From 2f0d937ca1386beae870f60d75b49db8a13699a1 Mon Sep 17 00:00:00 2001
From: Tomas Kracmar <tomas.kracmar@cqre.net>
Date: Mon, 27 Jul 2026 09:53:42 +0200
Subject: [PATCH] fix(ca-exporter): resolve AuthenticationFlows TransferMethods
 and surface in Excel

Raw object dump replaced with TransferMethods extraction (falls back to
AdditionalProperties for older module versions). Field added to the
Conditions section of Excel detail sheets.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 Scripts/Invoke-ConditionalAccessDocumentation.ps1 | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/Scripts/Invoke-ConditionalAccessDocumentation.ps1 b/Scripts/Invoke-ConditionalAccessDocumentation.ps1
index b81196b..3812d0c 100644
--- a/Scripts/Invoke-ConditionalAccessDocumentation.ps1
+++ b/Scripts/Invoke-ConditionalAccessDocumentation.ps1
@@ -494,7 +494,10 @@ foreach ($policy in $conditionalAccessPolicies) {
         $includeGuestsOrExternalUserTypes   = $policy.Conditions?.Users?.IncludeGuestsOrExternalUsers?.guestOrExternalUserTypes
         $includeGuestsOrExternalUserTenants = @($policy.Conditions?.Users?.IncludeGuestsOrExternalUsers?.externalTenants?.AdditionalProperties?['members'])
 
-        $authenticationFlows = @($policy.Conditions?.AuthenticationFlows)
+        $authFlowsObj = $policy.Conditions?.AuthenticationFlows
+        $authenticationFlows = if ($authFlowsObj) {
+            $authFlowsObj.TransferMethods ?? $authFlowsObj.AdditionalProperties?['transferMethods']
+        }
 
         $applicationsAdditional = $null
         if ($policy.Conditions?.Applications?.AdditionalProperties) {
@@ -553,7 +556,7 @@ foreach ($policy in $conditionalAccessPolicies) {
                 ExcludeDeviceStates                        = (@($excludeDeviceStates) -join $separator)
                 IncludeGuestsOrExternalUserTypes           = $includeGuestsOrExternalUserTypes
                 IncludeGuestOrExternalUserTenants          = (@($includeGuestsOrExternalUserTenants) -join $separator)
-                AuthenticationFlows                        = (@($authenticationFlows) -join $separator)
+                AuthenticationFlows                        = $authenticationFlows
                 ApplicationsAdditional                     = $applicationsAdditional
                 ConditionsAdditional                       = $conditionsAdditional
                 IncludeServicePrincipals                  = ($includeServicePrincipals -join $separator)
@@ -647,8 +650,9 @@ if ($ExportExcel) {
             @{ Label = 'Locations exclude'; Col = 'ExcludeLocations' },
             @{ Label = 'Device filter mode'; Col = 'DeviceFilterMode' },
             @{ Label = 'Device filter rule'; Col = 'DeviceFilterRule' },
-            @{ Label = 'Sign-in risk';   Col = 'SignInRiskLevels' },
-            @{ Label = 'User risk';      Col = 'UserRiskLevels' }
+            @{ Label = 'Sign-in risk';        Col = 'SignInRiskLevels' },
+            @{ Label = 'User risk';           Col = 'UserRiskLevels' },
+            @{ Label = 'Authentication flows'; Col = 'AuthenticationFlows' }
         )},
         @{ Title = 'Grant'; Fields = @(
             @{ Label = 'Operator';        Col = 'GrantControlsOperator' },