EntraCaExclusionReport.psd1
|
@{ RootModule = 'EntraCaExclusionReport.psm1' ModuleVersion = '1.0.0' GUID = 'c42d12f6-aa1a-4b3f-aafa-57c6aa773d35' Author = 'Olamide Olaleye' CompanyName = 'Fountview' Copyright = '(c) Olamide Olaleye. All rights reserved.' Description = @' Audit reporting for Microsoft Entra ID Conditional Access exclusions. Enumerates every Conditional Access policy in a tenant and exports one CSV row per excluded user or group principal per policy, so that every deliberate hole in a Conditional Access control is visible and attributable. Excluded directory roles and excluded guest/external user types can be included on request. Group membership is never enumerated or expanded, by design. The module is strictly read-only against the directory and authenticates interactively via Microsoft Graph device code flow. '@ PowerShellVersion = '7.0' CompatiblePSEditions = @('Core') # Explicit list. Never @() - PSGallery would install the module with nothing callable. FunctionsToExport = 'Get-EntraCaExclusionReport' CmdletsToExport = @() VariablesToExport = @() AliasesToExport = @() # Deliberately NOT declared as RequiredModules: the Microsoft Graph SDK sub-modules are large # and slow to import, and Get-EntraCaExclusionReport performs its own runtime availability # check and fails with an actionable Install-Module instruction. Declaring them here would # force every one of them to load on Import-Module, including for -Help or tab completion. # Required at runtime: Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns, # Microsoft.Graph.Users, Microsoft.Graph.Groups, and - only under -IncludeExcludedRoles - # Microsoft.Graph.Identity.DirectoryManagement. PrivateData = @{ PSData = @{ Tags = @('Entra', 'EntraID', 'AzureAD', 'ConditionalAccess', 'Security', 'Audit', 'MicrosoftGraph', 'Compliance', 'PSGallery') LicenseUri = 'https://github.com/Princetimber/EntraCaExclusionReport/blob/main/LICENSE' ProjectUri = 'https://github.com/Princetimber/EntraCaExclusionReport' ReleaseNotes = @' Initial public release. Get-EntraCaExclusionReport enumerates every Conditional Access policy in an Entra ID tenant and exports one CSV row per excluded user or group principal per policy, so every deliberate exclusion from a Conditional Access control is visible and attributable. - Strictly read-only against the directory. No create, update or delete against any Entra ID object; the only write is the CSV. - Group membership is never enumerated or expanded. Group exclusions are reported by ObjectID and DisplayName only. - Unresolved principals are never dropped. The raw identifier is preserved with a marked unresolved display name. - Per-policy error isolation. A failure on one policy does not abort the run or truncate the report. - A policy with no exclusions still produces one row, so the CSV is a complete assessment rather than a partial extract. - Six-column CSV: PolicyName, State, ObjectID, UserPrincipalName, DisplayName, PrincipalType. - Optional -IncludeExcludedRoles adds excluded directory roles and guest/external user types. - Device code sign-in by default, or -UseExistingConnection to reuse a Graph session. Requires PowerShell 7.0+ and the Microsoft Graph SDK (checked at runtime, not declared as RequiredModules so importing the module stays fast). '@ # Set by the Sampler build from GitVersion; must exist as an empty string in # source so ModuleBuilder has a key to write into. Prerelease = '' } } } |