Private/Write-NSPConditionalAccessProfileBinding.ps1
|
function Write-NSPConditionalAccessProfileBinding { <# .SYNOPSIS Binds a newly created group, named location, or authentication strength into the tenant profile. .DESCRIPTION Group: appends the object ID and label to the slot and clears Missing (existing bindings, such as a synced group, are kept). Country: sets NamedLocations.Countries.<ISO> and removes it from MissingCountries. Strength: sets AuthenticationStrengths.<Name>. The profile is rewritten atomically. #> [CmdletBinding()] param( [Parameter(Mandatory)][string]$ProfilePath, [Parameter(Mandatory)][ValidateSet('Group', 'TravelGroup', 'Country', 'Strength')][string]$Kind, [Parameter(Mandatory)][string]$Key, [Parameter(Mandatory)][string]$ObjectId, [string]$Label ) $tenantProfile = Get-Content -LiteralPath $ProfilePath -Raw | ConvertFrom-Json if ($Kind -eq 'Strength') { if (-not $tenantProfile.PSObject.Properties['AuthenticationStrengths'] -or -not $tenantProfile.AuthenticationStrengths) { $tenantProfile | Add-Member -NotePropertyName AuthenticationStrengths -NotePropertyValue ([pscustomobject]@{}) -Force } $tenantProfile.AuthenticationStrengths | Add-Member -NotePropertyName $Key -NotePropertyValue $ObjectId -Force } elseif ($Kind -eq 'TravelGroup') { $entry = $tenantProfile.Travel.Entries.$Key if (-not $entry) { throw "The tenant profile has no travel entry '$Key'." } if ($ObjectId -notin @($entry.Ids)) { $entry.Ids = @(@($entry.Ids | Where-Object { $_ }) + $ObjectId) $entry.Labels = @(@($entry.Labels | Where-Object { $_ }) + $Label) } $entry.Missing = $false } elseif ($Kind -eq 'Group') { $slot = $tenantProfile.Groups.$Key if (-not $slot) { $slot = [pscustomobject]@{ Ids = @(); Labels = @(); Missing = $true; DefaultName = $null } $tenantProfile.Groups | Add-Member -NotePropertyName $Key -NotePropertyValue $slot } if ($ObjectId -notin @($slot.Ids)) { $slot.Ids = @(@($slot.Ids | Where-Object { $_ }) + $ObjectId) $slot.Labels = @(@($slot.Labels | Where-Object { $_ }) + $Label) } $slot.Missing = $false } else { $countries = $tenantProfile.NamedLocations.Countries $countries | Add-Member -NotePropertyName $Key -NotePropertyValue $ObjectId -Force $tenantProfile.MissingCountries = @($tenantProfile.MissingCountries | Where-Object { $_ -and $_ -ne $Key }) } Save-NSPConditionalAccessJson -InputObject $tenantProfile -Path $ProfilePath } |