-
Notifications
You must be signed in to change notification settings - Fork 265
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Role assignment, group fixes, exemption update (#683)
Co-authored-by: Anthony Watherston <[email protected]>
- Loading branch information
Showing
4 changed files
with
126 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
100 changes: 100 additions & 0 deletions
100
Scripts/HydrationKit/Test-HydrationAppResourceGraphAuthorization.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| param ( | ||
| [Parameter(Mandatory = $true)] | ||
| [string]$appId, | ||
| [Parameter(Mandatory = $true)] | ||
| [string]$tenantId | ||
| ) | ||
| $InformationPreference = "Continue" | ||
| # List of Microsoft Graph permissions | ||
| $permissions = @( | ||
| "Directory.Read.All", | ||
| "Group.Read.All", | ||
| "ServicePrincipalEndpoint.Read.All", | ||
| "User.Read.All" | ||
| ) | ||
| try { | ||
| $graphServicePrincipal = Get-AzADServicePrincipal -DisplayName "Microsoft Graph" | ||
| } | ||
| catch { | ||
| $e1 = $_.Exception.Message | ||
| write-error $e1 | ||
| switch -Wildcard ($e1) { | ||
| "*Please login using Connect-AzAccount*" { | ||
| Write-Error "Please connect to Azure using Connect-AzAccount before using this function." | ||
| exit 1 | ||
| } | ||
| default { | ||
| exit 1 | ||
| } | ||
|
|
||
| } | ||
| } | ||
| $graphServiceAppId = $graphServicePrincipal.AppId | ||
|
|
||
| # Gather Graph GUID by expressed values above | ||
| try { | ||
| $graphResponse = Invoke-RestMethod ` | ||
| -Method Get ` | ||
| -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$graphServicePrincipalId" ` | ||
| -ErrorAction Stop ` | ||
| -Headers @{ | ||
| "Authorization" = "Bearer $((Get-AzAccessToken -ResourceUrl "https://graph.microsoft.com").Token)" | ||
| "Content-Type" = "application/json" | ||
| } | ||
| } | ||
| catch { | ||
| $e1 = $_.Exception.Message | ||
| write-error $e1 | ||
| switch -Wildcard ($e1) { | ||
| "*Please login using Connect-AzAccount*" { | ||
| Write-Error "Please connect to Azure using Connect-AzAccount before using this function." | ||
| exit 1 | ||
| } | ||
| "*The remote server returned an error: (404) Not Found.*" { | ||
| Write-Error "Microsoft Graph Service Principal not found. Confirm the Microsoft Graph Service Principal exists in the tenant." | ||
| exit 1 | ||
| } | ||
| default { | ||
| Write-Error "An error occurred while attempting to gather Microsoft Graph Service Principal information, confirm your access to this data." | ||
| exit 1 | ||
| } | ||
| } | ||
| } | ||
|
|
||
| $permissionsObjects = $graphResponse.appRoles | Where-Object { $permissions -contains $_.value } | ||
| # Gather assigned permissions on appId | ||
| try { | ||
| $permissionsAssigned = Get-AzADAppPermission -ApplicationId $appId -ErrorAction stop | Where-Object { $_.ApiId.Guid -eq $graphServiceAppId } | ||
| } | ||
| catch { | ||
| $e1 = $_.Exception.Message | ||
| write-error $e1 | ||
| switch -Wildcard ($e1) { | ||
| "*Unrecognized Guid format*" { | ||
| Write-Error "This is most commonly caused by attempting to use the AppId field to refer to objects other than Entra ID Registered Applications." | ||
| exit 1 | ||
| } | ||
| "*find application by ApplicationId*" { | ||
| Write-Error "This is most commonly caused by attempting to use the ObjectId value in the AppId field to refer toobjects other than Entra ID Registered Applications. Confirm your AppId GUID." | ||
| exit 1 | ||
| } | ||
| default { | ||
| exit 1 | ||
| } | ||
| } | ||
| } | ||
| # Test Permissions | ||
| foreach ($pm in $permissionsObjects) { | ||
| if (!($permissionsAssigned.Id -contains $pm.id)) { | ||
| Write-Warning "Permission $($pm.value) not found for AppId $appId in Graph API" | ||
| $failed = $True | ||
| } | ||
| } | ||
| if ($failed) { | ||
| Write-Error "Test Failed, insufficient Graph API permissions found for successful use of EPAC for AppId $appId" | ||
| exit 1 | ||
| } | ||
| else { | ||
| Write-Information "Tests passed, sufficient Graph API permissions found for successful use of EPAC for AppId $appId" | ||
| exit 0 | ||
| } |