Private/Add-NSPConditionalAccessAdGroupMember.ps1
|
function Add-NSPConditionalAccessAdGroupMember { <# .SYNOPSIS Adds one user to an on-premises group. The only function that writes to Active Directory. .DESCRIPTION Returns 'Added', or 'AlreadyMember' when the user is already a direct member. Throws when the user is missing or disabled, so the run stops instead of adding the wrong account. #> [CmdletBinding(SupportsShouldProcess)] [OutputType([string])] param( [Parameter(Mandatory)][string]$GroupIdentity, [Parameter(Mandatory)][string]$UserIdentity ) Import-Module ActiveDirectory -ErrorAction Stop -Verbose:$false $user = Get-ADUser -Identity $UserIdentity -Properties MemberOf -ErrorAction Stop if (-not $user.Enabled) { throw "AD user $UserIdentity is disabled now; not added." } $group = Get-ADGroup -Identity $GroupIdentity -ErrorAction Stop if (@($user.MemberOf) -contains $group.DistinguishedName) { return 'AlreadyMember' } if ($PSCmdlet.ShouldProcess($group.SamAccountName, "Add $($user.SamAccountName)")) { Add-ADGroupMember -Identity $group -Members $user -ErrorAction Stop } 'Added' } |