Get-CaConditionalAccessReport

Author(s)

• Dele Olaleye

Tags

ConditionalAccess EntraID MicrosoftGraph Security Inventory ReadOnly PSGallery

Functions

Connect-CaConditionalAccessGraph Export-CaConditionalAccessReport Get-CaConditionalAccessCatalog Get-CaConditionalAccessInventory

PSEditions

Core

Dependencies

This module has no dependencies.

Release Notes

## [0.2.1] - 2026-09-11

### Added

- `Connect-CaConditionalAccessGraph`: wires this module's required Microsoft Graph scopes into
 whichever authentication method fits the host — managed identity, workload identity federation,
 certificate app-only, client secret (last resort), interactive browser sign-in, or device code —
 so a caller no longer has to hand-build the right `Connect-MgGraph` parameter shape or remember
 the scope list themselves. App-only methods authenticate with application permissions granted to
 the app registration/managed identity; the interactive/device-code methods request delegated
 scopes at sign-in, defaulting to this module's minimum required set (`-SkipResolution` narrows it
 to `Policy.Read.All`, matching `Get-CaConditionalAccessInventory -SkipResolution`). The device-code
 sign-in URL and one-time code are explicitly relayed via `Write-Information -InformationAction
 Continue` so they are never silently discarded if the caller's own output is redirected or
 suppressed.
- `Get-CaRequiredGraphScope` (private): single source of truth for the module's minimum required
 Graph scopes, now shared by `Get-CaConditionalAccessInventory` and
 `Connect-CaConditionalAccessGraph` instead of being duplicated.

### Fixed

- `Connect-CaConditionalAccessGraph` captured `Connect-MgGraph`'s device-code sign-in message in a
 variable before relaying it. Assignment suppresses host display until the whole call returns, and
 discards everything emitted so far if the call throws before reaching the relay -- so a device-code
 timeout showed the operator no URL or code at all. Now piped directly to `Write-Information` so
 each message streams to the host the instant it is emitted, regardless of whether the call
 ultimately succeeds or fails.
- `Export-CaConditionalAccessReport` called `Get-Item -LiteralPath` without `-Force` after each
 write. On macOS/Linux, `Get-Item` does not return hidden files without `-Force`, so any write whose
 `-OutputPath` stem produced a dotfile (e.g. an `-OutputPath` ending in a path separator) was
 written successfully but silently dropped from the returned `FileInfo[]`. Added `-Force` to every
 `Get-Item` call, and `-OutputPath` now throws a clear error when it ends in a path separator
 instead of silently producing a malformed dotfile name.
- Standardized `Invoke-LogRotation.tests.ps1`, `LogFileWrappers.tests.ps1`, and `Write-ToLog.tests.ps1`
 onto the shared `TestHelpers.ps1` bootstrap used by every other test file. Their own ad-hoc
 `Import-Module`/`AfterAll { Remove-Module -All -Force }` pattern could tear down the module
 mid-suite, causing later test files to silently fall back to a stale installed copy of the module
 instead of the one under test.
- `tests/TestHelpers.ps1` now defines a no-op stub, created explicitly in Global scope, for any
 mocked Microsoft Graph SDK command name (`Get-MgContext`, `Get-MgIdentityConditionalAccessPolicy`,
 `Get-MgServicePrincipal`, `Get-MgGroup`, `Get-MgDirectoryRoleTemplate`,
 `Get-MgIdentityConditionalAccessNamedLocation`) that isn't already resolvable, rather than
 assuming the Microsoft.Graph.* modules are pre-installed on the CI runner. The hosted macOS
 runner image lacks them (Windows/Ubuntu happened to have them), so every test mocking those
 commands failed there with
 `CommandNotFoundException` before Pester's `Mock` ever got a chance to intercept the call.
- Each Graph SDK stub in `tests/TestHelpers.ps1` now declares `[CmdletBinding()]` on its
 scriptblock. Without it, a stub couldn't populate `$PSBoundParameters` from named/splatted
 arguments (e.g. `-All`, `-ExpandProperty`), so on the macOS runner — the only place the stub
 path actually executes — mock bodies that branch on a bound parameter never saw it set, and
 `-ParameterFilter` blocks asserting on those parameters never matched, even though the mock was
 genuinely invoked. Confirmed locally by temporarily removing the Microsoft.Graph.* modules to
 reproduce the exact macOS-runner condition.