Public/PrivilegedAccess/Get-EntraOpsPrivilegedEAMResourceApps.ps1
|
<#
.SYNOPSIS Get a list in schema of EntraOps with all privileged principals in Resource Apps and assigned app roles and classifications. .DESCRIPTION Get a list in schema of EntraOps with all privileged principals in Resource Apps and assigned app roles and classifications. Supports parallel processing (PowerShell 7+) using Microsoft Graph SDK's process-level authentication context. .PARAMETER TenantId Tenant ID of the Microsoft Entra ID tenant. Default is the current tenant ID. .PARAMETER FolderClassification Folder path to the classification definition files. Default is "./Classification". .PARAMETER SampleMode Use sample data for testing or offline mode. Default is $False. Default sample data is stored in "./Samples" .PARAMETER GlobalExclusion Use global exclusion list for classification. Default is $true. Global exclusion list is stored in "./Classification/Global.json". .PARAMETER EnableParallelProcessing Enable parallel processing for object detail resolution. Default is $true. Requires PowerShell 7+ and MgGraph SDK. .PARAMETER ParallelThrottleLimit Maximum number of parallel threads. Default is 10. .PARAMETER IncludeJustification Include the Justification property (documenting a manual classification overwrite) on all Classification entries of the returned objects. Default is $false, so the property is not present in the output at all. .PARAMETER IncludeObjectDetails Include descriptive object details in warning output. Defaults to ConsoleOutput.IncludeObjectDetails from EntraOpsConfig.json. Object IDs are always shown. #> function Get-EntraOpsPrivilegedEamResourceApps { [cmdletbinding()] param ( [Parameter(Mandatory = $false)] [System.String]$TenantId = (Get-EntraOpsAzContextValue -Property TenantId) , [Parameter(Mandatory = $false)] [System.String]$FolderClassification = "$DefaultFolderClassification" , [Parameter(Mandatory = $false)] [System.Boolean]$SampleMode = $False , [Parameter(Mandatory = $false)] [System.Boolean]$GlobalExclusion = $true , [Parameter(Mandatory = $false)] [System.Boolean]$EnableParallelProcessing = $true , [Parameter(Mandatory = $false)] [System.Int32]$ParallelThrottleLimit = 10 , [Parameter(Mandatory = $false)] [switch]$IncludeJustification , [Parameter(Mandatory = $false)] [System.Boolean]$IncludeObjectDetails = [bool]$Global:EntraOpsIncludeObjectDetails ) # Ensure TenantId is always set before it propagates into parallel runspaces where # $Global:TenantIdContext is not available. (Get-AzContext).Tenant.Id can return null # when only MgGraph auth is active (no Az context), which would cause ObjectTenantId # to be empty in all output entries. if ([string]::IsNullOrEmpty($TenantId) -and -not [string]::IsNullOrEmpty($Global:TenantIdContext)) { $TenantId = $Global:TenantIdContext } # Configuration for batch processing $BatchSize = 100 # Number of objects to process before showing progress $WarningMessages = New-Object -TypeName "System.Collections.Generic.List[psobject]" #region Check if classification file custom and/or template file exists, choose custom template for tenant if available $ResourceAppsClassificationFilePath = Resolve-EntraOpsClassificationPath -ClassificationFileName "Classification_ApiPermissions.json" #endregion Write-Host "Getting App Roles from Entra ID Service Principals..." #region Get all role assignments and global exclusions if ($SampleMode -ne $True) { $AppRoleAssignments = Get-EntraOpsPrivilegedAppRoles -TenantId $TenantId -WarningMessages $WarningMessages } else { $WarningMessages.Add([PSCustomObject]@{Type = "SampleMode"; Message = "SampleMode currently not supported!" }) } $GlobalExclusionList = Import-EntraOpsGlobalExclusions -Enabled $GlobalExclusion #endregion #region Check if App Role Assignment and scope is defined in JSON classification Write-Host "Checking if App role and scope is defined in JSON classification..." # Classification_ApiPermissions.json (Classification/Templates or tenant-specific) uses the same nested # EAMTierLevelName/TierLevelDefinition[] schema as Azure/Defender/DeviceManagement/IdentityGovernance/ # AadResources (entries additionally carry ResourceAppId/ResourceScope). Expand-EntraOpsPrivilegedEAMJsonFile # flattens it into one row per RoleDefinitionActions/RoleAssignmentScopeName pair, matching the shape the # matching logic below expects. Do not confuse this with the separate, FLAT per-permission catalog of the # same filename published at the root of the AzurePrivilegedIAM repository (Classification/Classification_ # ApiPermissions.json, PermissionValue/PermissionType/TargetAppId/Category schema) - that file is an # independent artifact used for KQL/Sentinel lookups and the Classification Explorer's API Permissions # browsing view, not consumed here. $AppRoleByClassificationJSON = Expand-EntraOpsPrivilegedEAMJsonFile -FilePath $ResourceAppsClassificationFilePath # Role action overwrites are already baked into the classification file by Update-EntraOpsClassificationControlPlaneScope. $AppRoleClassificationsByJSON = @() $AppRoleClassificationsByJSON += foreach ($AppRoleAssignment in $AppRoleAssignments | Select-Object -Unique RoleDefinitionId, RoleAssignmentScopeId, RoleDefinitionName, RoleType, ResourceAppId) { # Check if role action and scope exists in JSON classification, filtered by ResourceAppId and ResourceScope $ClassifiedWithMatchedActions = @() foreach ($RoleDefinitionName in $AppRoleAssignment.RoleDefinitionName) { $ClassifiedWithMatchedActions += $AppRoleByClassificationJSON | Where-Object { ($_.RoleDefinitionActions -eq $RoleDefinitionName -or $RoleDefinitionName -like $_.RoleDefinitionActions) -and $_.ExcludedRoleDefinitionActions -ne $RoleDefinitionName -and (-not $_.ResourceAppId -or $_.ResourceAppId -eq $AppRoleAssignment.ResourceAppId) -and ($_.ResourceScope -eq "All" -or ($AppRoleAssignment.RoleType -eq "Application" -and $_.ResourceScope -eq "Application") -or ($AppRoleAssignment.RoleType -eq "Delegated" -and $_.ResourceScope -eq "Delegation")) } | ForEach-Object { [PSCustomObject]@{ EAMTierLevelName = $_.EAMTierLevelName EAMTierLevelTagValue = $_.EAMTierLevelTagValue Service = $_.Service MatchedAction = $RoleDefinitionName } } } $Classification = @() if ($ClassifiedWithMatchedActions.Count -gt 0) { $UniqueClassifications = $ClassifiedWithMatchedActions | Select-Object -Unique EAMTierLevelName, EAMTierLevelTagValue, Service $Classification += $UniqueClassifications | ForEach-Object { $UniqueClass = $_ $MatchedEntries = @($ClassifiedWithMatchedActions | Where-Object { $_.EAMTierLevelName -eq $UniqueClass.EAMTierLevelName -and $_.EAMTierLevelTagValue -eq $UniqueClass.EAMTierLevelTagValue -and $_.Service -eq $UniqueClass.Service }) [array]$MatchedActions = @($MatchedEntries | Select-Object -ExpandProperty MatchedAction | Select-Object -Unique) [PSCustomObject]@{ 'AdminTierLevel' = $UniqueClass.EAMTierLevelTagValue 'AdminTierLevelName' = $UniqueClass.EAMTierLevelName 'Service' = $UniqueClass.Service 'MatchedActions' = if ($MatchedActions.Count -gt 0) { , @($MatchedActions) } else { $null } 'ScopedObjects' = $null 'TaggedBy' = "JSONwithAction" 'TaggedByObjectIds' = $null 'TaggedByObjectDisplayNames' = $null 'TaggedByRoleSystem' = "ResourceApps" } } } else { $Classification += [PSCustomObject]@{ 'AdminTierLevel' = "Unclassified" 'AdminTierLevelName' = "Unclassified" 'Service' = "Unclassified" 'MatchedActions' = $null 'ScopedObjects' = $null 'TaggedBy' = "JSONwithAction" 'TaggedByObjectIds' = $null 'TaggedByObjectDisplayNames' = $null 'TaggedByRoleSystem' = "ResourceApps" } } [PSCustomObject]@{ 'RoleDefinitionId' = $AppRoleAssignment.RoleDefinitionId 'RoleAssignmentScopeId' = $AppRoleAssignment.RoleAssignmentScopeId 'Classification' = $Classification } } $AppRoleClassificationsByJSON = $AppRoleClassificationsByJSON | sort-object -property @{e = { $_.Classification.AdminTierLevel } } #endregion #region Classify App Role Assignments for Service Principals $AppRoleClassifications = foreach ($AppRoleAssignment in $AppRoleAssignments) { $AppRoleAssignment = $AppRoleAssignment | Select-Object -ExcludeProperty Classification $Classification = @() $ClassificationCollection = ($AppRoleClassificationsByJSON | Where-Object { $_.RoleAssignmentScopeId -eq $AppRoleAssignment.RoleAssignmentScopeId -and $_.RoleDefinitionId -eq $AppRoleAssignment.RoleDefinitionId }) if ($ClassificationCollection.Classification.Count -gt 0) { $Classification += $ClassificationCollection.Classification | Sort-Object AdminTierLevel, AdminTierLevelName, Service, TaggedBy | select-object -Unique AdminTierLevel, AdminTierLevelName, MatchedActions, ScopedObjects, Service, TaggedBy, TaggedByObjectIds, TaggedByObjectDisplayNames, TaggedByRoleSystem, Justification } $AppRoleAssignment | Add-Member -NotePropertyName "Classification" -NotePropertyValue $Classification -Force $AppRoleAssignment } #endregion $AppRoleClassifications = $AppRoleClassifications | sort-object -property @{e = { $_.Classification.AdminTierLevel } }, RoleDefinitionName #region Get Agent Identities and store to $AppRoleClassifiedAgentIdObjectsByParentId Write-Host "Getting Agent Identities by parent blueprint principals..." $AllAgentIdBlueprintPrincipals = Invoke-EntraOpsMsGraphQuery -Method GET -Uri "https://graph.microsoft.com/beta/servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal?`$select=id, appId, displayName, createdByAppId, appOwnerOrganizationId" $AppRoleClassifiedAgentIdObjectsByParentId = foreach ( $AgentIdentityBlueprintPrincipal in $AllAgentIdBlueprintPrincipals ) { #region Process each Agent Identity Blueprint Principal Write-Verbose "Processing Agent Identity Blueprint Principal: $($AgentIdentityBlueprintPrincipal.displayName) ($($AgentIdentityBlueprintPrincipal.id))" # Add classified role assignments to Agent Identity Blueprint Principal $AgentIdentityBlueprintPrincipalAppRoles = $AppRoleClassifications | where-object { $_.ObjectId -eq $AgentIdentityBlueprintPrincipal.Id } if ( $AgentIdentityBlueprintPrincipal.appOwnerOrganizationId -ne $TenantId ) { $WarningMessages.Add([PSCustomObject]@{Type = "AgentIdentity-MultiTenant"; Message = "Skipping Agent Identity Blueprint Principal: $($AgentIdentityBlueprintPrincipal.displayName) ($($AgentIdentityBlueprintPrincipal.id)) as it belongs to multi-tenant app without visibility of inheritable permissions: $($AgentIdentityBlueprintPrincipal.appOwnerOrganizationId)"; Target = $AgentIdentityBlueprintPrincipal.id }) $inheritablePermissionScopes = $null continue } else { $AgentIdentityPermissions = Invoke-EntraOpsMsGraphQuery -Method GET -Uri "https://graph.microsoft.com/beta/applications/microsoft.graph.agentIdentityBlueprint/$($AgentIdentityBlueprintPrincipal.appid)/inheritablePermissions" #region Extract inheritable permission scopes $inheritablePermissionScopes = foreach ($AgentIdentityResourceAppPermission in $AgentIdentityPermissions) { if ($AgentIdentityResourceAppPermission.inheritableScopes.kind -eq "allAllowed") { $AllAllowedScopeId = Invoke-EntraOpsMsGraphQuery -Method GET -Uri "https://graph.microsoft.com/beta/servicePrincipals?`$filter=appId eq '$($AgentIdentityResourceAppPermission.resourceAppId)'" | select-object -ExpandProperty id $InheritableResourceAppPermission = $AgentIdentityBlueprintPrincipalAppRoles | where-object { $_.RoleAssignmentScopeId -eq $AllAllowedScopeId -and $_.RoleType -eq "Delegated" } $InheritableResourceAppPermission | Add-Member -NotePropertyName "RoleAssignmentType" -NotePropertyValue "Inheritable" -Force $InheritableResourceAppPermission | Add-Member -NotePropertyName "RoleAssignmentSubType" -NotePropertyValue "AllAllowed" -Force $InheritableResourceAppPermission | Add-Member -NotePropertyName "TransitiveByObjectDisplayName" -NotePropertyValue "$($AgentIdentityBlueprintPrincipal.displayName)" -Force $InheritableResourceAppPermission | Add-Member -NotePropertyName "TransitiveByObjectId" -NotePropertyValue "$($AgentIdentityBlueprintPrincipal.id)" -Force $InheritableResourceAppPermission | Add-Member -NotePropertyName "TransitiveByNestingObjectIds" -NotePropertyValue $null -Force $InheritableResourceAppPermission | Add-Member -NotePropertyName "TransitiveByNestingObjectDisplayNames" -NotePropertyValue $null -Force $InheritableResourceAppPermission } elseif ($AgentIdentityResourceAppPermission.inheritableScopes.kind -eq "enumerated") { $RoleAssignmentScopeId = Invoke-EntraOpsMsGraphQuery -Method GET -Uri "https://graph.microsoft.com/beta/servicePrincipals?`$filter=appId eq '$($AgentIdentityResourceAppPermission.resourceAppId)'" | select-object -ExpandProperty id $RoleDefinitionNames = $AgentIdentityResourceAppPermission.inheritableScopes.scopes $InheritableResourceAppPermission = $AgentIdentityBlueprintPrincipalAppRoles | Where-Object { $_.RoleAssignmentScopeId -eq $RoleAssignmentScopeId -and $_.RoleDefinitionName -in $RoleDefinitionNames } $InheritableResourceAppPermission | Add-Member -NotePropertyName "RoleAssignmentType" -NotePropertyValue "Inheritable" -Force $InheritableResourceAppPermission | Add-Member -NotePropertyName "RoleAssignmentSubType" -NotePropertyValue "Enumerated" -Force $InheritableResourceAppPermission | Add-Member -NotePropertyName "TransitiveByObjectDisplayName" -NotePropertyValue "$($AgentIdentityBlueprintPrincipal.displayName)" -Force $InheritableResourceAppPermission | Add-Member -NotePropertyName "TransitiveByObjectId" -NotePropertyValue "$($AgentIdentityBlueprintPrincipal.id)" -Force $InheritableResourceAppPermission | Add-Member -NotePropertyName "TransitiveByNestingObjectIds" -NotePropertyValue $null -Force $InheritableResourceAppPermission | Add-Member -NotePropertyName "TransitiveByNestingObjectDisplayNames" -NotePropertyValue $null -Force $InheritableResourceAppPermission } elseif ($null -eq $AgentIdentityResourceAppPermission.inheritableScopes.kind) { Write-Verbose "No inheritable scopes defined for Agent Identity $($AgentIdentityBlueprintPrincipal.displayName) Resource App Permission: $($AgentIdentityResourceAppPermission.id)" } else { $WarningMessages.Add([PSCustomObject]@{Type = "AgentIdentity-UnknownScope"; Message = "Unknown inheritableScopes.kind: $($AgentIdentityResourceAppPermission.inheritableScopes.kind)" }) } } #endregion if ( $inheritablePermissionScopes.Count -eq 0 -or $null -eq $inheritablePermissionScopes ) { Write-Host "No inheritable permission scopes found for Agent Identity Blueprint Principal: $($AgentIdentityBlueprintPrincipal.displayName) ($($AgentIdentityBlueprintPrincipal.id))" continue } else { $ChildAgentIdentities = Invoke-EntraOpsMsGraphQuery -Method GET -Uri "https://graph.microsoft.com/beta/servicePrincipals?`$filter=(isof('microsoft.graph.agentIdentity')%20OR%20(tags%2Fany(p%3Astartswith(p%2C%20'power-virtual-agents-'))%20OR%20tags%2Fany(p%3Ap%20eq%20'AgenticInstance')))%20AND%20createdByAppId%20eq%20'$($AgentIdentityBlueprintPrincipal.appId)'" foreach ( $ChildAgentIdentity in $ChildAgentIdentities ) { $ObjectDetails = Get-EntraOpsPrivilegedEntraObject -AadObjectId $ChildAgentIdentity.Id -TenantId $TenantId # Classification $Classification = @() $Classification += $inheritablePermissionScopes.Classification | Sort-Object AdminTierLevel, AdminTierLevelName, Service if ($Classification.Count -eq 0) { $Classification += [PSCustomObject]@{ 'AdminTierLevel' = "Unclassified" 'AdminTierLevelName' = "Unclassified" 'Service' = "Unclassified" } } $Classification = @($Classification | Select-Object -Unique AdminTierLevel, AdminTierLevelName, Service) [PSCustomObject]@{ 'ObjectId' = $ChildAgentIdentity.id 'ObjectTenantId' = $AgentIdentityBlueprintPrincipal.appOwnerOrganizationId 'ObjectType' = $ObjectDetails.ObjectType.toLower() 'ObjectSubType' = $ObjectDetails.ObjectSubType 'ObjectDisplayName' = $ObjectDetails.ObjectDisplayName 'ObjectUserPrincipalName' = $ObjectDetails.ObjectSignInName 'ObjectAdminTierLevel' = $ObjectDetails.AdminTierLevel 'ObjectAdminTierLevelName' = $ObjectDetails.AdminTierLevelName 'OnPremSynchronized' = $ObjectDetails.OnPremSynchronized 'AssignedAdministrativeUnits' = $ObjectDetails.AssignedAdministrativeUnits 'RestrictedManagementByRAG' = $ObjectDetails.RestrictedManagementByRAG 'RestrictedManagementByAadRole' = $ObjectDetails.RestrictedManagementByAadRole 'RestrictedManagementByRMAU' = $ObjectDetails.RestrictedManagementByRMAU 'RoleSystem' = "ResourceApps" 'Classification' = $Classification 'RoleAssignments' = @($inheritablePermissionScopes | Sort-Object { ($_.Classification | Sort-Object AdminTierLevel | Select-Object -First 1).AdminTierLevel }, RoleDefinitionName, RoleAssignmentScopeId, RoleAssignmentId) 'Sponsors' = $ObjectDetails.Sponsors 'Owners' = $ObjectDetails.Owners 'OwnedObjects' = $ObjectDetails.OwnedObjects 'OwnedDevices' = $ObjectDetails.OwnedDevices 'IdentityParent' = $ObjectDetails.IdentityParent 'AssociatedWorkAccount' = $ObjectDetails.AssociatedWorkAccount 'AssociatedPawDevice' = $ObjectDetails.AssociatedPawDevice } } } } # endregion } #endregion #region Add classification and details of Service Principals to output Write-Host "Classifying of all assigned privileged app roles to service principals..." # Optimization: Collect all unique ObjectIds and batch resolve details # Case-insensitive dedup (mirrors Get-EntraOpsPrivilegedEAMAzure.ps1): Select-Object -Unique compares # ObjectId case-sensitively and would emit the same principal twice when ids differ only in casing. $UniqueObjects = @( $AppRoleAssignments | Where-Object { $null -ne $_.ObjectId } | Group-Object -Property { "$($_.ObjectId)".ToLowerInvariant() } | ForEach-Object { $_.Group[0] | Select-Object ObjectId, ObjectType } ) # Use helper function for parallel/sequential object resolution $ObjectDetailsCache = Invoke-EntraOpsParallelObjectResolution ` -UniqueObjects $UniqueObjects ` -TenantId $TenantId ` -EnableParallelProcessing $EnableParallelProcessing ` -ParallelThrottleLimit $ParallelThrottleLimit # Group assignments by ObjectId for fast lookup $AppRoleByObject = $AppRoleClassifications | Group-Object ObjectId -AsHashTable -AsString $AgentIdObjectsByObject = if ($null -ne $AppRoleClassifiedAgentIdObjectsByParentId) { $AppRoleClassifiedAgentIdObjectsByParentId | Group-Object ObjectId -AsHashTable -AsString } else { @{} } # Classification is CPU-only and indexed; a runspace pool costs more than it saves for modest inventories. $HasSufficientObjects = $UniqueObjects.Count -ge 500 $UseParallelForClassification = $EnableParallelProcessing -and $HasSufficientObjects if ($UseParallelForClassification) { # Convert hashtables to synchronized versions for thread-safe access $SyncObjectDetailsCache = [System.Collections.Hashtable]::Synchronized($ObjectDetailsCache) $SyncAppRoleByObject = [System.Collections.Hashtable]::Synchronized($AppRoleByObject) $SyncAgentIdObjects = [System.Collections.Hashtable]::Synchronized($AgentIdObjectsByObject) $ClassificationThrottleLimit = [Math]::Min($ParallelThrottleLimit, 10) Write-Host "Using parallel classification processing with $ClassificationThrottleLimit threads for $($UniqueObjects.Count) objects..." -ForegroundColor Yellow $AppRoleClassifiedSpObjects = $UniqueObjects | ForEach-Object -ThrottleLimit $ClassificationThrottleLimit -Parallel { $obj = $_ $ObjectId = $obj.ObjectId if ($null -ne $ObjectId) { $SharedDetailsCache = $using:SyncObjectDetailsCache $SharedAppRoleByObject = $using:SyncAppRoleByObject $SharedAgentIdObjects = $using:SyncAgentIdObjects $ObjectDetails = $SharedDetailsCache[$ObjectId] if ($null -eq $ObjectDetails) { Write-Verbose "Skipping object $ObjectId - failed to retrieve details" return } # Role Assignments $AppRoleAssignments = @() if ($SharedAgentIdObjects.ContainsKey($ObjectId)) { $AppRoleAssignments += $SharedAppRoleByObject[$ObjectId] | Select-Object -Unique * $AppRoleAssignments += $SharedAgentIdObjects[$ObjectId].RoleAssignments } else { $AppRoleAssignments += $SharedAppRoleByObject[$ObjectId] | Select-Object -Unique * } # Classification - use hashtable for unique aggregation $UniqueClassificationsHash = @{} foreach ($Assignment in $AppRoleAssignments) { if ($null -ne $Assignment.Classification) { foreach ($ClassItem in $Assignment.Classification) { $key = "$($ClassItem.AdminTierLevel)|$($ClassItem.AdminTierLevelName)|$($ClassItem.Service)" if (-not $UniqueClassificationsHash.ContainsKey($key)) { $UniqueClassificationsHash[$key] = $ClassItem } } } } $Classification = @($UniqueClassificationsHash.Values | Select-Object -Unique -ExcludeProperty TaggedBy, TaggedByObjectIds, TaggedByObjectDisplayNames, TaggedByRoleSystem | Sort-Object AdminTierLevel, AdminTierLevelName, Service) if ($Classification.Count -eq 0) { $Classification = @([PSCustomObject]@{ 'AdminTierLevel' = "Unclassified" 'AdminTierLevelName' = "Unclassified" 'Service' = "Unclassified" }) } [PSCustomObject]@{ 'ObjectId' = $ObjectId 'ObjectTenantId' = $ObjectDetails.ObjectTenantId 'ObjectType' = $ObjectDetails.ObjectType.toLower() 'ObjectSubType' = $ObjectDetails.ObjectSubType 'ObjectDisplayName' = $ObjectDetails.ObjectDisplayName 'ObjectUserPrincipalName' = $ObjectDetails.ObjectSignInName 'ObjectAdminTierLevel' = $ObjectDetails.AdminTierLevel 'ObjectAdminTierLevelName' = $ObjectDetails.AdminTierLevelName 'OnPremSynchronized' = $ObjectDetails.OnPremSynchronized 'AssignedAdministrativeUnits' = $ObjectDetails.AssignedAdministrativeUnits 'RestrictedManagementByRAG' = $ObjectDetails.RestrictedManagementByRAG 'RestrictedManagementByAadRole' = $ObjectDetails.RestrictedManagementByAadRole 'RestrictedManagementByRMAU' = $ObjectDetails.RestrictedManagementByRMAU 'RoleSystem' = "ResourceApps" 'Classification' = $Classification 'RoleAssignments' = @($AppRoleAssignments | Sort-Object { ($_.Classification | Sort-Object AdminTierLevel | Select-Object -First 1).AdminTierLevel }, RoleDefinitionName, RoleAssignmentScopeId, RoleAssignmentId) 'Sponsors' = $ObjectDetails.Sponsors 'Owners' = $ObjectDetails.Owners 'OwnedObjects' = $ObjectDetails.OwnedObjects 'OwnedDevices' = $ObjectDetails.OwnedDevices 'AssociatedWorkAccount' = $ObjectDetails.AssociatedWorkAccount 'AssociatedPawDevice' = $ObjectDetails.AssociatedPawDevice } } } if ($AppRoleClassifiedSpObjects.Count -ne $UniqueObjects.Count) { $WarningMessages.Add([PSCustomObject]@{Type = "Stage-Classification-Parallel"; Message = "Parallel classification returned fewer objects than expected. Expected: $($UniqueObjects.Count), Actual: $($AppRoleClassifiedSpObjects.Count)" }) Write-Warning "Parallel classification returned fewer objects than expected. Expected: $($UniqueObjects.Count), Actual: $($AppRoleClassifiedSpObjects.Count)" } } else { if ($EnableParallelProcessing) { Write-Host "Using sequential classification processing (dataset too small: $($UniqueObjects.Count) objects)" -ForegroundColor Yellow } else { Write-Host "Using sequential classification processing (parallel disabled)..." -ForegroundColor Yellow } $AppRoleClassifiedSpObjects = $UniqueObjects | ForEach-Object { if ($null -ne $_.ObjectId) { $ObjectId = $_.ObjectId if ($VerbosePreference -ne 'SilentlyContinue') { Write-Verbose -Message "Processing classifications for $($ObjectId)..." } # Object types $ObjectDetails = $ObjectDetailsCache[$ObjectId] # Skip if object details couldn't be retrieved if ($null -eq $ObjectDetails) { $WarningMessages.Add([PSCustomObject]@{Type = "SkippedObject"; Message = "Skipping object $ObjectId - failed to retrieve details"; Target = $ObjectId }) return } # Role Assignments $AppRoleAssignments = @() if ($AgentIdObjectsByObject.ContainsKey($ObjectId)) { # Merge classifications and role assignments if service principal has inheritable permissions by agent blueprint and assigned app roles $AppRoleAssignments += $AppRoleByObject[$ObjectId] | Select-Object -Unique * $AppRoleAssignments += $AgentIdObjectsByObject[$ObjectId].RoleAssignments } else { $AppRoleAssignments += $AppRoleByObject[$ObjectId] | Select-Object -Unique * } # Classification - use hashtable for unique aggregation $UniqueClassificationsHash = @{} foreach ($Assignment in $AppRoleAssignments) { if ($null -ne $Assignment.Classification) { foreach ($ClassItem in $Assignment.Classification) { $key = "$($ClassItem.AdminTierLevel)|$($ClassItem.AdminTierLevelName)|$($ClassItem.Service)" if (-not $UniqueClassificationsHash.ContainsKey($key)) { $UniqueClassificationsHash[$key] = $ClassItem } } } } $Classification = @($UniqueClassificationsHash.Values | Select-Object -Unique -ExcludeProperty TaggedBy, TaggedByObjectIds, TaggedByObjectDisplayNames, TaggedByRoleSystem | Sort-Object AdminTierLevel, AdminTierLevelName, Service) if ($Classification.Count -eq 0) { $Classification = @( [PSCustomObject]@{ 'AdminTierLevel' = "Unclassified" 'AdminTierLevelName' = "Unclassified" 'Service' = "Unclassified" } ) } [PSCustomObject]@{ 'ObjectId' = $ObjectId 'ObjectTenantId' = $ObjectDetails.ObjectTenantId 'ObjectType' = $ObjectDetails.ObjectType.toLower() 'ObjectSubType' = $ObjectDetails.ObjectSubType 'ObjectDisplayName' = $ObjectDetails.ObjectDisplayName 'ObjectUserPrincipalName' = $ObjectDetails.ObjectSignInName 'ObjectAdminTierLevel' = $ObjectDetails.AdminTierLevel 'ObjectAdminTierLevelName' = $ObjectDetails.AdminTierLevelName 'OnPremSynchronized' = $ObjectDetails.OnPremSynchronized 'AssignedAdministrativeUnits' = $ObjectDetails.AssignedAdministrativeUnits 'RestrictedManagementByRAG' = $ObjectDetails.RestrictedManagementByRAG 'RestrictedManagementByAadRole' = $ObjectDetails.RestrictedManagementByAadRole 'RestrictedManagementByRMAU' = $ObjectDetails.RestrictedManagementByRMAU 'RoleSystem' = "ResourceApps" 'Classification' = $Classification 'RoleAssignments' = @($AppRoleAssignments | Sort-Object { ($_.Classification | Sort-Object AdminTierLevel | Select-Object -First 1).AdminTierLevel }, RoleDefinitionName, RoleAssignmentScopeId, RoleAssignmentId) 'Sponsors' = $ObjectDetails.Sponsors 'Owners' = $ObjectDetails.Owners 'OwnedObjects' = $ObjectDetails.OwnedObjects 'OwnedDevices' = $ObjectDetails.OwnedDevices 'AssociatedWorkAccount' = $ObjectDetails.AssociatedWorkAccount 'AssociatedPawDevice' = $ObjectDetails.AssociatedPawDevice } } } } #endregion #region Add agent identities to classified objects if not already present and correct role assignment ObjectIds $AppRoleClassifiedAgentIdObjects = $AppRoleClassifiedAgentIdObjectsByParentId | where-object { $_.ObjectId -notin $AppRoleClassifiedSpObjects.ObjectId } $AppRoleClassifiedObjects = $AppRoleClassifiedSpObjects + $AppRoleClassifiedAgentIdObjects # Overwrite ObjectId of RoleAssignments for Agent Identities to match Agent Identity ObjectId (and not include Blueprint Principal ObjectId) $AppRoleClassifiedObjects | Where-Object { $_.ObjectSubType -eq "AgentIdentity" } | ForEach-Object { $AgentObjectId = $_.ObjectId $_.RoleAssignments | ForEach-Object { $_.ObjectId = $AgentObjectId } } #endregion Write-Host "Applying global exclusions and finalizing results..." $AppRoleClassifiedObjects = $AppRoleClassifiedObjects | Where-Object { $GlobalExclusionList -notcontains $_.ObjectId } Write-Host "Completed processing $($AppRoleClassifiedObjects.Count) privileged objects." Show-EntraOpsWarningSummary -WarningMessages $WarningMessages -IncludeObjectDetails $IncludeObjectDetails $AppRoleClassifiedObjects | Where-Object { $null -ne $_.ObjectType -and $null -ne $_.ObjectId } | Set-EntraOpsEAMClassificationJustification -IncludeJustification:$IncludeJustification | Sort-Object ObjectAdminTierLevel, ObjectDisplayName, ObjectId } # SIG # Begin signature block # MIIniAYJKoZIhvcNAQcCoIIneTCCJ3UCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCC6jnefayPJ9KfQ # rw/N4hTerV+5N8E8lUvTEAuxAZcJY6CCIDwwggXJMIIEsaADAgECAhAbtY8lKt8j # AEkoya49fu0nMA0GCSqGSIb3DQEBDAUAMH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQK # ExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2Vy # dGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5l # dHdvcmsgQ0EwHhcNMjEwNTMxMDY0MzA2WhcNMjkwOTE3MDY0MzA2WjCBgDELMAkG # A1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMuQS4xJzAl # BgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIGA1UEAxMb # Q2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMIICIjANBgkqhkiG9w0BAQEFAAOC # Ag8AMIICCgKCAgEAvfl4+ObVgAxknYYblmRnPyI6HnUBfe/7XGeMycxca6mR5rlC # 5SBLm9qbe7mZXdmbgEvXhEArJ9PoujC7Pgkap0mV7ytAJMKXx6fumyXvqAoAl4Va # qp3cKcniNQfrcE1K1sGzVrihQTib0fsxf4/gX+GxPw+OFklg1waNGPmqJhCrKtPQ # 0WeNG0a+RzDVLnLRxWPa52N5RH5LYySJhi40PylMUosqp8DikSiJucBb+R3Z5yet # /5oCl8HGUJKbAiy9qbk0WQq/hEr/3/6zn+vZnuCYI+yma3cWKtvMrTscpIfcRnNe # GWJoRVfkkIJCu0LW8GHgwaM9ZqNd9BjuiMmNF0UpmTJ1AjHuKSbIawLmtWJFfzcV # WiNoidQ+3k4nsPBADLxNF8tNorMe0AZa3faTz1d1mfX6hhpneLO/lv403L3nUlbl # s+V1e9dBkQXcXWnjlQ1DufyDljmVe2yAWk8TcsbXfSl6RLpSpCrVQUYJIP4ioLZb # MI28iQzV13D4h1L92u+sUS4Hs07+0AnacO+Y+lbmbdu1V0vc5SwlFcieLnhO+Nqc # noYsylfzGuXIkosagpZ6w7xQEmnYDlpGizrrJvojybawgb5CAKT41v4wLsfSRvbl # jnX98sy50IdbzAYQYLuDNbdeZ95H7JlI8aShFf6tjGKOOVVPORa5sWOd/7cCAwEA # AaOCAT4wggE6MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLahVDkCw6A/joq8 # +tT4HKbROg79MB8GA1UdIwQYMBaAFAh2zcsH/yT2xc3tu5C84oQ3RnX3MA4GA1Ud # DwEB/wQEAwIBBjAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8vY3JsLmNlcnR1bS5w # bC9jdG5jYS5jcmwwawYIKwYBBQUHAQEEXzBdMCgGCCsGAQUFBzABhhxodHRwOi8v # c3ViY2Eub2NzcC1jZXJ0dW0uY29tMDEGCCsGAQUFBzAChiVodHRwOi8vcmVwb3Np # dG9yeS5jZXJ0dW0ucGwvY3RuY2EuY2VyMDkGA1UdIAQyMDAwLgYEVR0gADAmMCQG # CCsGAQUFBwIBFhhodHRwOi8vd3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZIhvcNAQEM # BQADggEBAFHCoVgWIhCL/IYx1MIy01z4S6Ivaj5N+KsIHu3V6PrnCA3st8YeDrJ1 # BXqxC/rXdGoABh+kzqrya33YEcARCNQOTWHFOqj6seHjmOriY/1B9ZN9DbxdkjuR # mmW60F9MvkyNaAMQFtXx0ASKhTP5N+dbLiZpQjy6zbzUeulNndrnQ/tjUoCFBMQl # lVXwfqefAcVbKPjgzoZwpic7Ofs4LphTZSJ1Ldf23SIikZbr3WjtP6MZl9M7JYjs # NhI9qX7OAo0FmpKnJ25FspxihjcNpDOO16hO0EoXQ0zF8ads0h5YbBRRfopUofbv # n3l6XYGaFpAP4bvxSgD5+d2+7arszgowggZrMIIEU6ADAgECAhBX5gfP8LabvnxC # XoItEBa/MA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhB # c3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBDb2RlIFNp # Z25pbmcgMjAyMSBDQTAeFw0yNjEwMDYwODI4MjNaFw0yNzEwMDYwODI4MjJaMIGQ # MQswCQYDVQQGEwJERTEdMBsGA1UECAwUUmhpbmVsYW5kLVBhbGF0aW5hdGUxEjAQ # BgNVBAcMCUxhaG5zdGVpbjEeMBwGA1UECgwVT3BlbiBTb3VyY2UgRGV2ZWxvcGVy # MS4wLAYDVQQDDCVPcGVuIFNvdXJjZSBEZXZlbG9wZXIgVGhvbWFzIE5hdW5oZWlt # MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAphp2ljSmVsRB6gvkEq7A # DUMENpKZiDFoAfF1ktD1nCwaVyI+bJ0ROjHwAn4iJgS+vlBDPOUIw2GLHkiqUhOg # HSwzg6gj45GNmt6zxsKP0zPlhMB/fb0zmz7/F7e3yfKCXLfhbHuk0Es9gJ+8Wmet # 9StVwwSE/K0MpW06GKA9nPWyE4N/ADwigDIj9rsTKJR4cve9w8G1b3zohpUc/qMr # onab+HVw5r9b3sOBnnaXC6zvrX4fovRz1ztwfWjRjILLoFG6mW/TuK5F2ICD3Rhl # 9R2rJWWWhzTDMsQlzvX+/SaM74q3OFpIVNdhvtmWU9pKUBRAyYMijcDqKEFGSzrc # 8JFmGMpP5TuroWF+N21d3px2eARvW1mV0DCfFAH+Og20SH/gVW6/ltQQEkH/z/Zt # 49ARyJrgESLOQtlMCIYSoKISdkk4ml4VUS1E/PcbzXEYj3a7m6DOxcd3WuY03UT9 # cnk3p0LMN6LeLYAZgVY+HRloZlH+kW2SkOHNuWgtXvZhAgMBAAGjggF4MIIBdDAM # BgNVHRMBAf8EAjAAMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jY3NjYTIwMjEu # Y3JsLmNlcnR1bS5wbC9jY3NjYTIwMjEuY3JsMHMGCCsGAQUFBwEBBGcwZTAsBggr # BgEFBQcwAYYgaHR0cDovL2Njc2NhMjAyMS5vY3NwLWNlcnR1bS5jb20wNQYIKwYB # BQUHMAKGKWh0dHA6Ly9yZXBvc2l0b3J5LmNlcnR1bS5wbC9jY3NjYTIwMjEuY2Vy # MB8GA1UdIwQYMBaAFN10XUwA23ufoHTKsW73PMAywHDNMB0GA1UdDgQWBBTBvGyH # MXj1dMbVnxuof9oP4PY7cDBLBgNVHSAERDBCMAgGBmeBDAEEATA2BgsqhGgBhvZ3 # AgUBBDAnMCUGCCsGAQUFBwIBFhlodHRwczovL3d3dy5jZXJ0dW0ucGwvQ1BTMBMG # A1UdJQQMMAoGCCsGAQUFBwMDMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsF # AAOCAgEAkC165c7/r6y3VeEEpNXas9bQs6ZpKPdJffHkf9xoPi4kWvAIWGc4ocG1 # DJLb18RXiDYShDmT5sb/6I08FeipKi2DNJkuOq6yOTJ3S7+hNFIZCyd6i7WKO8ea # P5I+FAbyJP4+5coZoMg45bUa9JoocaJCm+5n7WiCfN7/EQpClW5Trm4+ZMbp7EMN # F1uLJgGCMnN0SsoUarp7PHlqupMxMC4Uhhe+lAP2ytcSIU81L97/qjrADbLWqICk # 9il5iGM+aZndguq/cmfH9rJj4GRZHWnG6WwnzYD9+KgYlRI6em+/9dq+IRiXe2Bs # thUuIaFW7U2gWw8tBTEYm1UBLHdJx+L1gjJCLs5KT/wy5wU32wZxNDqPUQejUC1x # GvU3cKqmLgRq+yNf3gFVfzqIoggyM3U9wQvnk7nBtCkpjXS2hdx4yxzcmrlWsDHr # z6+6/jeyQySzbYUlFmKnc4n9Mw2soHOajEua5poFARVRS5KgUBuiiQ21YFNYzWBo # qGuECaaAI/C5rGxapMJ3dAOBnHw6NLqBet+ZXBJEccX5y89MLlOQu+jDmJP8HieR # qDLlwfhVZnw4RY8Rus43NZBwhNlVuOUXqocHKmJhKNlekda3qsJj93eQBQOxKJcc # w5O08q9jukpH2+yzFAj+7ll33DuNUgWptogc4Awtbx3glzcEvJQwggaCMIIEaqAD # AgECAhAo8HfBHDa9/l90MkdwJy4DMA0GCSqGSIb3DQEBDAUAMFYxCzAJBgNVBAYT # AlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMT # G0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQTAeFw0yNjAzMTEwNzM0NTRaFw0z # NjAyMjcwNzM0NTRaMFAxCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhBc3NlY28gRGF0 # YSBTeXN0ZW1zIFMuQS4xHjAcBgNVBAMMFUNlcnR1bSBUaW1lc3RhbXAgMjAyNjCC # AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALi9zfBw+xI12hi2F9uNQBNO # STkTIi13fuh3DiWybI5392bBfJw6tO7zDs7UqP/rejVf4xFTU3XNOPsuOFkP5SPF # snWwn3VJL+NhNhsuujvYsQtaQnvNo1wk46reTgws1L8OFEdKaxgyqT4zOQx81mLw # NZSqXNU9Rrb9oAJWJF4Mydz+C1ebu0D0+vgM3tqAQ8TU203fqgKCPqIdHloaFqH9 # eyR+8tnpmy2hnnN59ZOtmsuHeRwf5iTOhlhf0d/qqquLOSIGPgGVL1Hj5XBUox2O # E7tQRr+l/xxNbL6OuwBO4Aa2EbuxYg37cpXv5i2/lTL4NASB/duf9W4fjA3Ro+GP # +bC54n2OYiM3Cq8z92ejx8F5HWO2e4/75eC95B9tMw/eq7109GDyW2+2ut5Bn0o8 # MXJTERkyystWbqcnUkomA97qfiDCwvpWuOMdfTOksXe9S+xDxOJaCbiyTivgPulx # cT+tfQTRXBr5UwtPvc+INnafOEilzVHA11tv+pHcylryxBc08cUihf/ttqkZS0bm # x3VxQay8uohaTp0//ECA9vYGW51SKdJMJhXvKyIdBLy8WYNchTt8yRITv9Adxg9J # qGujh+TnP1bW3aQjFtlEl7SzgNeI8OVA/CJAWWUuRT3Au9ToOpHy/flrrknhN4he # Ew7/6ILMv4HSsj0YZ4otAgMBAAGjggFQMIIBTDB1BggrBgEFBQcBAQRpMGcwOwYI # KwYBBQUHMAKGL2h0dHA6Ly9zdWJjYS5yZXBvc2l0b3J5LmNlcnR1bS5wbC9jdHNj # YTIwMjEuY2VyMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u # Y29tMB8GA1UdIwQYMBaAFL5UAi+/QGxzQ86sCSVOnkNEGu7gMAwGA1UdEwEB/wQC # MAAwOQYDVR0fBDIwMDAuoCygKoYoaHR0cDovL3N1YmNhLmNybC5jZXJ0dW0ucGwv # Y3RzY2EyMDIxLmNybDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8E # BAMCB4AwIgYDVR0gBBswGTAIBgZngQwBBAIwDQYLKoRoAYb2dwIFAQswHQYDVR0O # BBYEFCM5aiirmhKnpKfyH/lFmr+N/oIDMA0GCSqGSIb3DQEBDAUAA4ICAQBm/pOb # rAveTqYFPCSthxNVwBHTW4TfuBQY2KGCdMlH6ALjVPYf2XARNGMTXScR0JQ2/c2L # xLpoHHhRwxFf3d933DhFS165rYj6iPSQKm41rc9AMpTCjMdmai1aK9o870pOzTzL # RhWFVIxm+5Qf+t4V5z14tPoUsAWdfRKD1Zzvzfe5AHlE9rxOZcGROiULxs3Edf7Z # J8RZI0jzD9juj2oEX2XS7BVKuNCK1W0h1mjapv028yqo8UtZh5/1Ib48Yyp88BDY # Shh5PSGUUuS5tYXVfcduIPBe3PdNTYRYdT5VNxkwLgjMzIcr/6SH2fejFJDjnCxj # vXLuarErJg/IdI+hXdGIBDVOGv1zrkF4ktoQvFZIp5DIAYh0GwyUhc87qqn5UaYT # j2+iyiBDSNh7aGCrkuAnqg7Qh7frhX+QhMGeJ9SpLpnG76qN85hLyjvYR6gRYiLT # j8G4fxjqV400/buPw0rBo9yJZyq/8cGdCOLPOYf9qpefTcrZKeO9pg+UJHx8UABb # aTqizRxm8sUSEycccCCFhIit3AI/3wGuSOADeiA676NcQ7+dsP04YvzvdN7pTZNy # g672WpBDJdg0eItHl4yomvNeIOWh1qs4QqOW6TI8Ocsi4uSDTLorxLUDnBTwKQzz # pxd1YUctEgRh32R0J9FkFkeEruJU94RljFr1uDCCBrkwggShoAMCAQICEQCZo4AK # JlU7ZavcboSms+o5MA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAG # A1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVt # IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3Rl # ZCBOZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjE4WhcNMzYwNTE4MDUzMjE4WjBW # MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEu # MSQwIgYDVQQDExtDZXJ0dW0gQ29kZSBTaWduaW5nIDIwMjEgQ0EwggIiMA0GCSqG # SIb3DQEBAQUAA4ICDwAwggIKAoICAQCdI88EMCM7wUYs5zNzPmNdenW6vlxNur3r # Lfi+5OZ+U3iZIB+AspO+CC/bj+taJUbMbFP1gQBJUzDUCPx7BNLgid1TyztVLn52 # NKgxxu8gpyTr6EjWyGzKU/gnIu+bHAse1LCitX3CaOE13rbuHbtrxF2tPU8f253Q # gX6eO8yTbGps1Mg+yda3DcTsOYOhSYNCJiL+5wnjZ9weoGRtvFgMHtJg6i671OPX # IciiHO4Lwo2p9xh/tnj+JmCQEn5QU0NxzrOiRna4kjFaA9ZcwSaG7WAxeC/xoZSx # F1oK1UPZtKVt+yrsGKqWONoK6f5EmBOAVEK2y4ATDSkb34UD7JA32f+Rm0wsr5aj # zftDhA5mBipVZDjHpwzv8bTKzCDUSUuUmPo1govD0RwFcTtMXcfJtm1i+P2UNXad # PyYVKRxKQATHN3imsfBiNRdN5kiVVeqP55piqgxOkyt+HkwIA4gbmSc3hD8ke66t # 9MjlcNg73rZZlrLHsAIV/nJ0mmgSjBI/TthoGJDydekOQ2tQD2Dup/+sKQptalDl # ui59SerVSJg8gAeV7N/ia4mrGoiez+SqV3olVfxyLFt3o/OQOnBmjhKUANoKLYlK # mUpKEFI0PfoT8Q1W/y6s9LTI6ekbi0igEbFUIBE8KDUGfIwnisEkBw5KcBZ3XwnH # mfznwlKo8QIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU # 3XRdTADbe5+gdMqxbvc8wDLAcM0wHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61Pgc # ptE6Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDAGA1Ud # HwQpMCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYI # KwYBBQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0 # dW0uY29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwv # Y3RuY2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0 # cDovL3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQB1iFgP5Y9Q # KJpTnxDsQ/z0O23JmoZifZdEOEmQvo/79PQg9nLF/GJe6ZiUBEyDBHMtFRK0mXj3 # Qv3gL0sYXe+PPMfwmreJHvgFGWQ7XwnfMh2YIpBrkvJnjwh8gIlNlUl4KENTK5DL # qsYPEtRQCw7R6p4s2EtWyDDr/M58iY2UBEqfUU/ujR9NuPyKk0bEcEi62JGxauFY # zZ/yld13fHaZskIoq2XazjaD0pQkcQiIueL0HKiohS6XgZuUtCKA7S6CHttZEsOb # QJ1j2s0urIDdqF7xaXFVaTHKtAuMfwi0jXtF3JJphrJfc+FFILgCbX/uYBPBlbBI # P4Ht4xxk2GmfzMn7oxPITpigQFJFWuzTMUUgdRHTxaTSKRJ/6Uh7ki/pFjf9sUAS # WgxT69QF9Ki4JF5nBIujxZ2sOU9e1HSCJwOfK07t5nnzbs1LbHuAIGJsRJiQ6HX/ # DW1XFOlXY1rc9HufFhWU+7Uk+hFkJsfzqBz3pRO+5aI6u5abI4Qws4YaeJH7H7M8 # X/YNoaArZbV4Ql+jarKsE0+8XvC4DJB+IVcvC9Ydqahi09mjQse4fxfef0L7E3hh # o2O3bLDM6v60rIRUCi2fJT2/IRU5ohgyTch4GuYWefSBsp5NPJh4QRTP9DC3gc5Q # EKtbrTY0Ka87Web7/zScvLmvQBm8JDFpDjCCBrkwggShoAMCAQICEQDn/2nHOzXO # S5Em2HR8aKWHMA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UE # ChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENl # cnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBO # ZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjA3WhcNMzYwNTE4MDUzMjA3WjBWMQsw # CQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQw # IgYDVQQDExtDZXJ0dW0gVGltZXN0YW1waW5nIDIwMjEgQ0EwggIiMA0GCSqGSIb3 # DQEBAQUAA4ICDwAwggIKAoICAQDpEh8ENe25XXrFppVBvoplf0530W0lddNmjtv4 # YSh/f7eDQKFaIqc7tHj7ox+u8vIsJZlroakUeMS3i3T8aJRC+eQs4FF0GqvkM6+W # ZO8kmzZfxmZaBYmMLs8FktgFYCzywmXeQ1fEExflee2OpbHVk665eXRHjH7MYZIz # Nnjl2m8Hy8ulB9mR8wL/W0v0pjKNT6G0sfrx1kk+3OGosFUb7yWNnVkWKU4qSxLv # 16kJ6oVJ4BSbZ4xMak6JLeB8szrK9vwGDpvGDnKCUMYL3NuviwH1x4gZG0JAXU3x # 2pOAz91JWKJSAmRy/l0s0l5bEYKolg+DMqVhlOANd8Yh5mkQWaMEvBRE/kAGzIqg # WhwzN2OsKIVtO8mf5sPWSrvyplSABAYa13rMYnzwfg08nljZHghquCJYCa/xHK9a # cev9UD7Y+usr15d7mrszzxhF1JOr1Mpup2chNSBlyOObhlSO16rwrffVrg/SzaKf # SndS5swRhr8bnDqNJY9TNyEYvBYpgF95K7p0g4LguR4A++Z1nFIHWVY5v0fNVZmg # zxD9uVo/gta3onGOQj3JCxgYx0KrCXu4yc9QiVwTFLWbNdHFSjBCt5/8Q9pLuRhV # ocdCunhcHudMS1CGQ/Rn0+7P+fzMgWdRKfEOh/hjLrnQ8BdJiYrZNxvIOhM2aa3z # EDHNwwIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvlQC # L79AbHNDzqwJJU6eQ0Qa7uAwHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61PgcptE6 # Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMDAGA1UdHwQp # MCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYIKwYB # BQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u # Y29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3Ru # Y2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0cDov # L3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQC4k1l3yUwV/ZQH # CKCneqAs8EGTnwEUJLdDpokN/dMhKjK0rR5qX8nIIHzxpQR3TAw2IRw1Uxsr2Pli # G3bCFqSdQTUbfaTq6V3vBzEebDru9QFjqlKnxCF2h1jhLNFFplbPJiW+JSnJTh1f # KEqEdKdxgl9rVTvlxfEJ7exOn25MGbd/wGPwuSmMxRJVO0wnqgS7kmoJjNF9zqee # hFSDDP8ZVkWg4EZ2tIS0M3uZmByRr+1Lkwjjt8AtW83mVnZTyTsOb+FNfwJY7DS4 # FmWhkRbgcHRetreoTirPOr/ozyDKhT8MTSTf6Lttg6s6T/u08mDWw6HK04ZRDfQ9 # sb77QV8mKgO44WGP31vXnVKoWVJpFBjPvjL8/Zck/5wXX2iqjOaLStFOR/IQki+E # hn4zlcgVm22ZVCBPF+l8nAwUUShCtKuSU7GmZLKCmmxQMkSiWILTm8EtVD6AxnJh # oq8EnhjEEyUoflkeRF2WhFiVQOmWTwZRr44IxWGkNJC6tTorW5rl2Zl+2e9JLPYf # 3pStAPMDoPKIjVXd6NW2+fZrNUBeDo2eOa5Fn7Brs/HLQff5Xgris5MeUbdVgDrF # 8uxO6cLPvZPo63j62SsNg55pTWk9fUIF9iPoRbb4QurjoY/woI1RAOKtYtTic6aA # Jq3u83RIPpGXBSJKwx4KJAOZnCDCtTGCBqIwggaeAgEBMGowVjELMAkGA1UEBhMC # UEwxITAfBgNVBAoTGEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEkMCIGA1UEAxMb # Q2VydHVtIENvZGUgU2lnbmluZyAyMDIxIENBAhBX5gfP8LabvnxCXoItEBa/MA0G # CWCGSAFlAwQCAQUAoIGEMBgGCisGAQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZI # hvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcC # ARUwLwYJKoZIhvcNAQkEMSIEIAqpXhYVZr1W3iStQs/DPEVAEx/Lpjy7VxMLXNLf # vwYQMA0GCSqGSIb3DQEBAQUABIIBgIg9SBQKvuKeyqo/kXCl9Ffm7LmGjxxoTWac # ZyLTDriiuQs1Ch1D4XoCNclyVzSnWGZHvz2QTtDWdgLnVCMSqQ+I3Y1IR7IC6ufV # sVcqurMdGWR78hnpkjPw+5frhQKJXpLotzz9XmpCqfFyQRf98OFreQPSbdCToc9B # Q3hYpkstTZAQ/47bU2JYGyzLMZgT4GyAQT1vD5VMzarawabw1aUHUtI+EuUO5vHv # Wrz0Rcn7vio0cQfJPMa2NQcXZTJkAbPJ4swOj0iYXXSfrQsv4bVvetlVGH+vyxzD # eZrj6cwzs19QmALIXue7nX8kyy7Jk0sB0KIJKLbKe5osbpof1ojwvPHAOvLm/ABr # DEa59RFhliykDK+Od2A43dtRH4K3wUxLCbZe7iwPXzsrxzrMMaInowedCn3TFr71 # Ip7zOrHYAll25k4WnsJ1dfzvNRRgtD30PcuRSswi4QJhFX4h6rzZVFOYWPEm2d8f # 4/3L1ZQAEs1vc52jpu/xDZS1EHyD8qGCBAIwggP+BgkqhkiG9w0BCQYxggPvMIID # 6wIBATBqMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0 # ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQQIQ # KPB3wRw2vf5fdDJHcCcuAzANBglghkgBZQMEAgIFAKCCAVYwGgYJKoZIhvcNAQkD # MQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjEwMTMwOTQxMjJaMDcG # CyqGSIb3DQEJEAIvMSgwJjAkMCIEIIW+kOEK0kONfMkotq9IsJqyCBd87PiwEmxY # 05EFJcQ8MD8GCSqGSIb3DQEJBDEyBDDfDIassa2evPqlo/pMCdrUjQA5AhYVQJbL # YmWJp37RUK1T91VPP1piC4Xuj/XreckwgZ8GCyqGSIb3DQEJEAIMMYGPMIGMMIGJ # MIGGBBRXFGhBDKha80JO+RZKUTYQ9NONmDBuMFqkWDBWMQswCQYDVQQGEwJQTDEh # MB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQwIgYDVQQDExtDZXJ0 # dW0gVGltZXN0YW1waW5nIDIwMjEgQ0ECECjwd8EcNr3+X3QyR3AnLgMwDQYJKoZI # hvcNAQEBBQAEggIAnT57mGGw2J1hFCRGfsiPh8DcubQ+GkTscuEb3vAyUV8EKJaQ # FUJUzNG0F9Kt6YSZCY7O60v558Cct6YCZTb9ku4Dg6tgoeM+tSL0o2PqTwudNGKL # dzLR+ZeYMlwPo2V7mPB29Ycl23TQD1m+UFdvPSrZ/TkyHeZIshgim7CfjAv+NDtr # 22tLXKBTxwIt0xvFY0vO6tne1ViZd+W7u1h+D9WHI2yLHfMZHpXHYAMjG35bhQ4V # HO399TgrXFQ868XCZY5kiW2sVOoL1CV1mdzUQHYeTXq5sv9zIS9difwWU0nnj34W # QB80PftcLswHhtydbiAYCpdAoNBBddR7u5OXOIaCl9Un3HzahrFLozUGCf9qunPv # o5KVGuHkDvBlpQvINATHlXtMAFect7QYCD+MtjLQWRj9zMkMxVhDXCz69IYRnEfu # bPcWwq6X05DGimt2fwkZMidvJEo/k1NSymda8Swhho2dpm2Xcz1PYENHjNzMcr6i # kuSwCItaPQfqqSFddomlK2X+vJ5dJx+iD1rVqcZFRDvmuvjQ3EjnogezK85g37NP # y+qG5rAF8jovOS9UPC9t/7NwfjWRczNwhJS7XKvjzhWMJ5Ty6vcEn4/JGt1PTDxs # zBfHPDZMrp/CGAwHq24GKogZHKiuR/5jbCbebhyMJ4wOgLwYL5Ve6gpxi4w= # SIG # End signature block |