Private/Get-NSPConditionalAccessGroupSlot.ps1
|
function Get-NSPConditionalAccessGroupSlot { <# .SYNOPSIS The baseline group slots: how discovery recognizes each one, and the name used when it must be created. .DESCRIPTION Patterns come from the legacy wizard's search strings and the naming seen in client tenants (CONF_MFA, CONF_InternalOnlyUsers). A match is only a suggestion: the tenant profile binds each slot to object IDs after operator review. Purpose is the plain-language meaning the dashboard shows. No policy uses MFAExempt: coverage treats its members as covered, and the bulk add can target it (the planner creates it on request, -GroupSlot). #> [CmdletBinding()] [OutputType([object[]])] param() @( [pscustomobject]@{ Slot = 'EnableMFA'; Patterns = @('*Enable*MFA*', '*[_-]MFA'); DefaultName = 'Group-EnableO365MFA'; Purpose = 'Staff who must use MFA when signing in from outside the office' } [pscustomobject]@{ Slot = 'RestrictExternal'; Patterns = @('*RestrictExternal*', '*InternalOnly*'); DefaultName = 'Group-RestrictExternalAccess'; Purpose = 'Staff who may sign in only from the office (trusted locations)' } [pscustomobject]@{ Slot = 'MFACatchAll'; Patterns = @('*MFACatchAll*'); DefaultName = 'Group-MFACatchAll'; Purpose = 'Everyone not in another MFA group, so the mobile and Intune policies still cover them' } [pscustomobject]@{ Slot = 'ExternalRegistration'; Patterns = @('*ExternalRegistration*'); DefaultName = 'Group-EnableExternalRegistration'; Purpose = 'Staff allowed to set up MFA from outside the office' } [pscustomobject]@{ Slot = 'MFAExempt'; Patterns = @('*MFAExempt*', '*MFA*Exempt*'); DefaultName = 'Group-MFAExempt'; Purpose = 'Accounts deliberately in no MFA group (kiosks, scanners, shared devices); coverage leaves them alone' } ) } |