Prerequisites
💡 Summary
The scope of this issue is to add a command line switch parameter such as -SkipLongFunctions that would significantly reduce the execution time of the Entra Id (ProductNames = aad) baseline. For now, this switch would prevent ScubaGear from running the following functions which are typically significantly slower than other functions in ExportAADProvider:
- Get-ApplicationsWithRiskyPermissions
- Get-ServicePrincipalsWithRiskyPermissions
Motivation and context
Some of our users have tenants with massive datasets, in particular thousands of registered apps and service principals, which takes a long time to process, sometimes hours. This new switch would enable those users to execute ScubaGear and collect information on risky apps and service principals only when they need to.
In the future, if we add other long running functions, such as per-user checks that we previously discussed related to mailbox detections, the command line switch could potentially affect the execution of that functionality also. Although for that, we might want to the reverse and create a switch to "enable" per-user checks so that those are NOT the default.
Implementation notes
- Change the code so that the functionality described is optionally suppressed when the switch is provided as a parameter.
Acceptance criteria
Prerequisites
💡 Summary
The scope of this issue is to add a command line switch parameter such as -SkipLongFunctions that would significantly reduce the execution time of the Entra Id (ProductNames = aad) baseline. For now, this switch would prevent ScubaGear from running the following functions which are typically significantly slower than other functions in ExportAADProvider:
Motivation and context
Some of our users have tenants with massive datasets, in particular thousands of registered apps and service principals, which takes a long time to process, sometimes hours. This new switch would enable those users to execute ScubaGear and collect information on risky apps and service principals only when they need to.
In the future, if we add other long running functions, such as per-user checks that we previously discussed related to mailbox detections, the command line switch could potentially affect the execution of that functionality also. Although for that, we might want to the reverse and create a switch to "enable" per-user checks so that those are NOT the default.
Implementation notes
Acceptance criteria