EntraCaExclusionReport.psd1

@{
    RootModule           = 'EntraCaExclusionReport.psm1'
    ModuleVersion        = '1.0.0'
    GUID                 = 'c42d12f6-aa1a-4b3f-aafa-57c6aa773d35'
    Author               = 'Olamide Olaleye'
    CompanyName          = 'Fountview'
    Copyright            = '(c) Olamide Olaleye. All rights reserved.'

    Description          = @'
Audit reporting for Microsoft Entra ID Conditional Access exclusions. Enumerates every Conditional
Access policy in a tenant and exports one CSV row per excluded user or group principal per policy,
so that every deliberate hole in a Conditional Access control is visible and attributable. Excluded
directory roles and excluded guest/external user types can be included on request. Group membership
is never enumerated or expanded, by design. The module is strictly read-only against the directory
and authenticates interactively via Microsoft Graph device code flow.
'@


    PowerShellVersion    = '7.0'
    CompatiblePSEditions = @('Core')

    # Explicit list. Never @() - PSGallery would install the module with nothing callable.
    FunctionsToExport    = 'Get-EntraCaExclusionReport'
    CmdletsToExport      = @()
    VariablesToExport    = @()
    AliasesToExport      = @()

    # Deliberately NOT declared as RequiredModules: the Microsoft Graph SDK sub-modules are large
    # and slow to import, and Get-EntraCaExclusionReport performs its own runtime availability
    # check and fails with an actionable Install-Module instruction. Declaring them here would
    # force every one of them to load on Import-Module, including for -Help or tab completion.
    # Required at runtime: Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns,
    # Microsoft.Graph.Users, Microsoft.Graph.Groups, and - only under -IncludeExcludedRoles -
    # Microsoft.Graph.Identity.DirectoryManagement.

    PrivateData          = @{
        PSData = @{
            Tags         = @('Entra', 'EntraID', 'AzureAD', 'ConditionalAccess', 'Security', 'Audit', 'MicrosoftGraph', 'Compliance', 'PSGallery')
            LicenseUri   = 'https://github.com/Princetimber/EntraCaExclusionReport/blob/main/LICENSE'
            ProjectUri   = 'https://github.com/Princetimber/EntraCaExclusionReport'
            ReleaseNotes = @'
Initial public release.

Get-EntraCaExclusionReport enumerates every Conditional Access policy in an Entra ID tenant and exports one CSV row per excluded user or group principal per policy, so every deliberate exclusion from a Conditional Access control is visible and attributable.

- Strictly read-only against the directory. No create, update or delete against any Entra ID object; the only write is the CSV.
- Group membership is never enumerated or expanded. Group exclusions are reported by ObjectID and DisplayName only.
- Unresolved principals are never dropped. The raw identifier is preserved with a marked unresolved display name.
- Per-policy error isolation. A failure on one policy does not abort the run or truncate the report.
- A policy with no exclusions still produces one row, so the CSV is a complete assessment rather than a partial extract.
- Six-column CSV: PolicyName, State, ObjectID, UserPrincipalName, DisplayName, PrincipalType.
- Optional -IncludeExcludedRoles adds excluded directory roles and guest/external user types.
- Device code sign-in by default, or -UseExistingConnection to reuse a Graph session.

Requires PowerShell 7.0+ and the Microsoft Graph SDK (checked at runtime, not declared as RequiredModules so importing the module stays fast).
'@


            # Set by the Sampler build from GitVersion; must exist as an empty string in
            # source so ModuleBuilder has a key to write into.
            Prerelease   = ''
        }
    }
}