Private/Get-NSPEntraPairingGraphScopes.ps1
|
function Get-NSPEntraPairingGraphScopes { <# .SYNOPSIS The delegated scopes this module requests. No call site builds its own list. .DESCRIPTION Each purpose adds to the one before it, so a review never holds a write scope. Moving from one purpose to the next asks for consent once, because the set changes. #> [CmdletBinding()] [OutputType([string[]])] param([ValidateSet('Read', 'Preflight', 'HardMatch')][string]$Purpose = 'Read') $scopes = @( 'User.Read.All' # the cloud user inventory, and soft-deleted users 'Organization.Read.All' # the tenant ID checked against the inventory or queue ) if ($Purpose -in @('Preflight', 'HardMatch')) { $scopes += @( 'RoleManagement.Read.Directory' # role assignments and eligibility 'GroupMember.Read.All' # members of role-assignable groups 'OnPremDirectorySynchronization.Read.All' # the tenant's hard-match block ) } if ($Purpose -eq 'HardMatch') { $scopes += 'User.ReadUpdate.All' } # onPremisesImmutableId $scopes } |