From b10258c5b4e50cf3ae1e334e16e2cd9cf0fd15a0 Mon Sep 17 00:00:00 2001
From: Tomas Kracmar <tomas.kracmar@cqre.net>
Date: Mon, 27 Jul 2026 09:49:48 +0200
Subject: [PATCH] fix(ca-exporter): pre-fetch auth context class references to
 fix ID resolution
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaced per-policy Graph API calls with a single pre-fetch of all
authentication context class references into a hashtable, consistent
with every other lookup in the script. Also fixes silent ID drops when
DisplayName was missing — GetOrDefault now falls back to the raw ID.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../Invoke-ConditionalAccessDocumentation.ps1 | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/Scripts/Invoke-ConditionalAccessDocumentation.ps1 b/Scripts/Invoke-ConditionalAccessDocumentation.ps1
index d70d6ad..b81196b 100644
--- a/Scripts/Invoke-ConditionalAccessDocumentation.ps1
+++ b/Scripts/Invoke-ConditionalAccessDocumentation.ps1
@@ -393,6 +393,14 @@ try {
     $termsOfUseAgreements = @{}
 }
 
+# Authentication context class references
+try {
+    $authContextClassReferences = Get-MgIdentityConditionalAccessAuthenticationContextClassReference -All -ErrorAction Stop | Group-Object -Property Id -AsHashTable
+} catch {
+    Write-Warning "Authentication context class references could not be retrieved. Context names will not be resolved."
+    $authContextClassReferences = @{}
+}
+
 # GSA network filtering profiles
 try {
     $networkFilteringProfiles = Invoke-MgGraphRequest -Uri 'https://graph.microsoft.com/beta/networkAccess/filteringProfiles' -Method GET -OutputType PSObject -ErrorAction Stop |
@@ -441,15 +449,8 @@ foreach ($policy in $conditionalAccessPolicies) {
         @($policy.Conditions?.ClientApplications?.IncludeServicePrincipals) | ForEach-Object { $includeServicePrincipals.Add($servicePrincipals.GetOrDefault($_, $_)) }
         @($policy.Conditions?.ClientApplications?.ExcludeServicePrincipals) | ForEach-Object { $excludeServicePrincipals.Add($servicePrincipals.GetOrDefault($_, $_)) }
 
-        $includeAuthenticationContext = [System.Collections.Generic.List[Object]]::new()
-        @($policy.Conditions?.Applications?.IncludeAuthenticationContextClassReferences) | ForEach-Object {
-            try {
-                $context = Get-MgIdentityConditionalAccessAuthenticationContextClassReference -Filter "Id eq '$PSItem'" -ErrorAction Stop
-                if ($context.DisplayName) { $includeAuthenticationContext.Add($context.DisplayName) }
-            } catch {
-                $includeAuthenticationContext.Add($PSItem)
-            }
-        }
+        $includeAuthenticationContext = @($policy.Conditions?.Applications?.IncludeAuthenticationContextClassReferences) |
+            ForEach-Object { $authContextClassReferences.GetOrDefault($_, $_) }
 
         $includeLocations = @($policy.Conditions?.Locations?.IncludeLocations) | ForEach-Object { $namedLocations.GetOrDefault($_, $_) }
         $excludeLocations = @($policy.Conditions?.Locations?.ExcludeLocations) | ForEach-Object { $namedLocations.GetOrDefault($_, $_) }