Get-CaConditionalAccessReport.psd1
|
# # Module manifest for module 'Get-CaConditionalAccessReport' # # Generated by: Dele Olaleye # @{ # Script module or binary module file associated with this manifest. RootModule = 'Get-CaConditionalAccessReport.psm1' # Version number of this module. ModuleVersion = '0.2.1' # Supported PSEditions CompatiblePSEditions = @('Core') # ID used to uniquely identify this module GUID = '3900dd55-d740-44a6-adf3-b5dc71f5de4a' # Author of this module Author = 'Dele Olaleye' # Company or vendor of this module CompanyName = 'Fountview' # Copyright statement for this module Copyright = '(c) Dele Olaleye. All rights reserved.' # Description of the functionality provided by this module Description = 'Read-only Conditional Access policy inventory and unique-values catalogue module, built on the Microsoft Graph PowerShell SDK. Retrieves every Conditional Access policy in a tenant, normalises each into a flat per-policy record, and aggregates a deduplicated catalogue of the distinct values in use (workloads, grant controls, platforms, locations, client app types, referenced groups/roles, and naming-pattern tokens) so a separate, downstream exercise can baseline naming conventions and map new policies onto the existing estate. Makes no write, update, or delete Graph call.' # Minimum version of the PowerShell engine required by this module PowerShellVersion = '7.0' # Name of the PowerShell host required by this module # PowerShellHostName = '' # Minimum version of the PowerShell host required by this module # PowerShellHostVersion = '' # Minimum version of Microsoft .NET Framework required by this module. This prerequisite is valid for the PowerShell Desktop edition only. # DotNetFrameworkVersion = '' # Minimum version of the common language runtime (CLR) required by this module. This prerequisite is valid for the PowerShell Desktop edition only. # ClrVersion = '' # Processor architecture (None, X86, Amd64) required by this module # ProcessorArchitecture = '' # Modules that must be imported into the global environment prior to importing this module RequiredModules = @() # Assemblies that must be loaded prior to importing this module # RequiredAssemblies = @() # Script files (.ps1) that are run in the caller's environment prior to importing this module. # ScriptsToProcess = @() # Type files (.ps1xml) to be loaded when importing this module # TypesToProcess = @() # Format files (.ps1xml) to be loaded when importing this module # FormatsToProcess = @() # Modules to import as nested modules of the module specified in RootModule/ModuleToProcess # NestedModules = @() # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export. FunctionsToExport = @('Connect-CaConditionalAccessGraph','Export-CaConditionalAccessReport','Get-CaConditionalAccessCatalog','Get-CaConditionalAccessInventory') # Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export. CmdletsToExport = @() # Variables to export from this module VariablesToExport = @() # Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export. AliasesToExport = @() # DSC resources to export from this module DscResourcesToExport = @() # List of all modules packaged with this module # ModuleList = @() # List of all files packaged with this module # FileList = @() # Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell. PrivateData = @{ PSData = @{ # Tags applied to this module. These help with module discovery in online galleries. Tags = @('ConditionalAccess', 'EntraID', 'MicrosoftGraph', 'Security', 'Inventory', 'ReadOnly', 'PSGallery') # A URL to the license for this module. # LicenseUri = '' # A URL to the main website for this project. # ProjectUri = '' # A URL to an icon representing this module. # IconUri = '' # ReleaseNotes of this module ReleaseNotes = '## [0.2.1] - 2026-09-11 ### Added - `Connect-CaConditionalAccessGraph`: wires this module''s required Microsoft Graph scopes into whichever authentication method fits the host — managed identity, workload identity federation, certificate app-only, client secret (last resort), interactive browser sign-in, or device code — so a caller no longer has to hand-build the right `Connect-MgGraph` parameter shape or remember the scope list themselves. App-only methods authenticate with application permissions granted to the app registration/managed identity; the interactive/device-code methods request delegated scopes at sign-in, defaulting to this module''s minimum required set (`-SkipResolution` narrows it to `Policy.Read.All`, matching `Get-CaConditionalAccessInventory -SkipResolution`). The device-code sign-in URL and one-time code are explicitly relayed via `Write-Information -InformationAction Continue` so they are never silently discarded if the caller''s own output is redirected or suppressed. - `Get-CaRequiredGraphScope` (private): single source of truth for the module''s minimum required Graph scopes, now shared by `Get-CaConditionalAccessInventory` and `Connect-CaConditionalAccessGraph` instead of being duplicated. ### Fixed - `Connect-CaConditionalAccessGraph` captured `Connect-MgGraph`''s device-code sign-in message in a variable before relaying it. Assignment suppresses host display until the whole call returns, and discards everything emitted so far if the call throws before reaching the relay -- so a device-code timeout showed the operator no URL or code at all. Now piped directly to `Write-Information` so each message streams to the host the instant it is emitted, regardless of whether the call ultimately succeeds or fails. - `Export-CaConditionalAccessReport` called `Get-Item -LiteralPath` without `-Force` after each write. On macOS/Linux, `Get-Item` does not return hidden files without `-Force`, so any write whose `-OutputPath` stem produced a dotfile (e.g. an `-OutputPath` ending in a path separator) was written successfully but silently dropped from the returned `FileInfo[]`. Added `-Force` to every `Get-Item` call, and `-OutputPath` now throws a clear error when it ends in a path separator instead of silently producing a malformed dotfile name. - Standardized `Invoke-LogRotation.tests.ps1`, `LogFileWrappers.tests.ps1`, and `Write-ToLog.tests.ps1` onto the shared `TestHelpers.ps1` bootstrap used by every other test file. Their own ad-hoc `Import-Module`/`AfterAll { Remove-Module -All -Force }` pattern could tear down the module mid-suite, causing later test files to silently fall back to a stale installed copy of the module instead of the one under test. - `tests/TestHelpers.ps1` now defines a no-op stub, created explicitly in Global scope, for any mocked Microsoft Graph SDK command name (`Get-MgContext`, `Get-MgIdentityConditionalAccessPolicy`, `Get-MgServicePrincipal`, `Get-MgGroup`, `Get-MgDirectoryRoleTemplate`, `Get-MgIdentityConditionalAccessNamedLocation`) that isn''t already resolvable, rather than assuming the Microsoft.Graph.* modules are pre-installed on the CI runner. The hosted macOS runner image lacks them (Windows/Ubuntu happened to have them), so every test mocking those commands failed there with `CommandNotFoundException` before Pester''s `Mock` ever got a chance to intercept the call. - Each Graph SDK stub in `tests/TestHelpers.ps1` now declares `[CmdletBinding()]` on its scriptblock. Without it, a stub couldn''t populate `$PSBoundParameters` from named/splatted arguments (e.g. `-All`, `-ExpandProperty`), so on the macOS runner — the only place the stub path actually executes — mock bodies that branch on a bound parameter never saw it set, and `-ParameterFilter` blocks asserting on those parameters never matched, even though the mock was genuinely invoked. Confirmed locally by temporarily removing the Microsoft.Graph.* modules to reproduce the exact macOS-runner condition. ' # Prerelease string of this module Prerelease = '' # Flag to indicate whether the module requires explicit user acceptance for install/update/save # RequireLicenseAcceptance = $false # External dependent modules of this module # ExternalModuleDependencies = @() } # End of PSData hashtable } # End of PrivateData hashtable # HelpInfo URI of this module # HelpInfoURI = '' # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix. # DefaultCommandPrefix = '' } |