Public/Get-NSPEntraPairingUpnSuffixComparison.ps1
|
function Get-NSPEntraPairingUpnSuffixComparison { <# .SYNOPSIS Compares verified Graph organization domains with available forest UPN suffixes. Read-only. .DESCRIPTION AvailableSuffix must include AD domain DNS roots as well as configured alternative UPN suffixes. This is a comparison only; the AD specialist's planner/writer owns additions. A missing verifiedDomains property is unknown and throws, rather than an empty result. .EXAMPLE Get-NSPEntraPairingUpnSuffixComparison -ExpectedTenantId $queue.tenantId -Forest $queue.forest -AvailableSuffix $available #> [CmdletBinding()] param([Parameter(Mandatory)][guid]$ExpectedTenantId, [Parameter(Mandatory)][ValidateNotNullOrEmpty()][string]$Forest, [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$AvailableSuffix) Import-NSPM365Graph $organizations = @((Invoke-NSPGraphRequest -Uri 'organization?$select=id,verifiedDomains')['value'] | Where-Object { $null -ne $_ }) if ($organizations.Count -ne 1 -or [string]$organizations[0]['id'] -ne [string]$ExpectedTenantId) { throw 'Graph organization differs from the expected tenant; no suffix plan was created.' } $organization = $organizations[0] if (-not $organization.Contains('verifiedDomains') -or $null -eq $organization['verifiedDomains']) { throw 'Verified cloud domains were not returned; suffix comparison is unknown.' } $seen = @{} foreach ($domain in @($organization['verifiedDomains'] | Sort-Object { $_['name'] })) { $name = [string]$domain['name'] if (-not $name -or [uri]::CheckHostName($name) -ne [UriHostNameType]::Dns -or -not $name.Contains('.')) { throw 'Graph returned an invalid verified domain name.' } $name = $name.ToLowerInvariant() if ($seen.ContainsKey($name)) { continue } $seen[$name] = $true [pscustomobject]@{ TenantId = [string]$ExpectedTenantId Forest = $Forest Suffix = $name Status = if ($name -in $AvailableSuffix) { 'Available' } else { 'Missing' } IsDefault = [bool]$domain['isDefault'] IsInitial = [bool]$domain['isInitial'] } } } |