Public/Get-NSPEntraPairingEnvironment.ps1
|
function Get-NSPEntraPairingEnvironment { <# .SYNOPSIS Discovers the signed-in Graph tenant, a responsive AD DC and its forest. Read-only. .EXAMPLE $environment = Get-NSPEntraPairingEnvironment #> [CmdletBinding()] param([string]$Server) Import-NSPM365Graph $organizations = @((Invoke-NSPGraphRequest -Uri 'organization?$select=id,displayName')['value'] | Where-Object { $null -ne $_ }) if ($organizations.Count -ne 1 -or -not $organizations[0]['id']) { throw 'Expected one signed-in Graph organization.' } $tenant = [guid]$organizations[0]['id'] if ($tenant -eq [guid]::Empty) { throw 'Graph returned an empty tenant ID.' } Import-NSPToolkitModule -Name 'NSP.ActiveDirectory' -MinimumVersion '0.1.9' $domain = Get-NSPADDomainInfo -Server $Server # Temporary adapter to existing AD helpers; no duplicate LDAP transport or RSAT dependency. if (Get-Command Get-NSPADForestInfo -ErrorAction SilentlyContinue) { $facts = Get-NSPADForestInfo -Server $domain.Server if (-not $facts.ForestDNSRoot) { throw 'AD did not return the forest DNS name.' } $forest = [string]$facts.ForestDNSRoot } else { $forest = & (Get-Module NSP.ActiveDirectory) { param($Domain) $rootDse = New-NSPADLdapEntry -Server $Domain.Server -SearchBase 'RootDSE' try { $root = [string]$rootDse.Properties['rootDomainNamingContext'][0] } finally { if ($null -ne $rootDse) { $rootDse.Dispose() } } if (-not $root) { throw 'AD did not return the forest root naming context.' } $ref = @(Read-NSPADLdap -Server $Domain.Server -SearchBase "CN=Partitions,$($Domain.ConfigurationDN)" -Filter "(&(objectClass=crossRef)(nCName=$root))" -Property dnsRoot)[0] if (-not $ref['dnsroot']) { throw 'AD did not return the forest DNS name.' } [string]$ref['dnsroot'] } $domain } [pscustomobject]@{ TenantId = [string]$tenant; TenantName = [string]$organizations[0]['displayName']; Server = $domain.Server; Forest = $forest; Domain = $domain.DNSRoot; CollectedAtUtc = [datetime]::UtcNow.ToString('o') } } |