nicolonsky / conditionalaccessdocumentation

Azure AD Conditional Access Documentation with PowerShell

Hi there 👋

• 🥷 I'm a security consultant with a strong background in topics around endpoint management (from configuration manager to Intune via co-management), identity and security
• 🔭 I really love to build new things, automate existing processes and build useful helpers
• 🌱 I'm currently focusing on security topics around the Microsoft security stack and have a big passion for identity threat detection and response
• 👉‍ Learn more and find me online at my blog and on medium as well

conditionalaccessdocumentation's Issues

While exporting getting the error "Get-MgProfile : The term 'Get-MgProfile' is not recognized as the name of a cmdlet"

As there is a separate module for Beta Commands then i guess we do not need to do select-mgprofile.
and while exporting the if the CAP has following setting configured :

Then this is not included in the exported CSV.

Increase the number of objects returned by Powershell GraphApi using the -top switch

Thanks for your code. I ran into some issue with enumerating the Service Principals and had a number of AppID references, can I suggest the following changes to the code,

There is a hidden switch add a -top 999 to the Get-MgServicePrincipal call, as by default the Powershell GraphAPI limits the number of objects returned to 100.

The -top 999 can be added to the Get-MgConditionalAccessPolicy, Get-MgConditionalAccessNamedLocation

"Resolve object IDs of xxxx" isn't expanding the list

Hi,

Trying to work out why when I export to csv the "Resolve object IDs of xxxx" isn't expanding the list. For example "Included Users" only includes one user although there are more. This is the same for all columns

Thanks

Device State Deprecated

Microsoft has deprecated the Device States: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions#device-state-preview

Would you kindly add the new Device Filter condition to the script? It's located here: $conditionalAccessPolicy.Conditions.AdditionalProperties.devices.deviceFilter

Get-MgIdentityConditionalAccessPolicy : Could not load file or assembly 'Microsoft.Graph.Authentication

Get-MgIdentityConditionalAccessPolicy : Could not load file or assembly 'Microsoft.Graph.Authentication, Version=0.9.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the
file specified.
At C:\ConditionalAccessDocumentation-master\Invoke-ConditionalAccessDocumentation.ps1:335 char:1

• $conditionalAccessPolicies = Get-MgIdentityConditionalAccessPolicy -A ...

•   + CategoryInfo          : NotSpecified: (:) [Get-MgIdentityC...cessPolicy_List], FileNotFoundException
    + FullyQualifiedErrorId : Microsoft.Graph.PowerShell.Cmdlets.GetMgIdentityConditionalAccessPolicy_List
  
  

Does not work with new Beta Graph modules

Forked a version that does: https://github.com/svhelden/ConditionalAccessDocumentationBeta/tree/master

Problem Export CA, if filter any device is selectionned with linux

Hello, I try to export 28 CA but the powershell extrat only 15 CA but another is tagged any device ( Linux included)

But If linux or any device selected, the ca is not extrated ?

Have you solution ?

Thank a lot

Add latest CA features

Features:

• Filter for Apps
• Organization scoping
• Authentication strength
• Workload identity protection

Improvements:

• Handle deleted users / groups
• Add warning for policies that might be missing when not on beta endpoint

Execution command not always correct

This instruction has two issues:

& "C:\Users\$env:USERNAME\Documents\WindowsPowerShell\Scripts\Invoke-ConditionalAccessDocumentation.ps1"

• User profile is not always in "C:\Users$env:USERNAME" but always in "$env:USERPROFILE"
• In Powershell 7, folder is "PowerShell" not "WindowsPowerShell"

Issue during Install-Script -Name Invoke-ConditionalAccessDocumentation -Scope CurrentUser

PackageManagement\Install-Package : The following commands are already available on this system:'Get-MgIdentityConditionalAccessNamedLocation,Get-MgIdentityConditionalAcce
ssPolicy,New-MgIdentityConditionalAccessNamedLocation,New-MgIdentityConditionalAccessPolicy,Remove-MgIdentityConditionalAccessNamedLocation,Remove-MgIdentityConditionalAcc
essPolicy,Update-MgIdentityConditionalAccessNamedLocation,Update-MgIdentityConditionalAccessPolicy'. This module 'Microsoft.Graph.Identity.ConditionalAccess' may override
the existing commands. If you still want to install this module 'Microsoft.Graph.Identity.ConditionalAccess', use -AllowClobber parameter.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:3538 char:21

• ... $null = PackageManagement\Install-Package @PSBoundParameters

•                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Exception
  • FullyQualifiedErrorId : CommandAlreadyAvailable,Validate-ModuleCommandAlreadyAvailable,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

Does not contain a method named 'indexof' error

Hi there
Getting the below error

PS C:\WINDOWS\system32> Connect-Graph
Welcome To Microsoft Graph!
PS C:\WINDOWS\system32> & "C:\Users$env:USERNAME\Documents\WindowsPowerShell\Scripts\Invoke-ConditionalAccessDocumentation.ps1"
Method invocation failed because [Microsoft.Graph.PowerShell.Models.MicrosoftGraphConditionalAccessPolicy1] does not
contain a method named 'indexOf'.
At C:\Users\user\Documents\WindowsPowerShell\Scripts\Invoke-ConditionalAccessDocumentation.ps1:349 char:5

• $currentIndex = $conditionalAccessPolicies.indexOf($conditionalAc ...
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : MethodNotFound

Attempted to divide by zero.
At C:\Users\user\Documents\WindowsPowerShell\Scripts\Invoke-ConditionalAccessDocumentation.ps1:350 char:5

• Write-Progress -Activity "Generating Conditional Access Documenta ...
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], RuntimeException
  • FullyQualifiedErrorId : RuntimeException

Authentication prompts repeating

Since the last update I'm getting constant pop-up auth requests, I've tried with a couple of different accounts in different tenants with the exact same thing.

Get-ConditionalAccess null value

When I run the Invoke-ConditionalAccessDocumentation I get the following error from the get-conditionalAccess PS. I do get all the data, but wondering if we can get the error fixed.

You cannot call a method on a null-valued expression.
At C:\Program Files\WindowsPowerShell\Modules\IntuneDocumentation\Internal\Get-ConditionalAccess.ps1:18 char:9

•     $errorResponse = $ex.Response.GetResponseStream()
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

Unable to get the full list of Policies in both BETA and V1.0 Endpoint

On behalf of the customer (Accenture)

Unable to get the full list of CA policies using this script, it used to work before.
It is only showing 75, previously it used to display all 83.

Optional Formatting

Step 4 optional formatting. Is this something that is done manually or do you have an example on code used to format like this?