Private/Get-NSPEntraObjectIdentifierState.ps1
|
function Get-NSPEntraObjectIdentifierState { <# .SYNOPSIS Reads a user's onPremisesObjectIdentifier: Set, Clear or Unknown. .DESCRIPTION Entra refuses a hard match when this property is set. Microsoft's recovery steps use it on the beta endpoint, but the user resource does not document it, so a failed read or an absent key is Unknown. That is a warning: Entra's own check still applies at sync. #> [CmdletBinding()] [OutputType([string])] param([Parameter(Mandatory)][string]$CloudObjectId) try { $user = Invoke-NSPGraphRequest -ApiVersion beta -Uri "users/$([uri]::EscapeDataString($CloudObjectId))?`$select=id,onPremisesObjectIdentifier" } catch { return 'Unknown' } if ($null -eq $user -or -not $user.ContainsKey('onPremisesObjectIdentifier')) { return 'Unknown' } if ($user['onPremisesObjectIdentifier']) { 'Set' } else { 'Clear' } } |