Public/Remove-NSPConditionalAccessPolicyTarget.ps1
|
function Remove-NSPConditionalAccessPolicyTarget { <# .SYNOPSIS Removes a user or group added to a policy, or a service account, from the tenant profile. .DESCRIPTION Offline; changes only the tenant profile. The next deployment plan updates the policy. Removing an exclusion from a block policy blocks that user or group again; the plan names them. Only additions can be removed; a definition's own targets stay. .EXAMPLE Remove-NSPConditionalAccessPolicyTarget -TenantProfile $profilePath -PolicyId 'NSP-BASE-GEO-01' -Field ExcludeUsers -Id $userId .EXAMPLE Remove-NSPConditionalAccessPolicyTarget -TenantProfile $profilePath -ServiceAccount -Id $userId #> [CmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Policy')] param( [Parameter(Mandatory)][string]$TenantProfile, [Parameter(Mandatory, ParameterSetName = 'Policy')][string]$PolicyId, [Parameter(Mandatory, ParameterSetName = 'Policy')][ValidateSet('IncludeUsers', 'IncludeGroups', 'ExcludeUsers', 'ExcludeGroups')][string]$Field, [Parameter(Mandatory, ParameterSetName = 'ServiceAccount')][switch]$ServiceAccount, [Parameter(Mandatory)][string]$Id ) $content = Get-Content -LiteralPath $TenantProfile -Raw | ConvertFrom-Json $Id = $Id.ToLowerInvariant() if ($ServiceAccount) { $ids = @($content.ServiceAccounts.Ids | Where-Object { $_ }) $labels = @($content.ServiceAccounts.Labels) $index = [array]::IndexOf(@($ids | ForEach-Object { ([string]$_).ToLowerInvariant() }), $Id) if ($index -lt 0) { throw "$Id is not a service account in the tenant profile." } $label = if ($index -lt $labels.Count) { $labels[$index] } else { $Id } $content.ServiceAccounts.Ids = @(for ($i = 0; $i -lt $ids.Count; $i++) { if ($i -ne $index) { $ids[$i] } }) $content.ServiceAccounts.Labels = @(for ($i = 0; $i -lt $labels.Count; $i++) { if ($i -ne $index) { $labels[$i] } }) $what = "Remove service account $label" } else { $targets = if ($content.PolicyTargets) { $content.PolicyTargets.$PolicyId } else { $null } $kept = @($targets.$Field | Where-Object { $_ -and ([string]$_.Id).ToLowerInvariant() -ne $Id }) if (-not $targets -or $kept.Count -eq @($targets.$Field | Where-Object { $_ }).Count) { throw "$Id is not added to $PolicyId as $Field." } $label = @($targets.$Field | Where-Object { $_ -and ([string]$_.Id).ToLowerInvariant() -eq $Id })[0].Label $targets | Add-Member -NotePropertyName $Field -NotePropertyValue $kept -Force if (-not @('IncludeUsers', 'IncludeGroups', 'ExcludeUsers', 'ExcludeGroups' | Where-Object { @($targets.$_ | Where-Object { $_ }).Count }).Count) { $content.PolicyTargets.PSObject.Properties.Remove($PolicyId) } $what = "Remove $label from $PolicyId $Field" } if ($PSCmdlet.ShouldProcess($TenantProfile, $what)) { Save-NSPConditionalAccessJson -InputObject $content -Path $TenantProfile } } |