Private/Format-TLDocumentation.ps1
|
function Format-TLDocumentation { <# .SYNOPSIS Builds the human-readable Markdown tenant documentation from a snapshot. .DESCRIPTION The Conditional Access section renders one prose block per policy with resolved display names - the part consultants otherwise write by hand. #> [CmdletBinding()] param( [Parameter(Mandatory)] [object]$Snapshot ) function Test-TLArea { param([object]$Snapshot, [string]$Name) return ($null -ne $Snapshot.PSObject.Properties[$Name] -and $null -ne $Snapshot.$Name) } function Get-TLListText { param([object]$Values, [string]$EmptyText = 'none') $list = @($Values | Where-Object { $null -ne $_ -and "$_" -ne '' }) if ($list.Count -eq 0) { return $EmptyText } return ($list -join ', ') } $md = [System.Text.StringBuilder]::new() $tenantLabel = 'tenant' $generated = [DateTime]::UtcNow.ToString('yyyy-MM-dd HH:mm') + ' UTC' if ($Snapshot.PSObject.Properties['_Manifest'] -and $Snapshot._Manifest) { $manifest = $Snapshot._Manifest if ($manifest.PSObject.Properties['tenant'] -and $manifest.tenant -and $manifest.tenant.PSObject.Properties['label']) { $tenantLabel = [string]$manifest.tenant.label } if ($manifest.PSObject.Properties['generatedUtc'] -and $manifest.generatedUtc) { # ConvertFrom-Json turns ISO timestamps into [DateTime]; a plain # [string] cast would render locale-dependent - keep it sortable. $generatedValue = $manifest.generatedUtc if ($generatedValue -is [DateTime]) { $generated = $generatedValue.ToUniversalTime().ToString('yyyy-MM-dd HH:mm') + ' UTC' } else { $generated = [string]$generatedValue } } } [void]$md.AppendLine("# Tenant documentation - $tenantLabel") [void]$md.AppendLine() [void]$md.AppendLine("*Generated $generated by TenantLens $($script:TLVersion). Source snapshot: ``$(Split-Path -Path $Snapshot._Path -Parent | Split-Path -Leaf)``.*") [void]$md.AppendLine() # --- Tenant overview ----------------------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'TenantBasics') { $basics = $Snapshot.TenantBasics [void]$md.AppendLine('## Tenant overview') [void]$md.AppendLine() if ($basics.PSObject.Properties['organization'] -and $basics.organization) { $org = $basics.organization [void]$md.AppendLine("- **Organization:** $($org.displayName)") [void]$md.AppendLine("- **Tenant id:** ``$($org.id)``") if ($org.PSObject.Properties['countryLetterCode'] -and $org.countryLetterCode) { [void]$md.AppendLine("- **Country:** $($org.countryLetterCode)") } } [void]$md.AppendLine() if ($basics.PSObject.Properties['domains'] -and @($basics.domains).Count -gt 0) { [void]$md.AppendLine('### Verified domains') [void]$md.AppendLine() [void]$md.AppendLine('| Domain | Verified | Default | Initial |') [void]$md.AppendLine('| --- | --- | --- | --- |') foreach ($domain in @($basics.domains)) { [void]$md.AppendLine(('| {0} | {1} | {2} | {3} |' -f $domain.id, $(if ($domain.isVerified) { 'yes' } else { 'no' }), $(if ($domain.isDefault) { 'yes' } else { '' }), $(if ($domain.isInitial) { 'yes' } else { '' }))) } [void]$md.AppendLine() } if ($basics.PSObject.Properties['skus'] -and @($basics.skus).Count -gt 0) { [void]$md.AppendLine('### Licensing') [void]$md.AppendLine() [void]$md.AppendLine('| SKU | Prepaid | Consumed |') [void]$md.AppendLine('| --- | --- | --- |') foreach ($sku in @($basics.skus)) { $prepaid = '' if ($sku.PSObject.Properties['prepaidUnits'] -and $sku.prepaidUnits) { $prepaid = $sku.prepaidUnits.enabled } [void]$md.AppendLine(('| {0} | {1} | {2} |' -f $sku.skuPartNumber, $prepaid, $sku.consumedUnits)) } [void]$md.AppendLine() } } # --- Conditional Access -------------------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'ConditionalAccess') { $policies = @($Snapshot.ConditionalAccess) [void]$md.AppendLine("## Conditional Access policies ($($policies.Count))") [void]$md.AppendLine() foreach ($policy in ($policies | Sort-Object -Property displayName)) { $stateLabel = switch ([string]$policy.state) { 'enabled' { 'Enabled' } 'disabled' { 'Disabled' } 'enabledForReportingButNotEnforced' { 'Report-only' } default { [string]$policy.state } } $resolved = $null if ($policy.PSObject.Properties['_tlResolved']) { $resolved = $policy._tlResolved } [void]$md.AppendLine("### $($policy.displayName) ($stateLabel)") [void]$md.AppendLine() $conditions = $policy.conditions $users = $null if ($conditions -and $conditions.PSObject.Properties['users']) { $users = $conditions.users } $userInclude = @(); $userExclude = @() if ($resolved) { $userInclude = @($resolved.usersInclude) + @($resolved.groupsInclude | ForEach-Object { "group: $_" }) + @($resolved.rolesInclude | ForEach-Object { "role: $_" }) $userExclude = @($resolved.usersExclude) + @($resolved.groupsExclude | ForEach-Object { "group: $_" }) + @($resolved.rolesExclude | ForEach-Object { "role: $_" }) } elseif ($users) { $userInclude = @($users.includeUsers) + @($users.includeGroups) + @($users.includeRoles) $userExclude = @($users.excludeUsers) + @($users.excludeGroups) + @($users.excludeRoles) } [void]$md.AppendLine("- **Users:** include: $(Get-TLListText -Values $userInclude); exclude: $(Get-TLListText -Values $userExclude)") $appInclude = @(); $appExclude = @() if ($resolved) { $appInclude = @($resolved.appsInclude); $appExclude = @($resolved.appsExclude) } elseif ($conditions -and $conditions.PSObject.Properties['applications'] -and $conditions.applications) { $appInclude = @($conditions.applications.includeApplications) $appExclude = @($conditions.applications.excludeApplications) } [void]$md.AppendLine("- **Applications:** include: $(Get-TLListText -Values $appInclude); exclude: $(Get-TLListText -Values $appExclude)") $conditionParts = [System.Collections.Generic.List[string]]::new() if ($conditions) { if ($conditions.PSObject.Properties['clientAppTypes'] -and @($conditions.clientAppTypes).Count -gt 0) { $conditionParts.Add("client apps: $(Get-TLListText -Values $conditions.clientAppTypes)") } if ($conditions.PSObject.Properties['platforms'] -and $conditions.platforms) { $conditionParts.Add("platforms: include $(Get-TLListText -Values $conditions.platforms.includePlatforms -EmptyText 'all')") } $locInclude = @(); $locExclude = @() if ($resolved -and $resolved.PSObject.Properties['locationsInclude']) { $locInclude = @($resolved.locationsInclude); $locExclude = @($resolved.locationsExclude) } elseif ($conditions.PSObject.Properties['locations'] -and $conditions.locations) { $locInclude = @($conditions.locations.includeLocations); $locExclude = @($conditions.locations.excludeLocations) } if (@($locInclude).Count -gt 0 -or @($locExclude).Count -gt 0) { $conditionParts.Add("locations: include $(Get-TLListText -Values $locInclude -EmptyText 'all'); exclude $(Get-TLListText -Values $locExclude)") } if ($conditions.PSObject.Properties['signInRiskLevels'] -and @($conditions.signInRiskLevels).Count -gt 0) { $conditionParts.Add("sign-in risk: $(Get-TLListText -Values $conditions.signInRiskLevels)") } if ($conditions.PSObject.Properties['userRiskLevels'] -and @($conditions.userRiskLevels).Count -gt 0) { $conditionParts.Add("user risk: $(Get-TLListText -Values $conditions.userRiskLevels)") } } if ($conditionParts.Count -eq 0) { $conditionParts.Add('no additional conditions') } [void]$md.AppendLine("- **Conditions:** $($conditionParts -join '; ')") $grantText = 'none' if ($policy.PSObject.Properties['grantControls'] -and $policy.grantControls) { $grant = $policy.grantControls $controls = @($grant.builtInControls) if ($grant.PSObject.Properties['authenticationStrength'] -and $grant.authenticationStrength -and $grant.authenticationStrength.PSObject.Properties['displayName'] -and $grant.authenticationStrength.displayName) { $controls += "authentication strength: $($grant.authenticationStrength.displayName)" } if (@($controls).Count -gt 0) { $operator = '' if ($grant.PSObject.Properties['operator'] -and $grant.operator -and @($controls).Count -gt 1) { $operator = " ($($grant.operator))" } $grantText = "$(Get-TLListText -Values $controls)$operator" } } [void]$md.AppendLine("- **Grant:** $grantText") if ($policy.PSObject.Properties['sessionControls'] -and $policy.sessionControls) { $sessionParts = @($policy.sessionControls.PSObject.Properties | Where-Object { $null -ne $_.Value -and $_.Name -notlike '@*' } | ForEach-Object { $_.Name }) if ($sessionParts.Count -gt 0) { [void]$md.AppendLine("- **Session:** $($sessionParts -join ', ')") } } [void]$md.AppendLine() } } # --- Named locations ----------------------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'NamedLocations') { $locations = @($Snapshot.NamedLocations) [void]$md.AppendLine("## Named locations ($($locations.Count))") [void]$md.AppendLine() foreach ($location in $locations) { $detail = '' $type = ([string]$location.'@odata.type') -replace '^#microsoft\.graph\.', '' if ($type -eq 'ipNamedLocation') { $ranges = @($location.ipRanges | ForEach-Object { $_.cidrAddress }) $trusted = $(if ($location.isTrusted) { 'trusted' } else { 'not trusted' }) $detail = "IP ($trusted): $(Get-TLListText -Values $ranges)" } elseif ($type -eq 'countryNamedLocation') { $detail = "Countries: $(Get-TLListText -Values $location.countriesAndRegions)" } [void]$md.AppendLine("- **$($location.displayName)** - $detail") } [void]$md.AppendLine() } # --- Directory roles ----------------------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'RoleAssignments') { $roleData = $Snapshot.RoleAssignments [void]$md.AppendLine('## Privileged directory roles') [void]$md.AppendLine() $assignments = @() $eligibility = @() if ($roleData.PSObject.Properties['assignments']) { $assignments = @($roleData.assignments) } if ($roleData.PSObject.Properties['eligibility']) { $eligibility = @($roleData.eligibility) } $byRole = $assignments | Group-Object -Property _tlRoleName | Sort-Object -Property Name foreach ($group in $byRole) { $members = @($group.Group | ForEach-Object { $(if ($_.PSObject.Properties['_tlPrincipalName'] -and $_._tlPrincipalName) { $_._tlPrincipalName } else { $_.principalId }) }) [void]$md.AppendLine("- **$($group.Name)** (active): $(Get-TLListText -Values $members)") } $eligibleByRole = $eligibility | Group-Object -Property _tlRoleName | Sort-Object -Property Name foreach ($group in $eligibleByRole) { $members = @($group.Group | ForEach-Object { $(if ($_.PSObject.Properties['_tlPrincipalName'] -and $_._tlPrincipalName) { $_._tlPrincipalName } else { $_.principalId }) }) [void]$md.AppendLine("- **$($group.Name)** (PIM eligible): $(Get-TLListText -Values $members)") } [void]$md.AppendLine() } # --- Authorization policy ------------------------------------------------ if (Test-TLArea -Snapshot $Snapshot -Name 'AuthorizationPolicy') { $authArea = $Snapshot.AuthorizationPolicy [void]$md.AppendLine('## Authorization and security defaults') [void]$md.AppendLine() if ($authArea.PSObject.Properties['securityDefaults'] -and $authArea.securityDefaults) { $sdState = $(if ($authArea.securityDefaults.isEnabled) { 'enabled' } else { 'disabled' }) [void]$md.AppendLine("- **Security defaults:** $sdState") } if ($authArea.PSObject.Properties['authorizationPolicy'] -and $authArea.authorizationPolicy) { $authPolicy = $authArea.authorizationPolicy if ($authPolicy.PSObject.Properties['allowInvitesFrom'] -and $authPolicy.allowInvitesFrom) { [void]$md.AppendLine("- **Guest invites allowed from:** $($authPolicy.allowInvitesFrom)") } if ($authPolicy.PSObject.Properties['guestUserRoleId'] -and $authPolicy.guestUserRoleId) { $guestRole = switch ([string]$authPolicy.guestUserRoleId) { 'a0b1b346-4d3e-4e8b-98f8-753987be4970' { 'same as member users' } '10dae51f-b6af-4016-8d66-8c2a99b929b3' { 'limited access (default)' } '2af84b1e-32c8-42b7-82bc-daa82404023b' { 'restricted access' } default { [string]$authPolicy.guestUserRoleId } } [void]$md.AppendLine("- **Guest user permissions:** $guestRole") } if ($authPolicy.PSObject.Properties['defaultUserRolePermissions'] -and $authPolicy.defaultUserRolePermissions) { $userPermissions = $authPolicy.defaultUserRolePermissions [void]$md.AppendLine("- **Users can register applications:** $([bool]$userPermissions.allowedToCreateApps)") if ($userPermissions.PSObject.Properties['permissionGrantPoliciesAssigned']) { [void]$md.AppendLine("- **User consent policy:** $(Get-TLListText -Values $userPermissions.permissionGrantPoliciesAssigned -EmptyText 'consent disabled')") } } } [void]$md.AppendLine() } # --- Authentication methods ---------------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'AuthMethods') { $methodPolicy = $Snapshot.AuthMethods if ($methodPolicy.PSObject.Properties['authenticationMethodConfigurations'] -and $methodPolicy.authenticationMethodConfigurations) { [void]$md.AppendLine('## Authentication methods') [void]$md.AppendLine() [void]$md.AppendLine('| Method | State |') [void]$md.AppendLine('| --- | --- |') $sortedMethods = @($methodPolicy.authenticationMethodConfigurations) | Sort-Object -Property @{ Expression = { [string]$_.state -ne 'enabled' } }, @{ Expression = { [string]$_.id } } foreach ($method in $sortedMethods) { [void]$md.AppendLine(('| {0} | {1} |' -f $method.id, $method.state)) } [void]$md.AppendLine() } } # --- Applications -------------------------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'Applications') { $applications = @($Snapshot.Applications.applications) [void]$md.AppendLine("## App registrations ($($applications.Count))") [void]$md.AppendLine() if ($applications.Count -gt 0) { [void]$md.AppendLine('| App | Credentials | Expired / expiring | High-privilege permissions | Owners |') [void]$md.AppendLine('| --- | --- | --- | --- | --- |') foreach ($application in ($applications | Sort-Object -Property displayName)) { $credentialStatus = $null if ($application.PSObject.Properties['_tlCredentialStatus']) { $credentialStatus = $application._tlCredentialStatus } $risky = @() if ($application.PSObject.Properties['_tlRiskyPermissions']) { $risky = @($application._tlRiskyPermissions) } $ownerCount = @($application.owners).Count [void]$md.AppendLine(('| {0} | {1} | {2} | {3} | {4} |' -f $application.displayName, $(if ($credentialStatus) { $credentialStatus.total } else { '?' }), $(if ($credentialStatus) { "$($credentialStatus.expired) / $($credentialStatus.expiringWithin30Days)" } else { '?' }), (Get-TLListText -Values $risky), $ownerCount)) } [void]$md.AppendLine() } } # --- Granted application permissions ------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'ConsentGrants') { $consentData = $Snapshot.ConsentGrants [void]$md.AppendLine('## Granted application permissions') [void]$md.AppendLine() [void]$md.AppendLine("- **Graph application role grants:** $($consentData.summary.appRoleGrantCount) ($($consentData.summary.highPrivilegeGrantCount) high-privilege)") [void]$md.AppendLine("- **Delegated consent grants:** $($consentData.summary.delegatedGrantCount)") $highPrivilegeGrants = @($consentData.appRoleGrants | Where-Object { $_._tlIsHighPrivilege }) if ($highPrivilegeGrants.Count -gt 0) { [void]$md.AppendLine() [void]$md.AppendLine('| Application | Granted permission |') [void]$md.AppendLine('| --- | --- |') foreach ($grant in ($highPrivilegeGrants | Sort-Object -Property principalDisplayName)) { [void]$md.AppendLine(('| {0} | {1} |' -f $grant.principalDisplayName, $grant._tlPermission)) } } [void]$md.AppendLine() } # --- Cross-tenant access ------------------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'CrossTenantAccess') { $crossTenant = $Snapshot.CrossTenantAccess [void]$md.AppendLine('## External collaboration (cross-tenant)') [void]$md.AppendLine() if ($crossTenant.default -and $crossTenant.default.PSObject.Properties['automaticUserConsentSettings'] -and $crossTenant.default.automaticUserConsentSettings) { $consentSettings = $crossTenant.default.automaticUserConsentSettings [void]$md.AppendLine("- **Automatic user consent (default):** inbound $(if ($consentSettings.inboundAllowed) { 'enabled' } else { 'disabled' }), outbound $(if ($consentSettings.outboundAllowed) { 'enabled' } else { 'disabled' })") } if ($crossTenant.default -and $crossTenant.default.PSObject.Properties['inboundTrust'] -and $crossTenant.default.inboundTrust) { $trust = $crossTenant.default.inboundTrust [void]$md.AppendLine("- **Inbound trust:** MFA accepted: $([bool]$trust.isMfaAccepted); compliant device accepted: $([bool]$trust.isCompliantDeviceAccepted)") } if ($crossTenant.PSObject.Properties['partners']) { [void]$md.AppendLine("- **Partner-specific configurations:** $(@($crossTenant.partners).Count)") } if ($crossTenant.adminConsentRequestPolicy -and $crossTenant.adminConsentRequestPolicy.PSObject.Properties['isEnabled']) { [void]$md.AppendLine("- **Admin consent request workflow:** $(if ($crossTenant.adminConsentRequestPolicy.isEnabled) { 'enabled' } else { 'disabled' })") } [void]$md.AppendLine() } # --- Identity hygiene ---------------------------------------------------- if ((Test-TLArea -Snapshot $Snapshot -Name 'StaleAccounts') -or (Test-TLArea -Snapshot $Snapshot -Name 'MfaRegistration')) { [void]$md.AppendLine('## Identity hygiene') [void]$md.AppendLine() if (Test-TLArea -Snapshot $Snapshot -Name 'StaleAccounts') { $staleData = $Snapshot.StaleAccounts [void]$md.AppendLine("- **Stale accounts (>$($staleData.thresholdDays) days):** $($staleData.summary.staleUserCount) of $($staleData.summary.totalEvaluated) enabled users") [void]$md.AppendLine("- **Guests that never signed in:** $($staleData.summary.neverSignedInGuestCount)") } if (Test-TLArea -Snapshot $Snapshot -Name 'MfaRegistration') { $mfaData = $Snapshot.MfaRegistration [void]$md.AppendLine("- **MFA registration:** $($mfaData.summary.mfaRegistered) of $($mfaData.summary.totalUsers) users ($($mfaData.summary.registeredPercent)%)") if ([int]$mfaData.summary.adminsWithoutMfa -gt 0) { [void]$md.AppendLine("- **Admins without MFA:** $($mfaData.summary.adminsWithoutMfa)") } } if (Test-TLArea -Snapshot $Snapshot -Name 'LegacyAuthSignIns') { $legacyData = $Snapshot.LegacyAuthSignIns [void]$md.AppendLine("- **Legacy auth sign-ins (last $($legacyData.windowDays) days):** $($legacyData.totalSuccessful) successful of $($legacyData.totalAttempts) attempts") } [void]$md.AppendLine() } # --- Groups -------------------------------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'Groups') { $groupData = $Snapshot.Groups [void]$md.AppendLine('## Groups') [void]$md.AppendLine() [void]$md.AppendLine("- **Total groups:** $($groupData.summary.total) ($($groupData.summary.unified) Microsoft 365, $($groupData.summary.dynamic) dynamic, $($groupData.summary.teams) Teams-connected)") [void]$md.AppendLine("- **Ownerless Microsoft 365 groups:** $($groupData.summary.ownerlessUnified)") [void]$md.AppendLine("- **Public Microsoft 365 groups:** $($groupData.summary.publicUnified)") [void]$md.AppendLine() } # --- SharePoint ---------------------------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'SharePointSettings') { $spoSettings = $Snapshot.SharePointSettings [void]$md.AppendLine('## SharePoint & OneDrive sharing') [void]$md.AppendLine() if ($spoSettings.PSObject.Properties['sharingCapability']) { $sharingLabels = @{ 'disabled' = 'Only people in your organization' 'existingExternalUserSharingOnly' = 'Existing guests only' 'externalUserSharingOnly' = 'New and existing guests' 'externalUserAndGuestSharing' = 'Anyone (anonymous links)' } $sharingValue = [string]$spoSettings.sharingCapability $sharingLabel = $(if ($sharingLabels.ContainsKey($sharingValue)) { $sharingLabels[$sharingValue] } else { $sharingValue }) [void]$md.AppendLine("- **External sharing:** $sharingLabel") } if ($spoSettings.PSObject.Properties['isLegacyAuthProtocolsEnabled']) { [void]$md.AppendLine("- **Legacy auth protocols:** $(if ($spoSettings.isLegacyAuthProtocolsEnabled) { 'enabled' } else { 'disabled' })") } if ($spoSettings.PSObject.Properties['isResharingByExternalUsersEnabled']) { [void]$md.AppendLine("- **Resharing by external users:** $(if ($spoSettings.isResharingByExternalUsersEnabled) { 'enabled' } else { 'disabled' })") } [void]$md.AppendLine() } # --- E-mail authentication ----------------------------------------------- if (Test-TLArea -Snapshot $Snapshot -Name 'EmailAuthDns') { $mailDomains = @($Snapshot.EmailAuthDns) [void]$md.AppendLine('## E-mail authentication (SPF / DKIM / DMARC)') [void]$md.AppendLine() [void]$md.AppendLine('| Domain | SPF | DKIM | DMARC |') [void]$md.AppendLine('| --- | --- | --- | --- |') foreach ($entry in $mailDomains) { $spfText = 'missing' if ($entry.spf.present) { $spfText = "present ($($entry.spf.qualifier))" } $dkimText = 'missing' if ($entry.dkim.selector1 -and $entry.dkim.selector2) { $dkimText = 'both selectors' } elseif ($entry.dkim.selector1 -or $entry.dkim.selector2) { $dkimText = 'one selector only' } $dmarcText = 'missing' if ($entry.dmarc.present) { $dmarcText = "p=$($entry.dmarc.policy)" } [void]$md.AppendLine(('| {0} | {1} | {2} | {3} |' -f $entry.domain, $spfText, $dkimText, $dmarcText)) } [void]$md.AppendLine() } # --- Intune -------------------------------------------------------------- $hasIntune = (Test-TLArea -Snapshot $Snapshot -Name 'IntuneCompliance') -or (Test-TLArea -Snapshot $Snapshot -Name 'IntuneConfiguration') -or (Test-TLArea -Snapshot $Snapshot -Name 'IntuneAppProtection') -or (Test-TLArea -Snapshot $Snapshot -Name 'ManagedDevices') if ($hasIntune) { [void]$md.AppendLine('## Intune (device management)') [void]$md.AppendLine() if (Test-TLArea -Snapshot $Snapshot -Name 'IntuneCompliance') { $compliancePolicies = @($Snapshot.IntuneCompliance.policies) $assignedCompliance = @($compliancePolicies | Where-Object { @($_.assignments).Count -gt 0 }) [void]$md.AppendLine("- **Compliance policies:** $($compliancePolicies.Count) ($($assignedCompliance.Count) assigned)") foreach ($policy in ($compliancePolicies | Sort-Object -Property displayName)) { $platform = ([string]$policy.'@odata.type') -replace '^#microsoft\.graph\.', '' -replace 'CompliancePolicy$', '' [void]$md.AppendLine(" - $($policy.displayName) ($platform)") } } if (Test-TLArea -Snapshot $Snapshot -Name 'IntuneConfiguration') { $configurationData = $Snapshot.IntuneConfiguration $deviceConfigurationCount = @($configurationData.deviceConfigurations).Count $settingsCatalogCount = @($configurationData.settingsCatalogPolicies).Count [void]$md.AppendLine("- **Configuration profiles:** $deviceConfigurationCount classic, $settingsCatalogCount settings catalog") } if (Test-TLArea -Snapshot $Snapshot -Name 'IntuneAppProtection') { $appProtection = $Snapshot.IntuneAppProtection [void]$md.AppendLine("- **App protection policies:** iOS $(@($appProtection.iosPolicies).Count), Android $(@($appProtection.androidPolicies).Count)") } if (Test-TLArea -Snapshot $Snapshot -Name 'ManagedDevices') { $deviceData = $Snapshot.ManagedDevices $osParts = @($deviceData.summary.byOperatingSystem.PSObject.Properties | ForEach-Object { "$($_.Name) $($_.Value)" }) [void]$md.AppendLine("- **Managed devices:** $($deviceData.summary.total) ($(Get-TLListText -Values $osParts))") [void]$md.AppendLine("- **Device hygiene:** $($deviceData.summary.staleCount) stale (>$($deviceData.staleThresholdDays)d), $($deviceData.summary.notEncryptedCount) unencrypted, $($deviceData.summary.nonCompliantCount) non-compliant, $($deviceData.summary.unsupportedOsCount) unsupported OS") } [void]$md.AppendLine() } # --- Coverage note ------------------------------------------------------- if ($Snapshot.PSObject.Properties['_Areas'] -and $Snapshot._Areas) { $skippedAreas = @($Snapshot._Areas.PSObject.Properties | Where-Object { $_.Value.Skipped }) if ($skippedAreas.Count -gt 0) { [void]$md.AppendLine('## Not collected') [void]$md.AppendLine() foreach ($areaProperty in $skippedAreas) { [void]$md.AppendLine("- **$($areaProperty.Name):** $($areaProperty.Value.SkipReason)") } [void]$md.AppendLine() } } return $md.ToString() } |