Add files via upload
This commit is contained in:
Mikael Karlsson
GitHub
273
Extensions/ConditionalAccess.psm1
Normal file
273
Extensions/ConditionalAccess.psm1
Normal file
@@ -0,0 +1,273 @@
|
||||
########################################################
|
||||
#
|
||||
# Common module functions
|
||||
#
|
||||
########################################################
|
||||
function Add-ModuleMenuItems
|
||||
{
|
||||
Add-MenuItem (New-Object PSObject -Property @{
|
||||
Title = (Get-ConditionalAccessName)
|
||||
MenuID = "IntuneGraphAPI"
|
||||
Script = [ScriptBlock]{Get-ConditionalAccess}
|
||||
})
|
||||
}
|
||||
|
||||
function Get-SupportedImportObjects
|
||||
{
|
||||
$global:importObjects += (New-Object PSObject -Property @{
|
||||
Selected = $true
|
||||
Title = (Get-ConditionalAccessName)
|
||||
Script = [ScriptBlock]{
|
||||
param($rootFolder)
|
||||
|
||||
Write-Status "Import all conditional access policies"
|
||||
Import-AllConditionalAccessObjects (Join-Path $rootFolder (Get-ConditionalAccessFolderName))
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
function Get-SupportedExportObjects
|
||||
{
|
||||
$global:exportObjects += (New-Object PSObject -Property @{
|
||||
Selected = $true
|
||||
Title = (Get-ConditionalAccessName)
|
||||
Script = [ScriptBlock]{
|
||||
param($rootFolder)
|
||||
|
||||
Write-Status "Export all conditional access policies"
|
||||
Get-ConditionalAccessObjects | ForEach-Object { Export-SingleConditionalAccess $PSItem.Object (Join-Path $rootFolder (Get-ConditionalAccessFolderName)) }
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
function Export-AllObjects
|
||||
{
|
||||
param($addObjectSubfolder)
|
||||
|
||||
$subFolder = ""
|
||||
if($addObjectSubfolder) { $subFolder = Get-ConditionalAccessFolderName }
|
||||
}
|
||||
|
||||
########################################################
|
||||
#
|
||||
# Object specific functions
|
||||
#
|
||||
########################################################
|
||||
function Get-ConditionalAccessName
|
||||
{
|
||||
return "Conditional Access"
|
||||
}
|
||||
|
||||
function Get-ConditionalAccessFolderName
|
||||
{
|
||||
return "ConditionalAccess"
|
||||
}
|
||||
|
||||
function Get-ConditionalAccess
|
||||
{
|
||||
Write-Status "Loading conditional access objects"
|
||||
$dgObjects.ItemsSource = @(Get-ConditionalAccessObjects)
|
||||
|
||||
#Scriptblocks that will perform the export tasks. empty by default
|
||||
$script:exportParams = @{}
|
||||
$script:exportParams.Add("ExportAllScript", [ScriptBlock]{
|
||||
Export-AllConditionalAccess $global:txtExportPath.Text
|
||||
Set-ObjectGrid
|
||||
Write-Status ""
|
||||
})
|
||||
|
||||
$script:exportParams.Add("ExportSelectedScript", [ScriptBlock]{
|
||||
Export-SelectedConditionalAccess $global:txtExportPath.Text
|
||||
Set-ObjectGrid
|
||||
Write-Status ""
|
||||
})
|
||||
#Scriptblock that will perform the import all files
|
||||
$script:importAll = [ScriptBlock]{
|
||||
Import-AllConditionalAccessObjects $global:txtImportPath.Text
|
||||
Set-ObjectGrid
|
||||
}
|
||||
|
||||
#Scriptblock that will perform the import of selected files
|
||||
$script:importSelected = [ScriptBlock]{
|
||||
Import-ConditionalAccessObjects $global:lstFiles.ItemsSource -Selected
|
||||
Set-ObjectGrid
|
||||
}
|
||||
|
||||
#Scriptblock that will read json files
|
||||
$script:getImportFiles = [ScriptBlock]{
|
||||
Show-FileListBox
|
||||
$global:lstFiles.ItemsSource = @(Get-JsonFileObjects $global:txtImportPath.Text -Exclude "*_Settings.json")
|
||||
}
|
||||
|
||||
Add-DefaultObjectButtons -export ([scriptblock]{Show-DefaultExportGrid @script:exportParams}) -import ([scriptblock]{Show-DefaultImportGrid -ImportAll $script:importAll -ImportSelected $script:importSelected -GetFiles $script:getImportFiles})
|
||||
}
|
||||
|
||||
function Get-ConditionalAccessObjects
|
||||
{
|
||||
#https://main.iam.ad.ext.azure.com/api/Policies/Policies?top=10&nextLink=null&appId=&includeBaseline=true
|
||||
Get-AzureNativeObjects "Policies/Policies?top=10&nextLink=null&appId=&includeBaseline=true" -property @('policyName')
|
||||
}
|
||||
|
||||
function Export-AllConditionalAccess
|
||||
{
|
||||
param($path = "$env:Temp")
|
||||
|
||||
if(-not (Test-Path $path)) { mkdir -Path $path -Force -ErrorAction SilentlyContinue | Out-Null }
|
||||
|
||||
if(Test-Path $path)
|
||||
{
|
||||
foreach($objTmp in ($global:dgObjects.ItemsSource))
|
||||
{
|
||||
Export-SingleConditionalAccess $objTmp.Object $path
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function Export-SelectedConditionalAccess
|
||||
{
|
||||
param($path = "$env:Temp")
|
||||
|
||||
Export-SingleConditionalAccess $global:dgObjects.SelectedItem.Object $path
|
||||
}
|
||||
|
||||
function Export-SingleConditionalAccess
|
||||
{
|
||||
param($psObj, $path = "$env:Temp")
|
||||
|
||||
if(-not $psObj) { return }
|
||||
|
||||
if($global:runningBulkExport -ne $true)
|
||||
{
|
||||
if($global:chkAddCompanyName.IsChecked) { $path = Join-Path $path $global:organization.displayName }
|
||||
if($global:chkAddObjectType.IsChecked) { $path = Join-Path $path (Get-ConditionalAccessFolderName) }
|
||||
}
|
||||
|
||||
if(-not (Test-Path $path)) { mkdir -Path $path -Force -ErrorAction SilentlyContinue | Out-Null }
|
||||
|
||||
if(Test-Path $path)
|
||||
{
|
||||
Write-Status "Export $($psObj.policyName)"
|
||||
|
||||
if($psObj.baselineType -eq 0)
|
||||
{
|
||||
$obj = Invoke-AzureNativeRequest "Policies/$($psObj.policyId)"
|
||||
}
|
||||
else
|
||||
{
|
||||
$obj = Invoke-AzureNativeRequest "BaselinePolicies/$($psObj.policyId)"
|
||||
}
|
||||
|
||||
if($obj)
|
||||
{
|
||||
$fileName = "$path\$((Remove-InvalidFileNameChars $psObj.policyName)).json"
|
||||
ConvertTo-Json $obj -Depth 5 | Out-File $fileName -Force
|
||||
}
|
||||
|
||||
if($jsonObj.usersV2.included.groupIds)
|
||||
{
|
||||
$jsonObj.usersV2.included.groupIds | ForEach-Object { Add-GroupMigrationObject $PSItem }
|
||||
}
|
||||
|
||||
if($jsonObj.usersV2.excluded.groupIds)
|
||||
{
|
||||
$jsonObj.usersV2.excluded.groupIds | ForEach-Object { Add-GroupMigrationObject $PSItem }
|
||||
}
|
||||
|
||||
if($jsonObj.usersV2.included.userIds -or $jsonObj.usersV2.excluded.userIds)
|
||||
{
|
||||
Write-Log "Users are specified in $($psObj.policyName). User are not supported in this version. This conditional access policy might not be imported" 2
|
||||
}
|
||||
|
||||
if($jsonObj.usersV2.included.roleIds -or $jsonObj.usersV2.excluded.roleIds)
|
||||
{
|
||||
Write-Log "Roles are specified in $($psObj.policyName). Roles are not supported in this version. This conditional access policy might not be imported" 2
|
||||
}
|
||||
|
||||
if($jsonObj.conditions.namedNetworks.includedNetworkIds -or $jsonObj.conditions.namedNetworks.excludedNetworkIds)
|
||||
{
|
||||
Write-Log "Networks are specified in $($psObj.policyName). Named networks are not supported in this version. This conditional access policy might not be imported" 2
|
||||
}
|
||||
|
||||
# There might be a lot more to check here...
|
||||
|
||||
$global:exportedObjects++
|
||||
}
|
||||
}
|
||||
|
||||
function Import-ConditionalAccess
|
||||
{
|
||||
param($obj)
|
||||
|
||||
$json = Update-JsonForEnvironment $json
|
||||
|
||||
if($obj.baselineType -eq 0)
|
||||
{
|
||||
$obj.policyId = ""
|
||||
$obj.isAllProtocolsEnabled = $true
|
||||
$json = ConvertTo-Json $obj -Depth 10
|
||||
$json = Update-JsonForEnvironment $json
|
||||
|
||||
if((Invoke-AzureNativeRequest "Policies/Validate" -Method POST -Body $json) -eq 11)
|
||||
{
|
||||
Invoke-AzureNativeRequest "Policies" -Method POST -Body $json | Out-Null
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Log "Policy validation of json data failed" 3
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Log "Conditional Access Baseline Policies does not support import"
|
||||
#Invoke-AzureNativeRequest "BaselinePolicies/$($obj.id)" -Method PUT -Body (ConvertTo-Json $obj -Depth 5) | Out-Null
|
||||
}
|
||||
}
|
||||
|
||||
function Import-AllConditionalAccessObjects
|
||||
{
|
||||
param($path = "$env:Temp")
|
||||
|
||||
Import-ConditionalAccessObjects (Get-JsonFileObjects $path)
|
||||
}
|
||||
|
||||
function Import-ConditionalAccessObjects
|
||||
{
|
||||
param(
|
||||
$Objects,
|
||||
|
||||
[switch]
|
||||
$Selected
|
||||
)
|
||||
|
||||
Write-Status "Import conditional access policies"
|
||||
|
||||
foreach($obj in $objects)
|
||||
{
|
||||
if($Selected -and $obj.Selected -ne $true) { continue }
|
||||
|
||||
Write-Log "Import Conditional Access: $($obj.Object.policyName)"
|
||||
|
||||
$response = Import-ConditionalAccess $obj.Object
|
||||
|
||||
if($response)
|
||||
{
|
||||
$global:importedObjects++
|
||||
}
|
||||
# No additionl assignments on conditional access policies
|
||||
}
|
||||
$dgObjects.ItemsSource = @(Get-ConditionalAccessObjects)
|
||||
Write-Status ""
|
||||
}
|
||||
|
||||
<#
|
||||
# Get all networks
|
||||
Get-AzureNativeObjects "NamedNetworksV2"
|
||||
|
||||
# Network example
|
||||
#{"networkName":"Australia","cidrIpRanges":[],"categories":[],"applyToUnknownCountry":false,"countryIsoCodes":["AU"],"isTrustedLocation":false,"namedLocationsType":2}
|
||||
|
||||
Get-AzureNativeObjects "NamedNetworksV2" -Method POST -Body $json | Out-Nul
|
||||
|
||||
# Get all contry codes
|
||||
NamedNetworksV2/CountryCodes
|
||||
#>
|
||||
Reference in New Issue
Block a user