Private/Get-SPMClaimClassification.ps1
|
function Get-SPMClaimClassification { <# .SYNOPSIS Classifies a SharePoint claim login name (Entra group, M365 group, Everyone claims, ...). .DESCRIPTION For Microsoft 365 groups the claim may reference the group's OWNERS (suffix "_o") instead of its members - OwnersClaim reflects that, so the caller resolves /owners instead of /members via Graph. #> [CmdletBinding()] param( [Parameter(Mandatory)] [string]$LoginName ) if ($LoginName -match '^c:0t\.c\|tenant\|(?<id>[0-9a-fA-F\-]{36})$') { return @{ Type = 'EntraGroup'; GroupId = $Matches['id']; OwnersClaim = $false } } if ($LoginName -match '^c:0o\.c\|federateddirectoryclaimprovider\|(?<id>[0-9a-fA-F\-]{36})(?<owners>_o)?$') { return @{ Type = 'M365Group'; GroupId = $Matches['id']; OwnersClaim = [bool]$Matches['owners'] } } if ($LoginName -like 'c:0-.f|rolemanager|spo-grid-all-users*') { return @{ Type = 'EveryoneExceptExternal'; GroupId = $null; OwnersClaim = $false } } if ($LoginName -eq 'c:0(.s|true') { return @{ Type = 'Everyone'; GroupId = $null; OwnersClaim = $false } } return @{ Type = 'SecurityGroup'; GroupId = $null; OwnersClaim = $false } } |