TestEnvironment

1.2.0

Seeds a realistic identity test environment in Entra ID, Active Directory, Okta, Authentik or FreeIPA - users in every lifecycle state, groups, devices and hosts, and the access policy over them - and tears it down again cleanly, proving ownership of every object before deleting it. One connect-seed-report-teardown surface for all five, no module dependencies, Windows
Seeds a realistic identity test environment in Entra ID, Active Directory, Okta, Authentik or FreeIPA - users in every lifecycle state, groups, devices and hosts, and the access policy over them - and tears it down again cleanly, proving ownership of every object before deleting it. One connect-seed-report-teardown surface for all five, no module dependencies, Windows PowerShell 5.1 and PowerShell 7.
Show more

Minimum PowerShell version

5.1

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name TestEnvironment

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name TestEnvironment

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Jeffrey Stuhr. All rights reserved.

Package Details

Author(s)

  • Jeffrey Stuhr

Tags

TestData TestEnvironment SeedData Identity IAM IdentityManagement Entra EntraID AzureAD MicrosoftGraph ActiveDirectory Okta Authentik FreeIPA Kerberos LDAP ConditionalAccess PIM HBAC Sudo Automation Pester Lab Windows Linux MacOS

Functions

Connect-TestEnvironment Disconnect-TestEnvironment Get-TestEnvironmentProvider New-TestEnvironment Remove-TestEnvironment Get-TestEnvironmentReport Get-TestAccessToken New-TestServiceApp Get-TestServiceApp Update-TestContainment New-EntraAdministrativeUnit New-EntraUser New-EntraGuestUser New-EntraGroup New-EntraDevice New-EntraApplication New-EntraNamedLocation New-EntraConditionalAccessPolicy New-EntraAuthenticationStrength New-EntraDirectoryRole New-EntraRoleEligibility New-EntraDirectoryExtension Set-EntraLicense New-ADTestOUStructure New-ADTestUser New-ADTestDevice New-ADTestSecurityGroups New-ADTestServiceAccount New-ADTestEdgeCase New-ADTestGroupPolicy New-ADTestDnsZone New-ADTestPasswordPolicy Get-ADTestPasswordFromVault New-OktaProfileAttribute New-OktaUser New-OktaGroup New-OktaGroupRule New-OktaApp New-OktaUserType New-OktaNetworkZone New-OktaPolicy New-OktaLinkedObject New-OktaTrustedOrigin New-OktaEventHook New-AuthentikGroup New-AuthentikUser New-AuthentikRole New-AuthentikApplication New-AuthentikOutpost New-AuthentikFlow New-AuthentikScopeMapping New-AuthentikEntitlement New-AuthentikPolicy New-AuthentikNotificationRule New-AuthentikBinding New-AuthentikToken New-AuthentikInvitation New-FreeIPAGroup New-FreeIPAUser New-FreeIPAHostgroup New-FreeIPAHost New-FreeIPANetgroup New-FreeIPAHbacRule New-FreeIPASudoRule New-FreeIPARole New-FreeIPAPasswordPolicy New-FreeIPAService New-FreeIPAIdView New-FreeIPAOtpToken New-FreeIPAAutomemberRule New-FreeIPAAutomount New-FreeIPASelinuxUserMap New-FreeIPACertMapRule New-FreeIPACaAcl New-FreeIPACertificate New-FreeIPADnsZone New-FreeIPAIdentityProvider

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

1.2.0 - Seed data that can find string bugs, and four defects the live runs turned up.

Every provider's people were accented Latin and nothing else, so the only string bugs this
module could find were the ones Latin-1 exposes. Nine new people each carry one specific way
that string handling goes wrong: Han with an ideographic space that is not U+0020, a surname
above the basic plane where one character is two UTF-16 units, Cyrillic homoglyphs a duplicate
check made by eye cannot see, Greek with its positional final sigma, right-to-left Arabic, a
decomposed name that renders identically to an existing precomposed one, a Turkish dotless i,
an eszett that upper-cases into two characters, and Devanagari combining vowel signs. Every
login stays plain ASCII, because that is the field a directory actually constrains; the writing
system lives in the display name, where a real directory keeps it. Counts move with it: Active
Directory 296 users to 311, Entra 305 to 329, Authentik 306 to 330, FreeIPA 333 to 357.

Okta is capped at eight users by its licence and cannot carry the cohort, so its one Japanese
person is now written in kanji rather than romaji, as she is in every other provider.

Fixes, all found while verifying that data against live directories:

- An Active Directory teardown refused at the confirmation prompt deleted the environment
 anyway. The guard returned from begin{}, which ends the begin block and nothing else, so
 process{} ran regardless. Unattended it always took that path, because Read-Host reads EOF
 and never matches CONFIRM. An automated teardown must now pass -Force, which was always the
 documented bypass; -WhatIf still beats it.
- The seeding counters undercounted badly - 176 of 311 users and 569 of 688 devices, with none
 skipped and no error raised - because jobs that finished between two readings of the job list
 were dropped from tracking without ever being received.
- Entra teardown left behind any user still in a role-assignable group, which Graph refuses to
 delete until the group is gone, and the group deletion needs a moment to take effect. That
 refusal is now retried once after a pause.
- Service account creation failed at random, about one seed run in three hundred, when a
 generated password happened to contain a three-letter token of the account's own display
 name. Windows reports that as a length, complexity or history failure and names none of the
 three. A refused account was also left behind without a password, which every later run then
 skipped as already created.

1.1.0 - The Active Directory provider catches up, and learns to survive a messy domain.

Seeded computers now resolve: two directory-integrated DNS zones of the seed's own, an A
record and a PTR for all 688 devices, and records around them that deliberately do not
reconcile. Eight service accounts register a principal name against a seeded server and one
delegates, constrained; unconstrained delegation is never seeded. Three fine-grained password
policies sit over seeded groups at three precedences. Remove-TestEnvironment -Keep now works
against Active Directory, which was the only provider without it.

Connecting picks a domain controller that answers rather than trusting discovery, and pins
every later call to it, so a domain that registers a controller it is not running no longer
breaks a seed halfway through. If that controller stops answering mid-run the seed stops with
one message instead of failing every remaining step.

Fixes: teardown claimed password settings objects by name pattern rather than by the seed tag;
the service account step discarded the password export entries it built, so the documentation
wrote nothing and the entries leaked onto the output stream; DNS zone objects were looked for
in the wrong directory partition, so the seed tag was never written and teardown refused to
remove its own zones.

1.0.0 - First release.

Five providers behind one connect-seed-report-teardown surface:

- Entra ID: ~1,150 objects across twelve types, held in administrative units.
- Active Directory: ~1,100 objects across five types, held in OU=TestData.
- Okta: ~60 objects across ten types, seed-tagged.
- Authentik: ~480 objects across seventeen types, under a user path of their own.
- FreeIPA: ~970 objects across twenty-eight types, seed-tagged, in DNS zones of their own.

The Entra and Active Directory providers seed the same people, so hybrid identity matching
is testable across the two.

Every provider proves ownership before deleting anything, never puts a directory into an
enforcing state (a seeded Conditional Access policy is report-only, a seeded PIM eligibility
is never active, a stock FreeIPA rule is never touched, and none of that is a parameter),
and honours -WhatIf over -Force on every destructive command. RequiredModules is empty:
importing this module installs nothing. The AD provider imports RSAT at connect time; the
other four run from a stock host on any platform.

See CHANGELOG.md for the detail.

FileList

Version History

Version Downloads Last updated
1.2.0 (current version) 6 9/12/2026
1.1.0 6 9/12/2026
1.0.0 6 9/12/2026