Private/Assert-NSPEntraPairingTenant.ps1

function Assert-NSPEntraPairingTenant {
    <#
    .SYNOPSIS
        Returns the Graph session's tenant ID, or throws if it is not the expected tenant.
    #>

    [CmdletBinding()]
    [OutputType([string])]
    param([Parameter(Mandatory)][guid]$ExpectedTenantId)

    $organizations = @((Invoke-NSPGraphRequest -Uri 'organization?$select=id')['value'] | Where-Object { $null -ne $_ })
    if ($organizations.Count -ne 1) { throw "Graph returned $($organizations.Count) organizations; expected one." }
    $tenantId = [string]$organizations[0]['id']
    if ($tenantId -ne [string]$ExpectedTenantId) {
        throw "The Graph session is in tenant $tenantId, not $ExpectedTenantId. Nothing was read. Run: Connect-NSPEntraPairingGraph -TenantId '$ExpectedTenantId'"
    }
    $tenantId
}