EntraOps

1.0.0

Public/PrivilegedAccess/Get-EntraOpsPrivilegedDeviceRoles.ps1

                                <#

.SYNOPSIS

    Get a list of directory role member assignments in Microsoft Intune.

.DESCRIPTION

    Get a list of RBAC member assignments in Microsoft Intune.

.PARAMETER TenantId

    Tenant ID of the Microsoft Microsoft Intune tenant. Default is the current tenant ID.

.PARAMETER PrincipalTypeFilter

    Filter for principal type. Default is User, Group, ServicePrincipal. Possible values are User, Group, ServicePrincipal.

.PARAMETER ExpandGroupMembers

    Expand group members for transitive role assignments. Default is $true.

.PARAMETER SampleMode

    Use sample data for testing or offline mode. Default is $False.

.EXAMPLE

    Get a list of assignment of Microsoft Intune roles.

    Get-EntraOpsPrivilegedDeviceRoles

#>

function Get-EntraOpsPrivilegedDeviceRoles {

    param (

        [Parameter(Mandatory = $False)]

        [System.String]$TenantId = (Get-EntraOpsAzContextValue -Property TenantId)

        ,

        [Parameter(Mandatory = $False)]

        [ValidateSet("User", "Group", "ServicePrincipal")]

        [Array]$PrincipalTypeFilter = ("User", "Group", "ServicePrincipal")

        ,

        [Parameter(Mandatory = $False)]

        [System.Boolean]$ExpandGroupMembers = $true

        ,

        [Parameter(Mandatory = $false)]

        [System.Boolean]$SampleMode = $False

        ,

        [Parameter(Mandatory = $false)]

        [System.Collections.Generic.List[psobject]]$WarningMessages

    )

    # Set Error Action

    $ErrorActionPreference = "Stop"

    #region Get Role Definitions and Role Assignments

    Write-Host "Get Device Management Role Management Assignments and Role Definition..."

    if ($SampleMode -eq $True) {

        Write-Warning "Not supported yet!"

    } else {

        $DeviceMgmtRoleDefinitions = Invoke-EntraOpsMsGraphQuery -Uri "/beta/roleManagement/deviceManagement/roleDefinitions?`$select=id,displayName,description,rolePermissions" -OutputType PSObject

        $DeviceMgmtRoleAssignments = Invoke-EntraOpsMsGraphQuery -Uri "/beta/roleManagement/deviceManagement/roleAssignments" -OutputType PSObject

    }

    #endregion

    #region Get Scope and tags

    Write-Verbose -Message "Getting scope and tags for scope name ..."

    $ScopeTags = (Invoke-EntraOpsMsGraphQuery -Method GET -Uri "/beta/deviceManagement/roleScopeTags" -OutputType PSObject)

    # Scope tags are used to resolve the display names of Intune role assignment scopes.

    #endregion

    #region Get role assignments for all permanent role member

    Write-Host "Get details of Device Management Role Assignments foreach individual principal..."

    if (![string]::IsNullOrWhiteSpace($DeviceMgmtRoleAssignments.id)) {

        $DeviceMgmtRoleAssignmentPrincipals = ($DeviceMgmtRoleAssignments | select-object -ExpandProperty principalIds -Unique)

        $DeviceMgmtPermanentRbacAssignments = foreach ($Principal in $DeviceMgmtRoleAssignmentPrincipals) {

            Write-Verbose "Get identity information from permanent member $Principal"

            # Reset to avoid carrying over the ObjectType from a previous iteration when resolution fails

            $ObjectType = $null

            try {

                $PrincipalProfile = Invoke-EntraOpsMsGraphQuery -Method Get -Uri "https://graph.microsoft.com/beta/directoryObjects/$($Principal)" -OutputType PSObject

                $ObjectType = $PrincipalProfile.'@odata.type'.Replace('#microsoft.graph.', '')

            } catch {

                Write-Warning "Issue to resolve directory object $Principal! $($_.Exception.Message)"

            }

            $AllPrinicpalDeviceMgmtRoleAssignments = Invoke-EntraOpsMsGraphQuery -Uri "/beta/roleManagement/deviceManagement/RoleAssignments?`$count=true&`$filter=principalIds/any(a:a+eq+'$Principal')" -ConsistencyLevel "eventual" -OutputType PSObject

            foreach ($DeviceMgmtPrincipalRoleAssignment in $AllPrinicpalDeviceMgmtRoleAssignments) {

                $Role = ($DeviceMgmtRoleDefinitions | where-object { $_.id -eq $DeviceMgmtPrincipalRoleAssignment.roleDefinitionId })

                if ($null -eq $Role) { Write-Warning "Role definition is empty or does not exist for Role Assignment $($DeviceMgmtPrincipalRoleAssignment.id)" }

                # Collect non-root directoryScopeIds for TaggedBy enrichment

                $nonRootDirectoryScopeIds = @($DeviceMgmtPrincipalRoleAssignment.directoryScopeIds | Where-Object { $_ -ne "/" -and -not [string]::IsNullOrEmpty($_) })

                # Tenant-wide: directoryScopeIds is null/empty (All Devices or All Users only) OR contains "/" (All Devices + All Users)

                $isTenantWide = [string]::IsNullOrEmpty($DeviceMgmtPrincipalRoleAssignment.directoryScopeIds) -or ($DeviceMgmtPrincipalRoleAssignment.directoryScopeIds -contains "/")

                if ($isTenantWide) {

                    # Tenant-wide scope (all users or all devices, root scope "/")

                    [pscustomobject]@{

                        RoleAssignmentId                      = $DeviceMgmtPrincipalRoleAssignment.Id

                        RoleAssignmentScopeId                 = "/"

                        RoleAssignmentScopeName               = "Tenant-wide"

                        DirectoryScopeIds                     = @()

                        RoleAssignmentType                    = "Direct"

                        RoleAssignmentSubType                 = ""

                        PIMManagedRole                        = $False

                        PIMAssignmentType                     = "Permanent"

                        RoleDefinitionName                    = $Role.displayName

                        RoleDefinitionId                      = $Role.id

                        RoleType                              = if ($Role.isBuiltIn -eq $True) { "Built-In" } else { "Custom" }

                        RoleIsPrivileged                      = $Role.isPrivileged

                        ObjectId                              = $Principal    

                        ObjectTenantId                        = $TenantId                                       

                        ObjectType                            = $ObjectType                      

                        TransitiveByObjectId                  = ""

                        TransitiveByObjectDisplayName         = ""

                        TransitiveByNestingObjectIds          = $null

                        TransitiveByNestingObjectDisplayNames = $null

                    }

                } else {

                    foreach ($appScopeId in $DeviceMgmtPrincipalRoleAssignment.appScopeIds) {

                        $ScopeTagName = ($ScopeTags | Where-Object { $_.Id -eq $appScopeId }).displayName

                        if ([string]::IsNullOrEmpty($ScopeTagName)) { $ScopeTagName = "ScopeTag-$appScopeId" }

                        [pscustomobject]@{

                            RoleAssignmentId                      = $DeviceMgmtPrincipalRoleAssignment.Id

                            RoleAssignmentScopeId                 = "$appScopeId"

                            RoleAssignmentScopeName               = $ScopeTagName

                            DirectoryScopeIds                     = $nonRootDirectoryScopeIds

                            RoleAssignmentType                    = "Direct"

                            RoleAssignmentSubType                 = ""

                            PIMManagedRole                        = $False

                            PIMAssignmentType                     = "Permanent"

                            RoleDefinitionName                    = $Role.displayName

                            RoleDefinitionId                      = $Role.id

                            RoleType                              = if ($Role.isBuiltIn -eq $True) { "Built-In" } else { "Custom" }

                            RoleIsPrivileged                      = $Role.isPrivileged

                            ObjectId                              = $Principal

                            ObjectTenantId                        = $TenantId                          

                            ObjectType                            = $ObjectType                      

                            TransitiveByObjectId                  = ""

                            TransitiveByObjectDisplayName         = ""

                            TransitiveByNestingObjectIds          = $null

                            TransitiveByNestingObjectDisplayNames = $null

                        }

                    }

                }

            }

        }

    } else {

        Write-Warning "No Device Management Role Assignments found!"

        $DeviceMgmtPermanentRbacAssignments = $null

    }

    #endregion

    # Summarize results with direct permanent (excl. activated roles) and eligible role assignments

    $AllDeviceMgmtRbacAssignments = @()

    $AllDeviceMgmtRbacAssignments += $DeviceMgmtPermanentRbacAssignments

    #region Collect transitive assignments by group members of Role-Assignable Groups or Security Groups

    if ($ExpandGroupMembers -eq $True) {

        Write-Verbose -Message "Expanding groups for direct or transitive Intune role assignments"

        # DeviceMgmtRbacAssignments

        $GroupsWithRbacAssignment = $AllDeviceMgmtRbacAssignments | where-object { $_.ObjectType -eq "group" } | Select-Object -Unique ObjectId, ObjectDisplayName

        $AllTransitiveMembers = @()

        foreach ($GroupWithRbacAssignment in $GroupsWithRbacAssignment) {

            $TransitiveMembers = Get-EntraOpsPrivilegedTransitiveGroupMember -GroupObjectId $($GroupWithRbacAssignment.ObjectId) -WarningMessages $WarningMessages

            $GroupObjectDisplayName = (Invoke-EntraOpsMsGraphQuery -Method Get -Uri "https://graph.microsoft.com/beta/groups/$($GroupWithRbacAssignment.ObjectId)" -OutputType PSObject).displayName

            foreach ($TransitiveMember in $TransitiveMembers) {

                $Member = [pscustomobject]@{

                    displayName               = $TransitiveMember.displayName

                    id                        = $TransitiveMember.id

                    '@odata.type'             = $TransitiveMember.'@odata.type'

                    RoleAssignmentSubType     = $TransitiveMember.RoleAssignmentSubType

                    GroupObjectDisplayName    = $GroupObjectDisplayName

                    GroupObjectId             = $GroupWithRbacAssignment.ObjectId

                    NestingObjectIds          = $TransitiveMember.NestingObjectIds

                    NestingObjectDisplayNames = $TransitiveMember.NestingObjectDisplayNames

                }

                $AllTransitiveMembers += $Member

            }

        }

        $DeviceMgmtTransitiveRbacAssignments = [System.Collections.Generic.List[object]]::new()

        foreach ($RbacAssignmentByGroup in ($AllDeviceMgmtRbacAssignments | where-object { $_.ObjectType -eq "group" }) ) {

            $RbacAssignmentByNestedGroupMembers = $AllTransitiveMembers | Where-Object { $_.GroupObjectId -eq $RbacAssignmentByGroup.ObjectId }

            if ($RbacAssignmentByNestedGroupMembers.Count -gt 0) {

                $RbacAssignmentByNestedGroupMembers | foreach-object {

                    $TransitiveAssignment = [pscustomobject]@{

                        RoleAssignmentId                      = $RbacAssignmentByGroup.RoleAssignmentId

                        RoleAssignmentScopeId                 = $RbacAssignmentByGroup.RoleAssignmentScopeId

                        RoleAssignmentScopeName               = $RbacAssignmentByGroup.RoleAssignmentScopeName

                        DirectoryScopeIds                     = $RbacAssignmentByGroup.DirectoryScopeIds

                        RoleAssignmentType                    = "Transitive"

                        RoleAssignmentSubType                 = $_.RoleAssignmentSubType

                        PIMManagedRole                        = $RbacAssignmentByGroup.PIMManagedRole

                        PIMAssignmentType                     = $RbacAssignmentByGroup.PIMAssignmentType

                        RoleDefinitionName                    = $RbacAssignmentByGroup.RoleDefinitionName

                        RoleDefinitionId                      = $RbacAssignmentByGroup.RoleDefinitionId

                        RoleType                              = $RbacAssignmentByGroup.RoleType

                        RoleIsPrivileged                      = $RbacAssignmentByGroup.RoleIsPrivileged

                        ObjectId                              = $_.Id

                        ObjectType                            = $_.'@odata.type'.Replace("#microsoft.graph.", "").ToLower()

                        TransitiveByObjectId                  = $RbacAssignmentByGroup.ObjectId

                        TransitiveByObjectDisplayName         = $_.GroupObjectDisplayName

                        TransitiveByNestingObjectIds          = $_.NestingObjectIds

                        TransitiveByNestingObjectDisplayNames = $_.NestingObjectDisplayNames

                    }

                    $DeviceMgmtTransitiveRbacAssignments.Add($TransitiveAssignment) | Out-Null

                }

            } else {

                if ($null -ne $WarningMessages) {

                    $WarningMessages.Add([PSCustomObject]@{

                            Type    = "Empty Group"

                            Message = "Empty group $($RbacAssignmentByGroup.ObjectId)"

                            Target  = $RbacAssignmentByGroup.ObjectId

                        })

                }

            }

        }

    }

    #endregion

    #region Filtering export if needed

    $AllDeviceMgmtRbacAssignments += $DeviceMgmtTransitiveRbacAssignments

    $AllDeviceMgmtRbacAssignments = $AllDeviceMgmtRbacAssignments | where-object { $_.ObjectType -in $PrincipalTypeFilter }

    $AllDeviceMgmtRbacAssignments = $AllDeviceMgmtRbacAssignments | select-object -Unique *

    $AllDeviceMgmtRbacAssignments | Sort-Object RoleAssignmentId, RoleAssignmentScopeName, RoleAssignmentScopeId, RoleAssignmentType, ObjectId

    #endregion

}

# SIG # Begin signature block

# MIIniAYJKoZIhvcNAQcCoIIneTCCJ3UCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDJYPLVnoDqCSE2

# VExQ28b3EaPJn59vbyt+tcOjuac/VqCCIDwwggXJMIIEsaADAgECAhAbtY8lKt8j

# AEkoya49fu0nMA0GCSqGSIb3DQEBDAUAMH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQK

# ExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2Vy

# dGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5l

# dHdvcmsgQ0EwHhcNMjEwNTMxMDY0MzA2WhcNMjkwOTE3MDY0MzA2WjCBgDELMAkG

# A1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMuQS4xJzAl

# BgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIGA1UEAxMb

# Q2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMIICIjANBgkqhkiG9w0BAQEFAAOC

# Ag8AMIICCgKCAgEAvfl4+ObVgAxknYYblmRnPyI6HnUBfe/7XGeMycxca6mR5rlC

# 5SBLm9qbe7mZXdmbgEvXhEArJ9PoujC7Pgkap0mV7ytAJMKXx6fumyXvqAoAl4Va

# qp3cKcniNQfrcE1K1sGzVrihQTib0fsxf4/gX+GxPw+OFklg1waNGPmqJhCrKtPQ

# 0WeNG0a+RzDVLnLRxWPa52N5RH5LYySJhi40PylMUosqp8DikSiJucBb+R3Z5yet

# /5oCl8HGUJKbAiy9qbk0WQq/hEr/3/6zn+vZnuCYI+yma3cWKtvMrTscpIfcRnNe

# GWJoRVfkkIJCu0LW8GHgwaM9ZqNd9BjuiMmNF0UpmTJ1AjHuKSbIawLmtWJFfzcV

# WiNoidQ+3k4nsPBADLxNF8tNorMe0AZa3faTz1d1mfX6hhpneLO/lv403L3nUlbl

# s+V1e9dBkQXcXWnjlQ1DufyDljmVe2yAWk8TcsbXfSl6RLpSpCrVQUYJIP4ioLZb

# MI28iQzV13D4h1L92u+sUS4Hs07+0AnacO+Y+lbmbdu1V0vc5SwlFcieLnhO+Nqc

# noYsylfzGuXIkosagpZ6w7xQEmnYDlpGizrrJvojybawgb5CAKT41v4wLsfSRvbl

# jnX98sy50IdbzAYQYLuDNbdeZ95H7JlI8aShFf6tjGKOOVVPORa5sWOd/7cCAwEA

# AaOCAT4wggE6MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLahVDkCw6A/joq8

# +tT4HKbROg79MB8GA1UdIwQYMBaAFAh2zcsH/yT2xc3tu5C84oQ3RnX3MA4GA1Ud

# DwEB/wQEAwIBBjAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8vY3JsLmNlcnR1bS5w

# bC9jdG5jYS5jcmwwawYIKwYBBQUHAQEEXzBdMCgGCCsGAQUFBzABhhxodHRwOi8v

# c3ViY2Eub2NzcC1jZXJ0dW0uY29tMDEGCCsGAQUFBzAChiVodHRwOi8vcmVwb3Np

# dG9yeS5jZXJ0dW0ucGwvY3RuY2EuY2VyMDkGA1UdIAQyMDAwLgYEVR0gADAmMCQG

# CCsGAQUFBwIBFhhodHRwOi8vd3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZIhvcNAQEM

# BQADggEBAFHCoVgWIhCL/IYx1MIy01z4S6Ivaj5N+KsIHu3V6PrnCA3st8YeDrJ1

# BXqxC/rXdGoABh+kzqrya33YEcARCNQOTWHFOqj6seHjmOriY/1B9ZN9DbxdkjuR

# mmW60F9MvkyNaAMQFtXx0ASKhTP5N+dbLiZpQjy6zbzUeulNndrnQ/tjUoCFBMQl

# lVXwfqefAcVbKPjgzoZwpic7Ofs4LphTZSJ1Ldf23SIikZbr3WjtP6MZl9M7JYjs

# NhI9qX7OAo0FmpKnJ25FspxihjcNpDOO16hO0EoXQ0zF8ads0h5YbBRRfopUofbv

# n3l6XYGaFpAP4bvxSgD5+d2+7arszgowggZrMIIEU6ADAgECAhBX5gfP8LabvnxC

# XoItEBa/MA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhB

# c3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBDb2RlIFNp

# Z25pbmcgMjAyMSBDQTAeFw0yNjEwMDYwODI4MjNaFw0yNzEwMDYwODI4MjJaMIGQ

# MQswCQYDVQQGEwJERTEdMBsGA1UECAwUUmhpbmVsYW5kLVBhbGF0aW5hdGUxEjAQ

# BgNVBAcMCUxhaG5zdGVpbjEeMBwGA1UECgwVT3BlbiBTb3VyY2UgRGV2ZWxvcGVy

# MS4wLAYDVQQDDCVPcGVuIFNvdXJjZSBEZXZlbG9wZXIgVGhvbWFzIE5hdW5oZWlt

# MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAphp2ljSmVsRB6gvkEq7A

# DUMENpKZiDFoAfF1ktD1nCwaVyI+bJ0ROjHwAn4iJgS+vlBDPOUIw2GLHkiqUhOg

# HSwzg6gj45GNmt6zxsKP0zPlhMB/fb0zmz7/F7e3yfKCXLfhbHuk0Es9gJ+8Wmet

# 9StVwwSE/K0MpW06GKA9nPWyE4N/ADwigDIj9rsTKJR4cve9w8G1b3zohpUc/qMr

# onab+HVw5r9b3sOBnnaXC6zvrX4fovRz1ztwfWjRjILLoFG6mW/TuK5F2ICD3Rhl

# 9R2rJWWWhzTDMsQlzvX+/SaM74q3OFpIVNdhvtmWU9pKUBRAyYMijcDqKEFGSzrc

# 8JFmGMpP5TuroWF+N21d3px2eARvW1mV0DCfFAH+Og20SH/gVW6/ltQQEkH/z/Zt

# 49ARyJrgESLOQtlMCIYSoKISdkk4ml4VUS1E/PcbzXEYj3a7m6DOxcd3WuY03UT9

# cnk3p0LMN6LeLYAZgVY+HRloZlH+kW2SkOHNuWgtXvZhAgMBAAGjggF4MIIBdDAM

# BgNVHRMBAf8EAjAAMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jY3NjYTIwMjEu

# Y3JsLmNlcnR1bS5wbC9jY3NjYTIwMjEuY3JsMHMGCCsGAQUFBwEBBGcwZTAsBggr

# BgEFBQcwAYYgaHR0cDovL2Njc2NhMjAyMS5vY3NwLWNlcnR1bS5jb20wNQYIKwYB

# BQUHMAKGKWh0dHA6Ly9yZXBvc2l0b3J5LmNlcnR1bS5wbC9jY3NjYTIwMjEuY2Vy

# MB8GA1UdIwQYMBaAFN10XUwA23ufoHTKsW73PMAywHDNMB0GA1UdDgQWBBTBvGyH

# MXj1dMbVnxuof9oP4PY7cDBLBgNVHSAERDBCMAgGBmeBDAEEATA2BgsqhGgBhvZ3

# AgUBBDAnMCUGCCsGAQUFBwIBFhlodHRwczovL3d3dy5jZXJ0dW0ucGwvQ1BTMBMG

# A1UdJQQMMAoGCCsGAQUFBwMDMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsF

# AAOCAgEAkC165c7/r6y3VeEEpNXas9bQs6ZpKPdJffHkf9xoPi4kWvAIWGc4ocG1

# DJLb18RXiDYShDmT5sb/6I08FeipKi2DNJkuOq6yOTJ3S7+hNFIZCyd6i7WKO8ea

# P5I+FAbyJP4+5coZoMg45bUa9JoocaJCm+5n7WiCfN7/EQpClW5Trm4+ZMbp7EMN

# F1uLJgGCMnN0SsoUarp7PHlqupMxMC4Uhhe+lAP2ytcSIU81L97/qjrADbLWqICk

# 9il5iGM+aZndguq/cmfH9rJj4GRZHWnG6WwnzYD9+KgYlRI6em+/9dq+IRiXe2Bs

# thUuIaFW7U2gWw8tBTEYm1UBLHdJx+L1gjJCLs5KT/wy5wU32wZxNDqPUQejUC1x

# GvU3cKqmLgRq+yNf3gFVfzqIoggyM3U9wQvnk7nBtCkpjXS2hdx4yxzcmrlWsDHr

# z6+6/jeyQySzbYUlFmKnc4n9Mw2soHOajEua5poFARVRS5KgUBuiiQ21YFNYzWBo

# qGuECaaAI/C5rGxapMJ3dAOBnHw6NLqBet+ZXBJEccX5y89MLlOQu+jDmJP8HieR

# qDLlwfhVZnw4RY8Rus43NZBwhNlVuOUXqocHKmJhKNlekda3qsJj93eQBQOxKJcc

# w5O08q9jukpH2+yzFAj+7ll33DuNUgWptogc4Awtbx3glzcEvJQwggaCMIIEaqAD

# AgECAhAo8HfBHDa9/l90MkdwJy4DMA0GCSqGSIb3DQEBDAUAMFYxCzAJBgNVBAYT

# AlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMT

# G0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQTAeFw0yNjAzMTEwNzM0NTRaFw0z

# NjAyMjcwNzM0NTRaMFAxCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhBc3NlY28gRGF0

# YSBTeXN0ZW1zIFMuQS4xHjAcBgNVBAMMFUNlcnR1bSBUaW1lc3RhbXAgMjAyNjCC

# AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALi9zfBw+xI12hi2F9uNQBNO

# STkTIi13fuh3DiWybI5392bBfJw6tO7zDs7UqP/rejVf4xFTU3XNOPsuOFkP5SPF

# snWwn3VJL+NhNhsuujvYsQtaQnvNo1wk46reTgws1L8OFEdKaxgyqT4zOQx81mLw

# NZSqXNU9Rrb9oAJWJF4Mydz+C1ebu0D0+vgM3tqAQ8TU203fqgKCPqIdHloaFqH9

# eyR+8tnpmy2hnnN59ZOtmsuHeRwf5iTOhlhf0d/qqquLOSIGPgGVL1Hj5XBUox2O

# E7tQRr+l/xxNbL6OuwBO4Aa2EbuxYg37cpXv5i2/lTL4NASB/duf9W4fjA3Ro+GP

# +bC54n2OYiM3Cq8z92ejx8F5HWO2e4/75eC95B9tMw/eq7109GDyW2+2ut5Bn0o8

# MXJTERkyystWbqcnUkomA97qfiDCwvpWuOMdfTOksXe9S+xDxOJaCbiyTivgPulx

# cT+tfQTRXBr5UwtPvc+INnafOEilzVHA11tv+pHcylryxBc08cUihf/ttqkZS0bm

# x3VxQay8uohaTp0//ECA9vYGW51SKdJMJhXvKyIdBLy8WYNchTt8yRITv9Adxg9J

# qGujh+TnP1bW3aQjFtlEl7SzgNeI8OVA/CJAWWUuRT3Au9ToOpHy/flrrknhN4he

# Ew7/6ILMv4HSsj0YZ4otAgMBAAGjggFQMIIBTDB1BggrBgEFBQcBAQRpMGcwOwYI

# KwYBBQUHMAKGL2h0dHA6Ly9zdWJjYS5yZXBvc2l0b3J5LmNlcnR1bS5wbC9jdHNj

# YTIwMjEuY2VyMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u

# Y29tMB8GA1UdIwQYMBaAFL5UAi+/QGxzQ86sCSVOnkNEGu7gMAwGA1UdEwEB/wQC

# MAAwOQYDVR0fBDIwMDAuoCygKoYoaHR0cDovL3N1YmNhLmNybC5jZXJ0dW0ucGwv

# Y3RzY2EyMDIxLmNybDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8E

# BAMCB4AwIgYDVR0gBBswGTAIBgZngQwBBAIwDQYLKoRoAYb2dwIFAQswHQYDVR0O

# BBYEFCM5aiirmhKnpKfyH/lFmr+N/oIDMA0GCSqGSIb3DQEBDAUAA4ICAQBm/pOb

# rAveTqYFPCSthxNVwBHTW4TfuBQY2KGCdMlH6ALjVPYf2XARNGMTXScR0JQ2/c2L

# xLpoHHhRwxFf3d933DhFS165rYj6iPSQKm41rc9AMpTCjMdmai1aK9o870pOzTzL

# RhWFVIxm+5Qf+t4V5z14tPoUsAWdfRKD1Zzvzfe5AHlE9rxOZcGROiULxs3Edf7Z

# J8RZI0jzD9juj2oEX2XS7BVKuNCK1W0h1mjapv028yqo8UtZh5/1Ib48Yyp88BDY

# Shh5PSGUUuS5tYXVfcduIPBe3PdNTYRYdT5VNxkwLgjMzIcr/6SH2fejFJDjnCxj

# vXLuarErJg/IdI+hXdGIBDVOGv1zrkF4ktoQvFZIp5DIAYh0GwyUhc87qqn5UaYT

# j2+iyiBDSNh7aGCrkuAnqg7Qh7frhX+QhMGeJ9SpLpnG76qN85hLyjvYR6gRYiLT

# j8G4fxjqV400/buPw0rBo9yJZyq/8cGdCOLPOYf9qpefTcrZKeO9pg+UJHx8UABb

# aTqizRxm8sUSEycccCCFhIit3AI/3wGuSOADeiA676NcQ7+dsP04YvzvdN7pTZNy

# g672WpBDJdg0eItHl4yomvNeIOWh1qs4QqOW6TI8Ocsi4uSDTLorxLUDnBTwKQzz

# pxd1YUctEgRh32R0J9FkFkeEruJU94RljFr1uDCCBrkwggShoAMCAQICEQCZo4AK

# JlU7ZavcboSms+o5MA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAG

# A1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVt

# IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3Rl

# ZCBOZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjE4WhcNMzYwNTE4MDUzMjE4WjBW

# MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEu

# MSQwIgYDVQQDExtDZXJ0dW0gQ29kZSBTaWduaW5nIDIwMjEgQ0EwggIiMA0GCSqG

# SIb3DQEBAQUAA4ICDwAwggIKAoICAQCdI88EMCM7wUYs5zNzPmNdenW6vlxNur3r

# Lfi+5OZ+U3iZIB+AspO+CC/bj+taJUbMbFP1gQBJUzDUCPx7BNLgid1TyztVLn52

# NKgxxu8gpyTr6EjWyGzKU/gnIu+bHAse1LCitX3CaOE13rbuHbtrxF2tPU8f253Q

# gX6eO8yTbGps1Mg+yda3DcTsOYOhSYNCJiL+5wnjZ9weoGRtvFgMHtJg6i671OPX

# IciiHO4Lwo2p9xh/tnj+JmCQEn5QU0NxzrOiRna4kjFaA9ZcwSaG7WAxeC/xoZSx

# F1oK1UPZtKVt+yrsGKqWONoK6f5EmBOAVEK2y4ATDSkb34UD7JA32f+Rm0wsr5aj

# zftDhA5mBipVZDjHpwzv8bTKzCDUSUuUmPo1govD0RwFcTtMXcfJtm1i+P2UNXad

# PyYVKRxKQATHN3imsfBiNRdN5kiVVeqP55piqgxOkyt+HkwIA4gbmSc3hD8ke66t

# 9MjlcNg73rZZlrLHsAIV/nJ0mmgSjBI/TthoGJDydekOQ2tQD2Dup/+sKQptalDl

# ui59SerVSJg8gAeV7N/ia4mrGoiez+SqV3olVfxyLFt3o/OQOnBmjhKUANoKLYlK

# mUpKEFI0PfoT8Q1W/y6s9LTI6ekbi0igEbFUIBE8KDUGfIwnisEkBw5KcBZ3XwnH

# mfznwlKo8QIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU

# 3XRdTADbe5+gdMqxbvc8wDLAcM0wHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61Pgc

# ptE6Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDAGA1Ud

# HwQpMCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYI

# KwYBBQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0

# dW0uY29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwv

# Y3RuY2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0

# cDovL3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQB1iFgP5Y9Q

# KJpTnxDsQ/z0O23JmoZifZdEOEmQvo/79PQg9nLF/GJe6ZiUBEyDBHMtFRK0mXj3

# Qv3gL0sYXe+PPMfwmreJHvgFGWQ7XwnfMh2YIpBrkvJnjwh8gIlNlUl4KENTK5DL

# qsYPEtRQCw7R6p4s2EtWyDDr/M58iY2UBEqfUU/ujR9NuPyKk0bEcEi62JGxauFY

# zZ/yld13fHaZskIoq2XazjaD0pQkcQiIueL0HKiohS6XgZuUtCKA7S6CHttZEsOb

# QJ1j2s0urIDdqF7xaXFVaTHKtAuMfwi0jXtF3JJphrJfc+FFILgCbX/uYBPBlbBI

# P4Ht4xxk2GmfzMn7oxPITpigQFJFWuzTMUUgdRHTxaTSKRJ/6Uh7ki/pFjf9sUAS

# WgxT69QF9Ki4JF5nBIujxZ2sOU9e1HSCJwOfK07t5nnzbs1LbHuAIGJsRJiQ6HX/

# DW1XFOlXY1rc9HufFhWU+7Uk+hFkJsfzqBz3pRO+5aI6u5abI4Qws4YaeJH7H7M8

# X/YNoaArZbV4Ql+jarKsE0+8XvC4DJB+IVcvC9Ydqahi09mjQse4fxfef0L7E3hh

# o2O3bLDM6v60rIRUCi2fJT2/IRU5ohgyTch4GuYWefSBsp5NPJh4QRTP9DC3gc5Q

# EKtbrTY0Ka87Web7/zScvLmvQBm8JDFpDjCCBrkwggShoAMCAQICEQDn/2nHOzXO

# S5Em2HR8aKWHMA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UE

# ChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENl

# cnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBO

# ZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjA3WhcNMzYwNTE4MDUzMjA3WjBWMQsw

# CQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQw

# IgYDVQQDExtDZXJ0dW0gVGltZXN0YW1waW5nIDIwMjEgQ0EwggIiMA0GCSqGSIb3

# DQEBAQUAA4ICDwAwggIKAoICAQDpEh8ENe25XXrFppVBvoplf0530W0lddNmjtv4

# YSh/f7eDQKFaIqc7tHj7ox+u8vIsJZlroakUeMS3i3T8aJRC+eQs4FF0GqvkM6+W

# ZO8kmzZfxmZaBYmMLs8FktgFYCzywmXeQ1fEExflee2OpbHVk665eXRHjH7MYZIz

# Nnjl2m8Hy8ulB9mR8wL/W0v0pjKNT6G0sfrx1kk+3OGosFUb7yWNnVkWKU4qSxLv

# 16kJ6oVJ4BSbZ4xMak6JLeB8szrK9vwGDpvGDnKCUMYL3NuviwH1x4gZG0JAXU3x

# 2pOAz91JWKJSAmRy/l0s0l5bEYKolg+DMqVhlOANd8Yh5mkQWaMEvBRE/kAGzIqg

# WhwzN2OsKIVtO8mf5sPWSrvyplSABAYa13rMYnzwfg08nljZHghquCJYCa/xHK9a

# cev9UD7Y+usr15d7mrszzxhF1JOr1Mpup2chNSBlyOObhlSO16rwrffVrg/SzaKf

# SndS5swRhr8bnDqNJY9TNyEYvBYpgF95K7p0g4LguR4A++Z1nFIHWVY5v0fNVZmg

# zxD9uVo/gta3onGOQj3JCxgYx0KrCXu4yc9QiVwTFLWbNdHFSjBCt5/8Q9pLuRhV

# ocdCunhcHudMS1CGQ/Rn0+7P+fzMgWdRKfEOh/hjLrnQ8BdJiYrZNxvIOhM2aa3z

# EDHNwwIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvlQC

# L79AbHNDzqwJJU6eQ0Qa7uAwHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61PgcptE6

# Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMDAGA1UdHwQp

# MCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYIKwYB

# BQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u

# Y29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3Ru

# Y2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0cDov

# L3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQC4k1l3yUwV/ZQH

# CKCneqAs8EGTnwEUJLdDpokN/dMhKjK0rR5qX8nIIHzxpQR3TAw2IRw1Uxsr2Pli

# G3bCFqSdQTUbfaTq6V3vBzEebDru9QFjqlKnxCF2h1jhLNFFplbPJiW+JSnJTh1f

# KEqEdKdxgl9rVTvlxfEJ7exOn25MGbd/wGPwuSmMxRJVO0wnqgS7kmoJjNF9zqee

# hFSDDP8ZVkWg4EZ2tIS0M3uZmByRr+1Lkwjjt8AtW83mVnZTyTsOb+FNfwJY7DS4

# FmWhkRbgcHRetreoTirPOr/ozyDKhT8MTSTf6Lttg6s6T/u08mDWw6HK04ZRDfQ9

# sb77QV8mKgO44WGP31vXnVKoWVJpFBjPvjL8/Zck/5wXX2iqjOaLStFOR/IQki+E

# hn4zlcgVm22ZVCBPF+l8nAwUUShCtKuSU7GmZLKCmmxQMkSiWILTm8EtVD6AxnJh

# oq8EnhjEEyUoflkeRF2WhFiVQOmWTwZRr44IxWGkNJC6tTorW5rl2Zl+2e9JLPYf

# 3pStAPMDoPKIjVXd6NW2+fZrNUBeDo2eOa5Fn7Brs/HLQff5Xgris5MeUbdVgDrF

# 8uxO6cLPvZPo63j62SsNg55pTWk9fUIF9iPoRbb4QurjoY/woI1RAOKtYtTic6aA

# Jq3u83RIPpGXBSJKwx4KJAOZnCDCtTGCBqIwggaeAgEBMGowVjELMAkGA1UEBhMC

# UEwxITAfBgNVBAoTGEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEkMCIGA1UEAxMb

# Q2VydHVtIENvZGUgU2lnbmluZyAyMDIxIENBAhBX5gfP8LabvnxCXoItEBa/MA0G

# CWCGSAFlAwQCAQUAoIGEMBgGCisGAQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZI

# hvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcC

# ARUwLwYJKoZIhvcNAQkEMSIEIJLpvh8fD/d6q0PkZCJmLbjYzKCOf1Thci8uTM1N

# t0QAMA0GCSqGSIb3DQEBAQUABIIBgJEP13KUoYPH9plLLhxb8IVhn7dWT5pEZfAz

# 8gZJ1clW9o73q3GXYhTizhMCJfzNYA6z1x3e5iG7Y2evufFveAz9+iFqXNZaCAJY

# BCj9YSMZLji6QdnRStcZt2c+2KbW/U8NJUXxyQG0IiEEHZ6MbUzBqs02YZIyhBkj

# zhiuZ+ZE1hYGaz6nlc9jc/IGmqDdM5XFpxru+JW6tevvSTapiyAuZscA8XxZsGPx

# cn/zNIR5nIJ2/zzkKBo2w2ZU8UyvL8H2Gf4ZT8Gxx2V+bkvzdn26Y6YuByrg+OqI

# MThYgWVpm+kejJgZ+xfoVbw6+xqE5AjTZuRqqzlEhrEv9Z5n18lMw5oFpSjg/dVe

# 9W+9bBRM8aPfkdELSUd7aUDPBmQFrS4xDkfSqq2IXPX1CLGYoXAhOwT/JV5b7kIE

# Cgc6zQgv0HgY4PlYOUsh9JcJ3nD/Wwnlu82nsO5tU1gZt5/7WiFYs4AgCV2Gn3H5

# Ka6n0JPXu+ozUJr3PGhD8XAUSzh6kqGCBAIwggP+BgkqhkiG9w0BCQYxggPvMIID

# 6wIBATBqMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0

# ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQQIQ

# KPB3wRw2vf5fdDJHcCcuAzANBglghkgBZQMEAgIFAKCCAVYwGgYJKoZIhvcNAQkD

# MQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjEwMTMwOTQxMTRaMDcG

# CyqGSIb3DQEJEAIvMSgwJjAkMCIEIIW+kOEK0kONfMkotq9IsJqyCBd87PiwEmxY

# 05EFJcQ8MD8GCSqGSIb3DQEJBDEyBDAJcqUpVSsuhCmeqVC78HEPH5HDuUT2Ulbb

# jmWAU1t8S/HmiUFRuZj7doMpZI+XUr8wgZ8GCyqGSIb3DQEJEAIMMYGPMIGMMIGJ

# MIGGBBRXFGhBDKha80JO+RZKUTYQ9NONmDBuMFqkWDBWMQswCQYDVQQGEwJQTDEh

# MB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQwIgYDVQQDExtDZXJ0

# dW0gVGltZXN0YW1waW5nIDIwMjEgQ0ECECjwd8EcNr3+X3QyR3AnLgMwDQYJKoZI

# hvcNAQEBBQAEggIAt/V07Ptk56bgdQSY0oGLPkumi7FLSPcdu/rRMSnJKG8JbbW1

# Dw/iVFGIz0sjyE4SwYxB1vsmCayh3+H5IKpTW1fwb9pPe66AX8ngxtZS0sk9Fn8E

# nCdVOc1TduQ0vyCIcvLh5l2+yfrKMVslUap+H3AbCLUY35qEZSc5rIrIQb2OFL3Q

# N8m2JGE4PK339T/qpDCjZbtchMVnfb5aeM/Rvhob7WjWsGehCpY5nwiFA5zTLrFc

# 2bxR/xinY3jA+UtnDCkKI3EYM/3ZAZ3X9iyr/11q3jtQYZEFOvFKplq37ZwL4PVm

# 8UocUyR8zVJcUd0Z+rPbm7OvN5oxPPK2XNvwft9+7MGV0LbkyOkTFnenRcm76HLY

# jf8WsqkF44Mft5IMc9vWjtfq1L2kEg/AI79QMuC8EtFsFax/1ksitZV0Ar/TPItJ

# +EL47/2/utk5IUxb9LWGTNZ7FfLhYO6vPvND7qK+zGgfR3qlO44l3OoCWiBf2rLx

# MTYZriwhEZc9ZxSqo4d7tIWxorV0X0nT8xtC4oLdnQFWdNihXNhbFNHRle/Ld4u6

# ypyp8g91aOEup6TMvyaKf5c8eYq15Dd7itwAaVMEjLj7wiGKVSObJa33d+d3U64q

# CflW1kX8CjKOF98+a1S/OHWA1eEiHm/IOO6Nxxul/BzH2E5FoRulAgrl5Is=

# SIG # End signature block