fix: MgGraph commands formatting
This commit is contained in:
@@ -1,7 +1,6 @@
|
||||
function Test-AdministrativeAccountCompliance {
|
||||
[CmdletBinding()]
|
||||
param ()
|
||||
|
||||
begin {
|
||||
# The following conditions are checked:
|
||||
# Condition A: The administrative account is cloud-only (not synced).
|
||||
@@ -11,16 +10,12 @@ function Test-AdministrativeAccountCompliance {
|
||||
$recnum = "1.1.1"
|
||||
Write-Verbose "Starting Test-AdministrativeAccountCompliance with Rec: $recnum"
|
||||
}
|
||||
|
||||
process {
|
||||
|
||||
try {
|
||||
# Retrieve admin roles, assignments, and user details including licenses
|
||||
Write-Verbose "Retrieving admin roles, assignments, and user details including licenses"
|
||||
$adminRoleAssignments = Get-CISMgOutput -Rec $recnum
|
||||
|
||||
$adminRoleUsers = @()
|
||||
|
||||
foreach ($roleName in $adminRoleAssignments.Keys) {
|
||||
$assignments = $adminRoleAssignments[$roleName]
|
||||
foreach ($assignment in $assignments) {
|
||||
@@ -29,21 +24,16 @@ function Test-AdministrativeAccountCompliance {
|
||||
$userPrincipalName = $userDetails.UserPrincipalName
|
||||
$licenses = $assignment.Licenses
|
||||
$licenseString = if ($licenses) { ($licenses.SkuPartNumber -join '|') } else { "No Licenses Found" }
|
||||
|
||||
# Condition A: Check if the account is cloud-only
|
||||
$cloudOnlyStatus = if ($userDetails.OnPremisesSyncEnabled) { "Fail" } else { "Pass" }
|
||||
|
||||
# Condition B: Check if the account has valid licenses
|
||||
$hasValidLicense = $licenses.SkuPartNumber | ForEach-Object { $validLicenses -contains $_ }
|
||||
$validLicensesStatus = if ($hasValidLicense) { "Pass" } else { "Fail" }
|
||||
|
||||
# Condition C: Check if the account has no other licenses
|
||||
$hasInvalidLicense = $licenses.SkuPartNumber | ForEach-Object { $validLicenses -notcontains $_ }
|
||||
$invalidLicenses = $licenses.SkuPartNumber | Where-Object { $validLicenses -notcontains $_ }
|
||||
$applicationAssignmentStatus = if ($hasInvalidLicense) { "Fail" } else { "Pass" }
|
||||
|
||||
Write-Verbose "User: $userPrincipalName, Cloud-Only: $cloudOnlyStatus, Valid Licenses: $validLicensesStatus, Invalid Licenses: $($invalidLicenses -join ', ')"
|
||||
|
||||
# Collect user information
|
||||
$adminRoleUsers += [PSCustomObject]@{
|
||||
UserName = $userPrincipalName
|
||||
@@ -57,17 +47,14 @@ function Test-AdministrativeAccountCompliance {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Group admin role users by UserName and collect unique roles and licenses
|
||||
Write-Verbose "Grouping admin role users by UserName"
|
||||
$uniqueAdminRoleUsers = $adminRoleUsers | Group-Object -Property UserName | ForEach-Object {
|
||||
$first = $_.Group | Select-Object -First 1
|
||||
$roles = ($_.Group.RoleName -join ', ')
|
||||
$licenses = (($_.Group | Select-Object -ExpandProperty Licenses) -join ',').Split(',') | Select-Object -Unique
|
||||
|
||||
$first | Select-Object UserName, UserId, HybridUser, @{Name = 'Roles'; Expression = { $roles } }, @{Name = 'Licenses'; Expression = { $licenses -join '|' } }, CloudOnlyStatus, ValidLicensesStatus, ApplicationAssignmentStatus
|
||||
}
|
||||
|
||||
# Identify non-compliant users based on conditions A, B, and C
|
||||
Write-Verbose "Identifying non-compliant users based on conditions"
|
||||
$nonCompliantUsers = $uniqueAdminRoleUsers | Where-Object {
|
||||
@@ -75,7 +62,6 @@ function Test-AdministrativeAccountCompliance {
|
||||
$_.ValidLicensesStatus -eq "Fail" -or # Fails Condition B
|
||||
$_.ApplicationAssignmentStatus -eq "Fail" # Fails Condition C
|
||||
}
|
||||
|
||||
# Generate failure reasons
|
||||
Write-Verbose "Generating failure reasons for non-compliant users"
|
||||
$failureReasons = $nonCompliantUsers | ForEach-Object {
|
||||
@@ -88,13 +74,10 @@ function Test-AdministrativeAccountCompliance {
|
||||
else {
|
||||
"Compliant Accounts: $($uniqueAdminRoleUsers.Count)"
|
||||
}
|
||||
|
||||
$result = $nonCompliantUsers.Count -eq 0
|
||||
$status = if ($result) { 'Pass' } else { 'Fail' }
|
||||
$details = if ($nonCompliantUsers) { "Username | Roles | Cloud-Only Status | EntraID P1/P2 License Status | Other Applications Assigned Status`n$failureReasons" } else { "N/A" }
|
||||
|
||||
Write-Verbose "Assessment completed. Result: $status"
|
||||
|
||||
# Create the parameter splat
|
||||
$params = @{
|
||||
Rec = $recnum
|
||||
@@ -103,7 +86,6 @@ function Test-AdministrativeAccountCompliance {
|
||||
Details = $details
|
||||
FailureReason = $failureReason
|
||||
}
|
||||
|
||||
$auditResult = Initialize-CISAuditResult @params
|
||||
}
|
||||
catch {
|
||||
@@ -111,7 +93,6 @@ function Test-AdministrativeAccountCompliance {
|
||||
$auditResult = Get-TestError -LastError $LastError -recnum $recnum
|
||||
}
|
||||
}
|
||||
|
||||
end {
|
||||
# Output the result
|
||||
return $auditResult
|
||||
|
||||
Reference in New Issue
Block a user