Private/Get-NSPEntraPairingRoleState.ps1
|
function Get-NSPEntraPairingRoleState { <# .SYNOPSIS Reads assigned and eligible role holders without treating failed eligibility as empty. #> [CmdletBinding()] param([switch]$AssumeNoRoleEligibility) function Get-Holder { param([object[]]$Entry) $ids = @{} foreach ($item in $Entry) { if ($null -eq $item) { continue } $principal = $item['principal'] if ($null -ne $principal -and [string]$principal['@odata.type'] -eq '#microsoft.graph.group') { foreach ($member in @(Invoke-NSPGraphCollection -Uri "groups/$($item['principalId'])/transitiveMembers/microsoft.graph.user?`$select=id&`$top=999")) { if ($null -ne $member) { $ids[[string]$member['id']] = $true } } } else { $ids[[string]$item['principalId']] = $true } } $ids } $query = '$select=principalId&$expand=principal($select=id)' $roleHolders = Get-Holder @(Invoke-NSPGraphCollection -Uri "roleManagement/directory/roleAssignments?$query") $warnings = [System.Collections.Generic.List[string]]::new() $blocks = [System.Collections.Generic.List[string]]::new() $eligible = @{} if ($AssumeNoRoleEligibility) { $warnings.Add('Role eligibility was not read, on the operator''s statement that this tenant has none.') } else { try { $eligible = Get-Holder @(Invoke-NSPGraphCollection -Uri "roleManagement/directory/roleEligibilitySchedules?$query") } catch { # The owner observed BadRequest. Its cause is not established by the status code. # Unknown eligibility must not read as none. $blocks.Add("Role eligibility could not be read: $($_.Exception.Message) BadRequest alone does not establish a licensing cause. Verify access, licensing and that no eligible roles exist before explicitly using -AssumeNoRoleEligibility.") } } [pscustomobject]@{ RoleHolders = $roleHolders; EligibleHolders = $eligible; Blocks = @($blocks); Warnings = @($warnings) } } |