]@{ PolicyId = $policy Field = $field Id = [string](Get-NSPConditionalAccessMapValue $entry 'Id') Label = [string](Get-NSPConditionalAccessMapValue $entry 'Label') AddedAtUtc = Get-NSPConditionalAccessMapValue $entry 'AddedAtUtc' } } } } $service = Get-NSPConditionalAccessMapValue $TenantProfile 'ServiceAccounts' $ids = @(Get-NSPConditionalAccessMapValue $service 'Ids') $labels = @(Get-NSPConditionalAccessMapValue $service 'Labels') for ($index = 0; $index -lt $ids.Count; $index++) { if (-not $ids[$index]) { continue } [pscustomobject]@{ PolicyId = '(every policy)' Field = 'ServiceAccounts' Id = [string]$ids[$index] Label = if ($index -lt $labels.Count) { [string]$labels[$index] } else { [string]$ids[$index] } AddedAtUtc = $null } } } |