EntraOps

1.0.0

Private/Get-EntraOpsTenantGovernanceResourceDefinition.ps1

                                <#

.SYNOPSIS

    Returns the supported Microsoft Entra resource types and their required Microsoft Graph read

    permissions for the EntraOps Tenant Governance Snapshot feature.

.DESCRIPTION

    Central definition used by the TenantGovernance cmdlets (Get-EntraOpsTenantGovernanceSnapshot,

    Save-EntraOpsTenantGovernanceSnapshotJson) and by New-EntraOpsWorkloadIdentity to configure the

    permissions of the first-party "Microsoft Tenant Configuration Management" (UTCM/TCM) service

    principal.

    Reference: https://learn.microsoft.com/en-us/graph/utcm-entra-resources

#>

function Get-EntraOpsTenantGovernanceResourceDefinition {

    [CmdletBinding()]

    param()

    # All Microsoft Entra resource types currently supported by Tenant Configuration Management (UTCM).

    $AvailableResources = @(

        "microsoft.entra.administrativeUnit",

        "microsoft.entra.application",

        "microsoft.entra.authenticationContextClassReference",

        "microsoft.entra.authenticationMethodPolicy",

        "microsoft.entra.authenticationMethodPolicyAuthenticator",

        "microsoft.entra.authenticationMethodPolicyEmail",

        "microsoft.entra.authenticationMethodPolicyFido2",

        "microsoft.entra.authenticationMethodPolicySms",

        "microsoft.entra.authenticationMethodPolicySoftware",

        "microsoft.entra.authenticationMethodPolicyTemporary",

        "microsoft.entra.authenticationMethodPolicyVoice",

        "microsoft.entra.authenticationMethodPolicyX509",

        "microsoft.entra.authenticationStrengthPolicy",

        "microsoft.entra.authorizationPolicy",

        "microsoft.entra.conditionalAccessPolicy",

        "microsoft.entra.crossTenantAccessPolicy",

        "microsoft.entra.crossTenantAccessPolicyConfigurationDefault",

        "microsoft.entra.crossTenantAccessPolicyConfigurationPartner",

        "microsoft.entra.entitlementManagementAccessPackage",

        "microsoft.entra.entitlementManagementAccessPackageAssignmentPolicy",

        "microsoft.entra.entitlementManagementAccessPackageCatalog",

        "microsoft.entra.entitlementManagementAccessPackageCatalogResource",

        "microsoft.entra.entitlementManagementConnectedOrganization",

        "microsoft.entra.externalIdentityPolicy",

        "microsoft.entra.group",

        "microsoft.entra.groupLifecyclePolicy",

        "microsoft.entra.namedLocationPolicy",

        "microsoft.entra.roleDefinition",

        "microsoft.entra.roleEligibilityScheduleRequest",

        "microsoft.entra.roleSetting",

        "microsoft.entra.securityDefaults",

        "microsoft.entra.servicePrincipal",

        "microsoft.entra.socialIdentityProvider",

        "microsoft.entra.tenantDetails",

        "microsoft.entra.tokenLifetimePolicy",

        "microsoft.entra.user"

    )

    # Least-privileged Microsoft Graph *read* application permissions required by the first-party

    # "Microsoft Tenant Configuration Management" (UTCM/TCM) service principal to capture each

    # resource type in a snapshot. Used by New-EntraOpsWorkloadIdentity to grant only the

    # permissions needed for the resources configured in TenantGovernanceSnapshot.ResourcesToInclude.

    $ResourcePermissions = [ordered]@{

        "microsoft.entra.administrativeUnit"                                 = @("AdministrativeUnit.Read.All", "RoleManagement.Read.Directory")

        "microsoft.entra.application"                                        = @("Application.Read.All", "Policy.Read.All")

        "microsoft.entra.authenticationContextClassReference"                = @("Policy.Read.ConditionalAccess")

        "microsoft.entra.authenticationMethodPolicy"                         = @("Policy.Read.AuthenticationMethod")

        "microsoft.entra.authenticationMethodPolicyAuthenticator"            = @("Policy.Read.AuthenticationMethod", "Group.Read.All")

        "microsoft.entra.authenticationMethodPolicyEmail"                    = @("Policy.Read.AuthenticationMethod", "Group.Read.All")

        "microsoft.entra.authenticationMethodPolicyFido2"                    = @("Policy.Read.AuthenticationMethod", "Group.Read.All")

        "microsoft.entra.authenticationMethodPolicySms"                      = @("Policy.Read.AuthenticationMethod", "Group.Read.All")

        "microsoft.entra.authenticationMethodPolicySoftware"                 = @("Policy.Read.AuthenticationMethod", "Group.Read.All")

        "microsoft.entra.authenticationMethodPolicyTemporary"                = @("Policy.Read.AuthenticationMethod", "Group.Read.All")

        "microsoft.entra.authenticationMethodPolicyVoice"                    = @("Policy.Read.AuthenticationMethod", "Group.Read.All")

        "microsoft.entra.authenticationMethodPolicyX509"                     = @("Policy.Read.AuthenticationMethod", "Group.Read.All")

        "microsoft.entra.authenticationStrengthPolicy"                       = @("Policy.Read.AuthenticationMethod")

        "microsoft.entra.authorizationPolicy"                                = @("Policy.Read.All")

        "microsoft.entra.conditionalAccessPolicy"                            = @("Agreement.Read.All", "Application.Read.All", "Group.Read.All", "Policy.Read.All", "RoleManagement.Read.Directory", "User.Read.All", "CustomSecAttributeDefinition.Read.All")

        "microsoft.entra.crossTenantAccessPolicy"                            = @("Policy.Read.All")

        "microsoft.entra.crossTenantAccessPolicyConfigurationDefault"        = @("Policy.Read.All")

        "microsoft.entra.crossTenantAccessPolicyConfigurationPartner"        = @("Policy.Read.All")

        "microsoft.entra.entitlementManagementAccessPackage"                 = @("EntitlementManagement.Read.All")

        "microsoft.entra.entitlementManagementAccessPackageAssignmentPolicy" = @("EntitlementManagement.Read.All")

        "microsoft.entra.entitlementManagementAccessPackageCatalog"          = @("EntitlementManagement.Read.All")

        "microsoft.entra.entitlementManagementAccessPackageCatalogResource"  = @("EntitlementManagement.Read.All")

        "microsoft.entra.entitlementManagementConnectedOrganization"        = @("EntitlementManagement.Read.All")

        "microsoft.entra.externalIdentityPolicy"                            = @("Policy.Read.All")

        "microsoft.entra.group"                                             = @("Application.Read.All", "Device.Read.All", "Directory.Read.All", "Group.Read.All", "ReportSettings.Read.All")

        "microsoft.entra.groupLifecyclePolicy"                              = @("Directory.Read.All")

        "microsoft.entra.namedLocationPolicy"                               = @("Policy.Read.All")

        "microsoft.entra.roleDefinition"                                    = @("RoleManagement.Read.Directory")

        "microsoft.entra.roleEligibilityScheduleRequest"                    = @("RoleEligibilitySchedule.Read.Directory", "Directory.Read.All")

        "microsoft.entra.roleSetting"                                       = @("Group.Read.All", "RoleManagement.Read.Directory", "User.Read.All", "RoleManagementPolicy.Read.Directory")

        "microsoft.entra.securityDefaults"                                  = @("Policy.Read.All")

        "microsoft.entra.servicePrincipal"                                  = @("Application.Read.All", "Group.Read.All", "User.Read.All")

        "microsoft.entra.socialIdentityProvider"                            = @("IdentityProvider.Read.All")

        "microsoft.entra.tenantDetails"                                     = @("Organization.Read.All")

        "microsoft.entra.tokenLifetimePolicy"                               = @("Policy.Read.All")

        "microsoft.entra.user"                                              = @("RoleManagement.Read.Directory", "User.Read.All")

        # Microsoft Intune resource types (reference: https://learn.microsoft.com/en-us/graph/utcm-intune-resources)

        "microsoft.intune.accountProtectionLocalUserGroupMembershipPolicy"                    = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceCategory"                                                      = @("DeviceManagementManagedDevices.Read.All")

        "microsoft.intune.deviceCompliancePolicyAndroid"                                        = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceCompliancePolicyAndroidDeviceOwner"                             = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceCompliancePolicyAndroidWorkProfile"                             = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceCompliancePolicyIos"                                            = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceCompliancePolicyMacos"                                          = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceCompliancePolicyWindows10"                                      = @("Group.Read.All", "DeviceManagementConfiguration.Read.All", "DeviceManagementScripts.Read.All")

        "microsoft.intune.deviceConfigurationDefenderForEndpointOnboardingPolicyWindows10"      = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceConfigurationDomainJoinPolicyWindows10"                         = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceConfigurationIdentityProtectionPolicyWindows10"                 = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceConfigurationImportedPfxCertificatePolicyWindows10"              = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceConfigurationPkcsCertificatePolicyWindows10"                    = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceConfigurationPolicyMacos"                                       = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceConfigurationScepCertificatePolicyWindows10"                    = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceConfigurationTrustedCertificatePolicyWindows10"                 = @("Group.Read.All", "DeviceManagementConfiguration.Read.All")

        "microsoft.intune.deviceEnrollmentLimitRestriction"                                     = @("DeviceManagementServiceConfig.Read.All")

        "microsoft.intune.deviceEnrollmentPlatformRestriction"                                  = @("Group.Read.All", "DeviceManagementServiceConfig.Read.All")

        # Microsoft Security and Compliance resource types (reference: https://learn.microsoft.com/en-us/graph/utcm-securityandcompliance-resources).

        # These resources are backed by the Office 365 Exchange Online API rather than Microsoft Graph,

        # and require the "Exchange.ManageAsApp" application permission granted on the Office 365

        # Exchange Online resource service principal (AppId 00000002-0000-0ff1-ce00-000000000000).

        "microsoft.securityandcompliance.deviceConditionalAccessPolicy" = @("Exchange.ManageAsApp")

        "microsoft.securityandcompliance.deviceConfigurationPolicy"    = @("Exchange.ManageAsApp")

    }

    # Default identity, access, Intune and compliance resources for tenant governance reporting.

    $DefaultResources = @(

        "microsoft.entra.administrativeUnit",

        "microsoft.entra.authenticationContextClassReference",

        "microsoft.entra.authenticationMethodPolicy",

        "microsoft.entra.authenticationMethodPolicyAuthenticator",

        "microsoft.entra.authenticationMethodPolicyEmail",

        "microsoft.entra.authenticationMethodPolicyFido2",

        "microsoft.entra.authenticationMethodPolicySms",

        "microsoft.entra.authenticationMethodPolicySoftware",

        "microsoft.entra.authenticationMethodPolicyTemporary",

        "microsoft.entra.authenticationMethodPolicyVoice",

        "microsoft.entra.authenticationMethodPolicyX509",

        "microsoft.entra.authenticationStrengthPolicy",

        "microsoft.entra.authorizationPolicy",

        "microsoft.entra.conditionalAccessPolicy",

        "microsoft.entra.crossTenantAccessPolicy",

        "microsoft.entra.crossTenantAccessPolicyConfigurationDefault",

        "microsoft.entra.crossTenantAccessPolicyConfigurationPartner",

        "microsoft.entra.entitlementManagementAccessPackageAssignmentPolicy",

        "microsoft.entra.entitlementManagementConnectedOrganization",

        "microsoft.entra.externalIdentityPolicy",

        "microsoft.entra.groupLifecyclePolicy",

        "microsoft.entra.namedLocationPolicy",

        "microsoft.entra.roleDefinition",

        "microsoft.entra.roleEligibilityScheduleRequest",

        "microsoft.entra.roleSetting",

        "microsoft.entra.securityDefaults",

        "microsoft.entra.socialIdentityProvider",

        "microsoft.entra.tenantDetails",

        "microsoft.entra.tokenLifetimePolicy",

        "microsoft.intune.accountProtectionLocalUserGroupMembershipPolicy",

        "microsoft.intune.deviceCategory",

        "microsoft.intune.deviceCompliancePolicyAndroid",

        "microsoft.intune.deviceCompliancePolicyAndroidDeviceOwner",

        "microsoft.intune.deviceCompliancePolicyAndroidWorkProfile",

        "microsoft.intune.deviceCompliancePolicyIos",

        "microsoft.intune.deviceCompliancePolicyMacos",

        "microsoft.intune.deviceCompliancePolicyWindows10",

        "microsoft.intune.deviceConfigurationDefenderForEndpointOnboardingPolicyWindows10",

        "microsoft.intune.deviceConfigurationDomainJoinPolicyWindows10",

        "microsoft.intune.deviceConfigurationIdentityProtectionPolicyWindows10",

        "microsoft.intune.deviceConfigurationImportedPfxCertificatePolicyWindows10",

        "microsoft.intune.deviceConfigurationPkcsCertificatePolicyWindows10",

        "microsoft.intune.deviceConfigurationPolicyMacos",

        "microsoft.intune.deviceConfigurationScepCertificatePolicyWindows10",

        "microsoft.intune.deviceConfigurationTrustedCertificatePolicyWindows10",

        "microsoft.intune.deviceEnrollmentLimitRestriction",

        "microsoft.intune.deviceEnrollmentPlatformRestriction"

        # NOTE: microsoft.securityandcompliance.* resource types are deliberately NOT part of the default set.

        # They require "Exchange.ManageAsApp", which is not a read permission - it allows running Exchange

        # Online PowerShell as an app and, combined with an Exchange-capable directory role, amounts to

        # tenant-wide mail/compliance management. They remain in $AvailableResources so they can be enabled

        # explicitly via ResourcesToInclude by an operator who accepts that grant.

    )

    return [PSCustomObject]@{

        AvailableResources  = $AvailableResources

        DefaultResources    = $DefaultResources

        ResourcePermissions = $ResourcePermissions

    }

}

# SIG # Begin signature block

# MIIniAYJKoZIhvcNAQcCoIIneTCCJ3UCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCrE13xVyooY0Wc

# OX6/A4Iid40jv5CVFWa0T7I1R/PrDaCCIDwwggXJMIIEsaADAgECAhAbtY8lKt8j

# AEkoya49fu0nMA0GCSqGSIb3DQEBDAUAMH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQK

# ExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2Vy

# dGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5l

# dHdvcmsgQ0EwHhcNMjEwNTMxMDY0MzA2WhcNMjkwOTE3MDY0MzA2WjCBgDELMAkG

# A1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMuQS4xJzAl

# BgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIGA1UEAxMb

# Q2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMIICIjANBgkqhkiG9w0BAQEFAAOC

# Ag8AMIICCgKCAgEAvfl4+ObVgAxknYYblmRnPyI6HnUBfe/7XGeMycxca6mR5rlC

# 5SBLm9qbe7mZXdmbgEvXhEArJ9PoujC7Pgkap0mV7ytAJMKXx6fumyXvqAoAl4Va

# qp3cKcniNQfrcE1K1sGzVrihQTib0fsxf4/gX+GxPw+OFklg1waNGPmqJhCrKtPQ

# 0WeNG0a+RzDVLnLRxWPa52N5RH5LYySJhi40PylMUosqp8DikSiJucBb+R3Z5yet

# /5oCl8HGUJKbAiy9qbk0WQq/hEr/3/6zn+vZnuCYI+yma3cWKtvMrTscpIfcRnNe

# GWJoRVfkkIJCu0LW8GHgwaM9ZqNd9BjuiMmNF0UpmTJ1AjHuKSbIawLmtWJFfzcV

# WiNoidQ+3k4nsPBADLxNF8tNorMe0AZa3faTz1d1mfX6hhpneLO/lv403L3nUlbl

# s+V1e9dBkQXcXWnjlQ1DufyDljmVe2yAWk8TcsbXfSl6RLpSpCrVQUYJIP4ioLZb

# MI28iQzV13D4h1L92u+sUS4Hs07+0AnacO+Y+lbmbdu1V0vc5SwlFcieLnhO+Nqc

# noYsylfzGuXIkosagpZ6w7xQEmnYDlpGizrrJvojybawgb5CAKT41v4wLsfSRvbl

# jnX98sy50IdbzAYQYLuDNbdeZ95H7JlI8aShFf6tjGKOOVVPORa5sWOd/7cCAwEA

# AaOCAT4wggE6MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLahVDkCw6A/joq8

# +tT4HKbROg79MB8GA1UdIwQYMBaAFAh2zcsH/yT2xc3tu5C84oQ3RnX3MA4GA1Ud

# DwEB/wQEAwIBBjAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8vY3JsLmNlcnR1bS5w

# bC9jdG5jYS5jcmwwawYIKwYBBQUHAQEEXzBdMCgGCCsGAQUFBzABhhxodHRwOi8v

# c3ViY2Eub2NzcC1jZXJ0dW0uY29tMDEGCCsGAQUFBzAChiVodHRwOi8vcmVwb3Np

# dG9yeS5jZXJ0dW0ucGwvY3RuY2EuY2VyMDkGA1UdIAQyMDAwLgYEVR0gADAmMCQG

# CCsGAQUFBwIBFhhodHRwOi8vd3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZIhvcNAQEM

# BQADggEBAFHCoVgWIhCL/IYx1MIy01z4S6Ivaj5N+KsIHu3V6PrnCA3st8YeDrJ1

# BXqxC/rXdGoABh+kzqrya33YEcARCNQOTWHFOqj6seHjmOriY/1B9ZN9DbxdkjuR

# mmW60F9MvkyNaAMQFtXx0ASKhTP5N+dbLiZpQjy6zbzUeulNndrnQ/tjUoCFBMQl

# lVXwfqefAcVbKPjgzoZwpic7Ofs4LphTZSJ1Ldf23SIikZbr3WjtP6MZl9M7JYjs

# NhI9qX7OAo0FmpKnJ25FspxihjcNpDOO16hO0EoXQ0zF8ads0h5YbBRRfopUofbv

# n3l6XYGaFpAP4bvxSgD5+d2+7arszgowggZrMIIEU6ADAgECAhBX5gfP8LabvnxC

# XoItEBa/MA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhB

# c3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBDb2RlIFNp

# Z25pbmcgMjAyMSBDQTAeFw0yNjEwMDYwODI4MjNaFw0yNzEwMDYwODI4MjJaMIGQ

# MQswCQYDVQQGEwJERTEdMBsGA1UECAwUUmhpbmVsYW5kLVBhbGF0aW5hdGUxEjAQ

# BgNVBAcMCUxhaG5zdGVpbjEeMBwGA1UECgwVT3BlbiBTb3VyY2UgRGV2ZWxvcGVy

# MS4wLAYDVQQDDCVPcGVuIFNvdXJjZSBEZXZlbG9wZXIgVGhvbWFzIE5hdW5oZWlt

# MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAphp2ljSmVsRB6gvkEq7A

# DUMENpKZiDFoAfF1ktD1nCwaVyI+bJ0ROjHwAn4iJgS+vlBDPOUIw2GLHkiqUhOg

# HSwzg6gj45GNmt6zxsKP0zPlhMB/fb0zmz7/F7e3yfKCXLfhbHuk0Es9gJ+8Wmet

# 9StVwwSE/K0MpW06GKA9nPWyE4N/ADwigDIj9rsTKJR4cve9w8G1b3zohpUc/qMr

# onab+HVw5r9b3sOBnnaXC6zvrX4fovRz1ztwfWjRjILLoFG6mW/TuK5F2ICD3Rhl

# 9R2rJWWWhzTDMsQlzvX+/SaM74q3OFpIVNdhvtmWU9pKUBRAyYMijcDqKEFGSzrc

# 8JFmGMpP5TuroWF+N21d3px2eARvW1mV0DCfFAH+Og20SH/gVW6/ltQQEkH/z/Zt

# 49ARyJrgESLOQtlMCIYSoKISdkk4ml4VUS1E/PcbzXEYj3a7m6DOxcd3WuY03UT9

# cnk3p0LMN6LeLYAZgVY+HRloZlH+kW2SkOHNuWgtXvZhAgMBAAGjggF4MIIBdDAM

# BgNVHRMBAf8EAjAAMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jY3NjYTIwMjEu

# Y3JsLmNlcnR1bS5wbC9jY3NjYTIwMjEuY3JsMHMGCCsGAQUFBwEBBGcwZTAsBggr

# BgEFBQcwAYYgaHR0cDovL2Njc2NhMjAyMS5vY3NwLWNlcnR1bS5jb20wNQYIKwYB

# BQUHMAKGKWh0dHA6Ly9yZXBvc2l0b3J5LmNlcnR1bS5wbC9jY3NjYTIwMjEuY2Vy

# MB8GA1UdIwQYMBaAFN10XUwA23ufoHTKsW73PMAywHDNMB0GA1UdDgQWBBTBvGyH

# MXj1dMbVnxuof9oP4PY7cDBLBgNVHSAERDBCMAgGBmeBDAEEATA2BgsqhGgBhvZ3

# AgUBBDAnMCUGCCsGAQUFBwIBFhlodHRwczovL3d3dy5jZXJ0dW0ucGwvQ1BTMBMG

# A1UdJQQMMAoGCCsGAQUFBwMDMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsF

# AAOCAgEAkC165c7/r6y3VeEEpNXas9bQs6ZpKPdJffHkf9xoPi4kWvAIWGc4ocG1

# DJLb18RXiDYShDmT5sb/6I08FeipKi2DNJkuOq6yOTJ3S7+hNFIZCyd6i7WKO8ea

# P5I+FAbyJP4+5coZoMg45bUa9JoocaJCm+5n7WiCfN7/EQpClW5Trm4+ZMbp7EMN

# F1uLJgGCMnN0SsoUarp7PHlqupMxMC4Uhhe+lAP2ytcSIU81L97/qjrADbLWqICk

# 9il5iGM+aZndguq/cmfH9rJj4GRZHWnG6WwnzYD9+KgYlRI6em+/9dq+IRiXe2Bs

# thUuIaFW7U2gWw8tBTEYm1UBLHdJx+L1gjJCLs5KT/wy5wU32wZxNDqPUQejUC1x

# GvU3cKqmLgRq+yNf3gFVfzqIoggyM3U9wQvnk7nBtCkpjXS2hdx4yxzcmrlWsDHr

# z6+6/jeyQySzbYUlFmKnc4n9Mw2soHOajEua5poFARVRS5KgUBuiiQ21YFNYzWBo

# qGuECaaAI/C5rGxapMJ3dAOBnHw6NLqBet+ZXBJEccX5y89MLlOQu+jDmJP8HieR

# qDLlwfhVZnw4RY8Rus43NZBwhNlVuOUXqocHKmJhKNlekda3qsJj93eQBQOxKJcc

# w5O08q9jukpH2+yzFAj+7ll33DuNUgWptogc4Awtbx3glzcEvJQwggaCMIIEaqAD

# AgECAhAo8HfBHDa9/l90MkdwJy4DMA0GCSqGSIb3DQEBDAUAMFYxCzAJBgNVBAYT

# AlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMT

# G0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQTAeFw0yNjAzMTEwNzM0NTRaFw0z

# NjAyMjcwNzM0NTRaMFAxCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhBc3NlY28gRGF0

# YSBTeXN0ZW1zIFMuQS4xHjAcBgNVBAMMFUNlcnR1bSBUaW1lc3RhbXAgMjAyNjCC

# AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALi9zfBw+xI12hi2F9uNQBNO

# STkTIi13fuh3DiWybI5392bBfJw6tO7zDs7UqP/rejVf4xFTU3XNOPsuOFkP5SPF

# snWwn3VJL+NhNhsuujvYsQtaQnvNo1wk46reTgws1L8OFEdKaxgyqT4zOQx81mLw

# NZSqXNU9Rrb9oAJWJF4Mydz+C1ebu0D0+vgM3tqAQ8TU203fqgKCPqIdHloaFqH9

# eyR+8tnpmy2hnnN59ZOtmsuHeRwf5iTOhlhf0d/qqquLOSIGPgGVL1Hj5XBUox2O

# E7tQRr+l/xxNbL6OuwBO4Aa2EbuxYg37cpXv5i2/lTL4NASB/duf9W4fjA3Ro+GP

# +bC54n2OYiM3Cq8z92ejx8F5HWO2e4/75eC95B9tMw/eq7109GDyW2+2ut5Bn0o8

# MXJTERkyystWbqcnUkomA97qfiDCwvpWuOMdfTOksXe9S+xDxOJaCbiyTivgPulx

# cT+tfQTRXBr5UwtPvc+INnafOEilzVHA11tv+pHcylryxBc08cUihf/ttqkZS0bm

# x3VxQay8uohaTp0//ECA9vYGW51SKdJMJhXvKyIdBLy8WYNchTt8yRITv9Adxg9J

# qGujh+TnP1bW3aQjFtlEl7SzgNeI8OVA/CJAWWUuRT3Au9ToOpHy/flrrknhN4he

# Ew7/6ILMv4HSsj0YZ4otAgMBAAGjggFQMIIBTDB1BggrBgEFBQcBAQRpMGcwOwYI

# KwYBBQUHMAKGL2h0dHA6Ly9zdWJjYS5yZXBvc2l0b3J5LmNlcnR1bS5wbC9jdHNj

# YTIwMjEuY2VyMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u

# Y29tMB8GA1UdIwQYMBaAFL5UAi+/QGxzQ86sCSVOnkNEGu7gMAwGA1UdEwEB/wQC

# MAAwOQYDVR0fBDIwMDAuoCygKoYoaHR0cDovL3N1YmNhLmNybC5jZXJ0dW0ucGwv

# Y3RzY2EyMDIxLmNybDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8E

# BAMCB4AwIgYDVR0gBBswGTAIBgZngQwBBAIwDQYLKoRoAYb2dwIFAQswHQYDVR0O

# BBYEFCM5aiirmhKnpKfyH/lFmr+N/oIDMA0GCSqGSIb3DQEBDAUAA4ICAQBm/pOb

# rAveTqYFPCSthxNVwBHTW4TfuBQY2KGCdMlH6ALjVPYf2XARNGMTXScR0JQ2/c2L

# xLpoHHhRwxFf3d933DhFS165rYj6iPSQKm41rc9AMpTCjMdmai1aK9o870pOzTzL

# RhWFVIxm+5Qf+t4V5z14tPoUsAWdfRKD1Zzvzfe5AHlE9rxOZcGROiULxs3Edf7Z

# J8RZI0jzD9juj2oEX2XS7BVKuNCK1W0h1mjapv028yqo8UtZh5/1Ib48Yyp88BDY

# Shh5PSGUUuS5tYXVfcduIPBe3PdNTYRYdT5VNxkwLgjMzIcr/6SH2fejFJDjnCxj

# vXLuarErJg/IdI+hXdGIBDVOGv1zrkF4ktoQvFZIp5DIAYh0GwyUhc87qqn5UaYT

# j2+iyiBDSNh7aGCrkuAnqg7Qh7frhX+QhMGeJ9SpLpnG76qN85hLyjvYR6gRYiLT

# j8G4fxjqV400/buPw0rBo9yJZyq/8cGdCOLPOYf9qpefTcrZKeO9pg+UJHx8UABb

# aTqizRxm8sUSEycccCCFhIit3AI/3wGuSOADeiA676NcQ7+dsP04YvzvdN7pTZNy

# g672WpBDJdg0eItHl4yomvNeIOWh1qs4QqOW6TI8Ocsi4uSDTLorxLUDnBTwKQzz

# pxd1YUctEgRh32R0J9FkFkeEruJU94RljFr1uDCCBrkwggShoAMCAQICEQCZo4AK

# JlU7ZavcboSms+o5MA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAG

# A1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVt

# IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3Rl

# ZCBOZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjE4WhcNMzYwNTE4MDUzMjE4WjBW

# MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEu

# MSQwIgYDVQQDExtDZXJ0dW0gQ29kZSBTaWduaW5nIDIwMjEgQ0EwggIiMA0GCSqG

# SIb3DQEBAQUAA4ICDwAwggIKAoICAQCdI88EMCM7wUYs5zNzPmNdenW6vlxNur3r

# Lfi+5OZ+U3iZIB+AspO+CC/bj+taJUbMbFP1gQBJUzDUCPx7BNLgid1TyztVLn52

# NKgxxu8gpyTr6EjWyGzKU/gnIu+bHAse1LCitX3CaOE13rbuHbtrxF2tPU8f253Q

# gX6eO8yTbGps1Mg+yda3DcTsOYOhSYNCJiL+5wnjZ9weoGRtvFgMHtJg6i671OPX

# IciiHO4Lwo2p9xh/tnj+JmCQEn5QU0NxzrOiRna4kjFaA9ZcwSaG7WAxeC/xoZSx

# F1oK1UPZtKVt+yrsGKqWONoK6f5EmBOAVEK2y4ATDSkb34UD7JA32f+Rm0wsr5aj

# zftDhA5mBipVZDjHpwzv8bTKzCDUSUuUmPo1govD0RwFcTtMXcfJtm1i+P2UNXad

# PyYVKRxKQATHN3imsfBiNRdN5kiVVeqP55piqgxOkyt+HkwIA4gbmSc3hD8ke66t

# 9MjlcNg73rZZlrLHsAIV/nJ0mmgSjBI/TthoGJDydekOQ2tQD2Dup/+sKQptalDl

# ui59SerVSJg8gAeV7N/ia4mrGoiez+SqV3olVfxyLFt3o/OQOnBmjhKUANoKLYlK

# mUpKEFI0PfoT8Q1W/y6s9LTI6ekbi0igEbFUIBE8KDUGfIwnisEkBw5KcBZ3XwnH

# mfznwlKo8QIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU

# 3XRdTADbe5+gdMqxbvc8wDLAcM0wHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61Pgc

# ptE6Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDAGA1Ud

# HwQpMCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYI

# KwYBBQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0

# dW0uY29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwv

# Y3RuY2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0

# cDovL3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQB1iFgP5Y9Q

# KJpTnxDsQ/z0O23JmoZifZdEOEmQvo/79PQg9nLF/GJe6ZiUBEyDBHMtFRK0mXj3

# Qv3gL0sYXe+PPMfwmreJHvgFGWQ7XwnfMh2YIpBrkvJnjwh8gIlNlUl4KENTK5DL

# qsYPEtRQCw7R6p4s2EtWyDDr/M58iY2UBEqfUU/ujR9NuPyKk0bEcEi62JGxauFY

# zZ/yld13fHaZskIoq2XazjaD0pQkcQiIueL0HKiohS6XgZuUtCKA7S6CHttZEsOb

# QJ1j2s0urIDdqF7xaXFVaTHKtAuMfwi0jXtF3JJphrJfc+FFILgCbX/uYBPBlbBI

# P4Ht4xxk2GmfzMn7oxPITpigQFJFWuzTMUUgdRHTxaTSKRJ/6Uh7ki/pFjf9sUAS

# WgxT69QF9Ki4JF5nBIujxZ2sOU9e1HSCJwOfK07t5nnzbs1LbHuAIGJsRJiQ6HX/

# DW1XFOlXY1rc9HufFhWU+7Uk+hFkJsfzqBz3pRO+5aI6u5abI4Qws4YaeJH7H7M8

# X/YNoaArZbV4Ql+jarKsE0+8XvC4DJB+IVcvC9Ydqahi09mjQse4fxfef0L7E3hh

# o2O3bLDM6v60rIRUCi2fJT2/IRU5ohgyTch4GuYWefSBsp5NPJh4QRTP9DC3gc5Q

# EKtbrTY0Ka87Web7/zScvLmvQBm8JDFpDjCCBrkwggShoAMCAQICEQDn/2nHOzXO

# S5Em2HR8aKWHMA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UE

# ChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENl

# cnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBO

# ZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjA3WhcNMzYwNTE4MDUzMjA3WjBWMQsw

# CQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQw

# IgYDVQQDExtDZXJ0dW0gVGltZXN0YW1waW5nIDIwMjEgQ0EwggIiMA0GCSqGSIb3

# DQEBAQUAA4ICDwAwggIKAoICAQDpEh8ENe25XXrFppVBvoplf0530W0lddNmjtv4

# YSh/f7eDQKFaIqc7tHj7ox+u8vIsJZlroakUeMS3i3T8aJRC+eQs4FF0GqvkM6+W

# ZO8kmzZfxmZaBYmMLs8FktgFYCzywmXeQ1fEExflee2OpbHVk665eXRHjH7MYZIz

# Nnjl2m8Hy8ulB9mR8wL/W0v0pjKNT6G0sfrx1kk+3OGosFUb7yWNnVkWKU4qSxLv

# 16kJ6oVJ4BSbZ4xMak6JLeB8szrK9vwGDpvGDnKCUMYL3NuviwH1x4gZG0JAXU3x

# 2pOAz91JWKJSAmRy/l0s0l5bEYKolg+DMqVhlOANd8Yh5mkQWaMEvBRE/kAGzIqg

# WhwzN2OsKIVtO8mf5sPWSrvyplSABAYa13rMYnzwfg08nljZHghquCJYCa/xHK9a

# cev9UD7Y+usr15d7mrszzxhF1JOr1Mpup2chNSBlyOObhlSO16rwrffVrg/SzaKf

# SndS5swRhr8bnDqNJY9TNyEYvBYpgF95K7p0g4LguR4A++Z1nFIHWVY5v0fNVZmg

# zxD9uVo/gta3onGOQj3JCxgYx0KrCXu4yc9QiVwTFLWbNdHFSjBCt5/8Q9pLuRhV

# ocdCunhcHudMS1CGQ/Rn0+7P+fzMgWdRKfEOh/hjLrnQ8BdJiYrZNxvIOhM2aa3z

# EDHNwwIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvlQC

# L79AbHNDzqwJJU6eQ0Qa7uAwHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61PgcptE6

# Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMDAGA1UdHwQp

# MCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYIKwYB

# BQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u

# Y29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3Ru

# Y2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0cDov

# L3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQC4k1l3yUwV/ZQH

# CKCneqAs8EGTnwEUJLdDpokN/dMhKjK0rR5qX8nIIHzxpQR3TAw2IRw1Uxsr2Pli

# G3bCFqSdQTUbfaTq6V3vBzEebDru9QFjqlKnxCF2h1jhLNFFplbPJiW+JSnJTh1f

# KEqEdKdxgl9rVTvlxfEJ7exOn25MGbd/wGPwuSmMxRJVO0wnqgS7kmoJjNF9zqee

# hFSDDP8ZVkWg4EZ2tIS0M3uZmByRr+1Lkwjjt8AtW83mVnZTyTsOb+FNfwJY7DS4

# FmWhkRbgcHRetreoTirPOr/ozyDKhT8MTSTf6Lttg6s6T/u08mDWw6HK04ZRDfQ9

# sb77QV8mKgO44WGP31vXnVKoWVJpFBjPvjL8/Zck/5wXX2iqjOaLStFOR/IQki+E

# hn4zlcgVm22ZVCBPF+l8nAwUUShCtKuSU7GmZLKCmmxQMkSiWILTm8EtVD6AxnJh

# oq8EnhjEEyUoflkeRF2WhFiVQOmWTwZRr44IxWGkNJC6tTorW5rl2Zl+2e9JLPYf

# 3pStAPMDoPKIjVXd6NW2+fZrNUBeDo2eOa5Fn7Brs/HLQff5Xgris5MeUbdVgDrF

# 8uxO6cLPvZPo63j62SsNg55pTWk9fUIF9iPoRbb4QurjoY/woI1RAOKtYtTic6aA

# Jq3u83RIPpGXBSJKwx4KJAOZnCDCtTGCBqIwggaeAgEBMGowVjELMAkGA1UEBhMC

# UEwxITAfBgNVBAoTGEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEkMCIGA1UEAxMb

# Q2VydHVtIENvZGUgU2lnbmluZyAyMDIxIENBAhBX5gfP8LabvnxCXoItEBa/MA0G

# CWCGSAFlAwQCAQUAoIGEMBgGCisGAQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZI

# hvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcC

# ARUwLwYJKoZIhvcNAQkEMSIEIA/ST8PsE0vOTHkU/C19p/zoCgAtst9dJUxiREuC

# tjeLMA0GCSqGSIb3DQEBAQUABIIBgJflvWgpUYbFKkgcSaKCPgkHMHXgZCUG5HtY

# G3NNC+HPzd71rGk6976AkCspJK0GmIGYU5JZic0M1Kpl2Xw1ILxCLrCb+MfUQZx3

# R9m8AGLSlollE5SmzBBTWIbhSemexKHzs7BYEf64l7VgsY4uDnmraNlMn9ejMOku

# mJgmUaRXh71p+ec8RW0K3zdoeVWDhK+ILOEvvjbiZvlryxnvZf6E/GZHYUaAKNXQ

# PBFV7e12HtYtY6OiiH95IT27UI5jaByRSteG7aojDqpIrRuiIFqOKZ5dzNqCXZ8I

# ppm8Ec0l3p69QZtm0zOokDAnFEm1WbtpF8+ZHzBK0DAhxOpBuanzrKBOMJMM/u1L

# 8OhRiq1yTqNtonBFnB3vdAsTTVSXPoDObd6Juwqg5pe1NnIIevl2JsWpXTjGRADL

# j7qlgRYu1S0weIDRQXVcNajWfFc1Wsmjy1Mp/OJN4rSIgA4Frhzfvf9klyIVW0Pj

# XsisUz4zQllp3wcww4hR5XNqOPKOGqGCBAIwggP+BgkqhkiG9w0BCQYxggPvMIID

# 6wIBATBqMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0

# ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQQIQ

# KPB3wRw2vf5fdDJHcCcuAzANBglghkgBZQMEAgIFAKCCAVYwGgYJKoZIhvcNAQkD

# MQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjEwMTMwOTM5NDZaMDcG

# CyqGSIb3DQEJEAIvMSgwJjAkMCIEIIW+kOEK0kONfMkotq9IsJqyCBd87PiwEmxY

# 05EFJcQ8MD8GCSqGSIb3DQEJBDEyBDCBmjjg0qGWuDYeux1eM0JxJTE3LBNLLw+q

# BTUGAsgd5H33KZh/+zNq5m8BuJIxxDwwgZ8GCyqGSIb3DQEJEAIMMYGPMIGMMIGJ

# MIGGBBRXFGhBDKha80JO+RZKUTYQ9NONmDBuMFqkWDBWMQswCQYDVQQGEwJQTDEh

# MB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQwIgYDVQQDExtDZXJ0

# dW0gVGltZXN0YW1waW5nIDIwMjEgQ0ECECjwd8EcNr3+X3QyR3AnLgMwDQYJKoZI

# hvcNAQEBBQAEggIAZDfT813GtMRprbbCMfju7YomDaP5LQuwDUAQA8jdg9AhpM1C

# vYorAhjyLQzj8drslishI7izihV2+aueCcXPxbCU3yyeWxgN9EmdfZHHv9QQT0Lp

# CS/RqMYmVBHCbWsFrclcQJhU8j/OzC6fnLt2YGFQ+jeGYirhwz8K74H6SND3/TrD

# 2wwB8pqdmYeu201OD5qdautdrPEn/dsLLxTCUFKQXtSI8DQ/JOEBtdUms7Bisk3q

# ZIon/r/XiPomGN8o2JCRupiRQJZGydknBonWusVkb374LDA4kX2XJ2BfBjdaCvrP

# fCzCSk+Bx6W+wZEtAUO+asx9YP/t37WD2eCm5bfw/5zY1OVZmrG2qrG6QqG+6+DW

# lqCVpB6EMREuC9w9VkrE+q2d2UzAMM3bQpztcjI/8oDUdZ5qV7H26QEuiy7e3oFM

# Fmff8xzkUb9z+GsLzb4E9nE677IKGe7jnV3BLmxZV6lPtsGwG9txMyr6Hr7KOyj9

# /ht+pBDteNz2c+lxuYh4yB2Dq7n0qJGKlrCvlX0X4pi4wN6YBAvbSxppAZRQgaXW

# ajUbnyapFsgtoRHbqk0fB3uMCgnyqBRLcehYjH0IoYNEdvFD0oQAIZmZ+AOzGMu5

# 99YPwyhFRMAUKpVN++3p7GhK2ro0ENVgYXnj5JLBpRkrdfVtaI6O1tcEDvA=

# SIG # End signature block