vibecoding/M365FoundationsCISReport
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Error handling in 1.1.1 test

Browse Source
This commit is contained in:
DrIOS
2024-04-15 16:27:01 -05:00
parent fe503509ea
commit 8f44424962
1 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
source/tests/Test-AdministrativeAccountCompliance.ps1
View File

@@ -8,23 +8,29 @@ function Test-AdministrativeAccountCompliance {
$validLicenses = @('AAD_PREMIUM', 'AAD_PREMIUM_P2') $validLicenses = @('AAD_PREMIUM', 'AAD_PREMIUM_P2')
} }
process { process {
$adminRoles = Get-MgRoleManagementDirectoryRoleDefinition | Where-Object { $_.DisplayName -like "*Admin*" } $adminRoles = Get-MgRoleManagementDirectoryRoleDefinition | Where-Object { $_.DisplayName -like "*Admin*" }
$adminRoleUsers = @() $adminRoleUsers = @()
foreach ($role in $adminRoles) { foreach ($role in $adminRoles) {
$roleAssignments = Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$($role.Id)'" $roleAssignments = Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$($role.Id)'"
foreach ($assignment in $roleAssignments) { foreach ($assignment in $roleAssignments) {
$userDetails = Get-MgUser -UserId $assignment.PrincipalId -Property "DisplayName, UserPrincipalName, Id, OnPremisesSyncEnabled" $userDetails = Get-MgUser -UserId $assignment.PrincipalId -Property "DisplayName, UserPrincipalName, Id, OnPremisesSyncEnabled" -ErrorAction SilentlyContinue
$licenses = (Get-MgUserLicenseDetail -UserId $assignment.PrincipalId).SkuPartNumber -join '|' if ($userDetails) {
$adminRoleUsers += [PSCustomObject]@{ $licenses = Get-MgUserLicenseDetail -UserId $assignment.PrincipalId -ErrorAction SilentlyContinue
UserName = $userDetails.UserPrincipalName $licenseString = if ($licenses) { ($licenses.SkuPartNumber -join '|') } else { "No Licenses Found" }
RoleName = $role.DisplayName
UserId = $userDetails.Id $adminRoleUsers += [PSCustomObject]@{
HybridUser = $userDetails.OnPremisesSyncEnabled UserName = $userDetails.UserPrincipalName
Licenses = $licenses RoleName = $role.DisplayName
UserId = $userDetails.Id
HybridUser = $userDetails.OnPremisesSyncEnabled
Licenses = $licenseString
}
} }
} }
} }
$uniqueAdminRoleUsers = $adminRoleUsers | Group-Object -Property UserName | ForEach-Object { $uniqueAdminRoleUsers = $adminRoleUsers | Group-Object -Property UserName | ForEach-Object {
$first = $_.Group | Select-Object -First 1 $first = $_.Group | Select-Object -First 1
$roles = ($_.Group.RoleName -join ', ') $roles = ($_.Group.RoleName -join ', ')
@@ -32,10 +38,12 @@ function Test-AdministrativeAccountCompliance {
$first | Select-Object UserName, UserId, HybridUser, @{Name = 'Roles'; Expression = { $roles } }, @{Name = 'Licenses'; Expression = { $licenses -join '|' } } $first | Select-Object UserName, UserId, HybridUser, @{Name = 'Roles'; Expression = { $roles } }, @{Name = 'Licenses'; Expression = { $licenses -join '|' } }
} }
$nonCompliantUsers = $uniqueAdminRoleUsers | Where-Object { $nonCompliantUsers = $uniqueAdminRoleUsers | Where-Object {
$_.HybridUser -or $_.HybridUser -or
-not ($_.Licenses -split '\|' | Where-Object { $validLicenses -contains $_ }) -not ($_.Licenses -split '\|' | Where-Object { $validLicenses -contains $_ })
} }
$failureReasons = $nonCompliantUsers | ForEach-Object { $failureReasons = $nonCompliantUsers | ForEach-Object {
$accountType = if ($_.HybridUser) { "Hybrid" } else { "Cloud-Only" } $accountType = if ($_.HybridUser) { "Hybrid" } else { "Cloud-Only" }
$missingLicenses = $validLicenses | Where-Object { $_ -notin ($_.Licenses -split '\|') } $missingLicenses = $validLicenses | Where-Object { $_ -notin ($_.Licenses -split '\|') }