Public/Set-NSPConditionalAccessCoverageSetting.ps1
|
function Set-NSPConditionalAccessCoverageSetting { <# .SYNOPSIS Changes a tenant profile's coverage settings (exempt group, guests, and the size rails). .DESCRIPTION Only the parameters given are changed; the others keep their stored or default values (see Get-NSPConditionalAccessCoverage). The profile is rewritten atomically. .EXAMPLE Set-NSPConditionalAccessCoverageSetting -TenantProfile $profilePath -ExemptGroup 'Group-MFAExempt' -MaxAdds 40 .EXAMPLE Set-NSPConditionalAccessCoverageSetting -TenantProfile $profilePath -ExemptGroup '' # this tenant has no exempt group #> [CmdletBinding(SupportsShouldProcess)] param( [Parameter(Mandatory)][string]$TenantProfile, [AllowEmptyString()][string]$ExemptGroup, [bool]$IncludeGuests, [ValidateRange(1, 100000)][int]$MaxAdds, [ValidateRange(1, 100)][int]$MaxAddsPercent, # The scheduled job's switch. $false stops the next run; the task can stay registered. [bool]$ScheduledEnabled, [ValidateRange(1, 1000)][int]$ScheduledMaxAdds, # Scheduled-run e-mail (see Get-NSPConditionalAccessCoverageMailSetup). An empty -MailFrom turns it off. [AllowEmptyString()][string]$MailFrom, [string[]]$MailTo, [ValidateSet('Problems', 'Changes', 'Always')][string]$MailWhen ) $content = Get-Content -LiteralPath $TenantProfile -Raw | ConvertFrom-Json $current = Get-NSPConditionalAccessCoverageSetting -TenantProfile $content $coverage = [ordered]@{ ExemptGroup = $current.ExemptGroup IncludeGuests = $current.IncludeGuests MaxAdds = $current.MaxAdds MaxAddsPercent = $current.MaxAddsPercent Scheduled = $current.Scheduled } foreach ($name in 'ExemptGroup', 'IncludeGuests', 'MaxAdds', 'MaxAddsPercent') { if ($PSBoundParameters.ContainsKey($name)) { $coverage[$name] = $PSBoundParameters[$name] } } if ($PSBoundParameters.ContainsKey('ScheduledEnabled') -or $PSBoundParameters.ContainsKey('ScheduledMaxAdds')) { if (-not $coverage.Scheduled) { if ($ScheduledEnabled) { throw 'Scheduled coverage is not installed for this tenant. Use Install-NSPConditionalAccessCoverageTask.' } $coverage.Scheduled = [pscustomobject]@{ Enabled = $false } } if ($PSBoundParameters.ContainsKey('ScheduledEnabled')) { $coverage.Scheduled | Add-Member -NotePropertyName Enabled -NotePropertyValue $ScheduledEnabled -Force } if ($PSBoundParameters.ContainsKey('ScheduledMaxAdds')) { if ($ScheduledMaxAdds -gt $coverage.MaxAdds) { throw "The scheduled cap ($ScheduledMaxAdds) cannot exceed MaxAdds ($($coverage.MaxAdds))." } $coverage.Scheduled | Add-Member -NotePropertyName MaxAdds -NotePropertyValue $ScheduledMaxAdds -Force } } if (@('MailFrom', 'MailTo', 'MailWhen' | Where-Object { $PSBoundParameters.ContainsKey($_) }).Count) { if (-not $coverage.Scheduled) { throw 'Scheduled coverage is not installed for this tenant. Use Install-NSPConditionalAccessCoverageTask first.' } $mail = if ($coverage.Scheduled.PSObject.Properties['Mail'] -and $coverage.Scheduled.Mail) { $coverage.Scheduled.Mail } else { [pscustomobject]@{ From = $null; To = @(); When = 'Problems' } } if ($PSBoundParameters.ContainsKey('MailFrom')) { $mail | Add-Member -NotePropertyName From -NotePropertyValue $(if ($MailFrom) { $MailFrom } else { $null }) -Force } if ($PSBoundParameters.ContainsKey('MailTo')) { $mail | Add-Member -NotePropertyName To -NotePropertyValue @($MailTo) -Force } if ($PSBoundParameters.ContainsKey('MailWhen')) { $mail | Add-Member -NotePropertyName When -NotePropertyValue $MailWhen -Force } if ($mail.From -and -not @($mail.To).Count) { throw 'Set -MailTo too: the report needs at least one recipient.' } $coverage.Scheduled | Add-Member -NotePropertyName Mail -NotePropertyValue $mail -Force } $content | Add-Member -NotePropertyName Coverage -NotePropertyValue ([pscustomobject]$coverage) -Force if ($PSCmdlet.ShouldProcess($TenantProfile, 'Update coverage settings')) { Save-NSPConditionalAccessJson -InputObject $content -Path $TenantProfile } [pscustomobject]$coverage } |