Private/Show-NSPEntraPairReview.ps1
|
function Show-NSPEntraPairReview { <# .SYNOPSIS Draws one pair: the cloud user beside its best candidate, then what needs care. #> [CmdletBinding()] param( [Parameter(Mandatory)]$Pair, [int]$Position, [int]$Total ) $width = [Math]::Floor(((Get-NSPConsoleWidth) - 16) / 2) $fit = { param($Value) $text = [string]$Value if ($text.Length -gt $width - 2) { $text.Substring(0, $width - 5) + '...' } else { $text } } $row = { param([string]$Field, $Cloud, $AD) Write-NSPConsoleLine -Message (" {0,-13}{1,-$width}{2}" -f $Field, (& $fit $Cloud), (& $fit $AD)) } $best = @($Pair.candidates)[0] if ($Pair.adObjectGuid) { $selected = @($Pair.candidates | Where-Object adObjectGuid -eq $Pair.adObjectGuid) if ($selected.Count) { $best = $selected[0] } else { $best = [pscustomobject]@{ userPrincipalName = $Pair.adUserPrincipalNameAtReview; displayName = 'Selected by search'; enabled = $Pair.adEnabledAtReview; confidence = 'Operator search'; passwordLastSetUtc = $null; domain = ''; samAccountName = '' } } } Clear-NSPConsole Write-NSPConsoleRule -Title "Cloud user $Position of $Total" Write-NSPConsoleLine -Message (" {0,-13}{1,-$width}{2}" -f '', 'Cloud', 'Selected / best AD candidate') -Role Muted & $row 'Name' $Pair.cloudDisplayNameAtReview $best.displayName & $row 'UPN' $Pair.cloudUpnAtReview $best.userPrincipalName & $row 'State' $Pair.cloudStateAtReview $(if ($best) { if ($best.enabled) { 'Enabled' } else { 'DISABLED' } }) & $row 'Account' '' $(if ($best) { "$($best.domain)\$($best.samAccountName)" }) & $row 'Confidence' '' $best.confidence $formatTime = { param($Value) if (-not $Value) { return 'Unknown / not returned' } if ([string]$Value -like 'pwdLastSet=0*') { return [string]$Value } try { (ConvertTo-NSPEntraPairingUtcTime -Value $Value).ToString('yyyy-MM-dd HH:mm:ssZ') } catch { 'Unknown / invalid timestamp' } } & $row 'Password UTC' (& $formatTime $Pair.cloudLastPasswordChangeUtc) (& $formatTime $best.passwordLastSetUtc) & $row 'Decision' $Pair.decision '' $role = if ($Pair.roleReview) { $Pair.roleReview } else { 'UNKNOWN directory roles - refresh inventory with -ReadRoles; preflight required' } Write-NSPConsoleLine -Message " ROLE CHECK: $role" -Role Warning Write-Host '' switch ($Pair.status) { 'NotFound' { Write-NSPConsoleLine -Message ' No AD user matched. Search, or skip it.' -Role Warning } 'Ambiguous' { Write-NSPConsoleLine -Message ' Several AD users tie. Do not assume the first is right.' -Role Warning } 'OneToMany' { Write-NSPConsoleLine -Message ' This AD user is also the best match for another cloud user. Only one can have it.' -Role Warning } } if ($Pair.decision -eq 'needs-review' -and $Pair.revalidation) { Write-NSPConsoleLine -Message ' The earlier choice no longer holds:' -Role Warning foreach ($reason in @($Pair.revalidation.reasons)) { Write-NSPConsoleLine -Message " $reason" -Role Warning } } if ($best -and $best.confidence -eq 'Low') { Write-NSPConsoleLine -Message ' Low confidence: only names match, and names are not evidence.' -Role Warning } } |