Private/Get-MsecEnvironment.ps1
|
function Get-MsecEnvironment { <# .SYNOPSIS Resolves the cloud-specific endpoints msec needs (AAD authority, Microsoft Graph, Key Vault, ARM, Defender) for an Azure environment, derived from Get-AzEnvironment so commercial, Azure China (Mooncake), and US Gov all work without per-cloud branches scattered through the module. .DESCRIPTION With no -Name, uses the current Az context's environment, defaulting to 'AzureCloud' when the context doesn't name one (keeps behaviour identical to the old hardcoded module for commercial callers and for unit tests with a bare mocked context). All endpoints have trailing slashes trimmed so callers can concatenate a leading-slash path safely. Microsoft Graph's endpoint comes from the environment's ExtendedProperties on modern Az.Accounts, with a per-cloud fallback for older Az. Defender for Endpoint (securitycenter) has no Get-AzEnvironment property and is commercial-only - it is $null in sovereign clouds (e.g. retired in Azure China), so callers fail with a clear message instead of hitting a dead host. .PARAMETER Name Azure environment name (e.g. 'AzureCloud', 'AzureChinaCloud', 'AzureUSGovernment'). Defaults to the current Az context's environment. #> [CmdletBinding()] param( [Parameter()] [string] $Name ) if (-not $Name) { $ctx = Get-AzContext -ErrorAction SilentlyContinue $Name = if ($ctx -and $ctx.Environment) { $ctx.Environment } else { 'AzureCloud' } } $env = Get-AzEnvironment -Name $Name -ErrorAction Stop if (-not $env) { throw "Unknown Azure environment '$Name'. Connect with Connect-AzAccount -Environment <name> first." } # Microsoft Graph: present in ExtendedProperties on modern Az; fall back per cloud. $graph = $null if ($env.ExtendedProperties -and $env.ExtendedProperties.ContainsKey('MicrosoftGraphUrl')) { $graph = $env.ExtendedProperties['MicrosoftGraphUrl'] } if (-not $graph) { $graph = switch ($Name) { 'AzureChinaCloud' { 'https://microsoftgraph.chinacloudapi.cn' } 'AzureUSGovernment' { 'https://graph.microsoft.us' } default { 'https://graph.microsoft.com' } } } # Defender for Endpoint (securitycenter) is commercial-only here. $defender = if ($Name -eq 'AzureCloud') { 'https://api.securitycenter.microsoft.com' } else { $null } [pscustomobject]@{ EnvironmentName = $Name AadAuthority = $env.ActiveDirectoryAuthority.TrimEnd('/') GraphResource = $graph.TrimEnd('/') DefenderResource = $defender KeyVaultResource = $env.AzureKeyVaultServiceEndpointResourceId.TrimEnd('/') KeyVaultDnsSuffix = $env.AzureKeyVaultDnsSuffix ArmResource = $env.ResourceManagerUrl.TrimEnd('/') } } |