Skip to content

Commit 3034e9f

Browse files
author
Rajaram Kakodiya (from Dev Box)
committed
Add custom cmdlets for XTAP
1 parent 36f2312 commit 3034e9f

16 files changed

Lines changed: 2669 additions & 0 deletions

‎src/Identity.SignIns/beta/custom/ConvertTo-EntraXTAPFlatOutput.ps1‎

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
# ----------------------------------------------------------------------------------
2+
#
3+
# Copyright Microsoft Corporation
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
# ----------------------------------------------------------------------------------
14+
15+
<#
16+
.Synopsis
17+
Internal helper: projects a CrossTenantAccessPolicy API response into the flat
18+
parameter-aligned output shape shared by the *-DefaultEntraXTAP and
19+
*-PartnerEntraXTAP cmdlets.
20+
21+
.Description
22+
Decodes the nested TargetConfiguration model back into the flat property names
23+
that match the new cmdlet input parameters:
24+
25+
Default mode (IsPartner = $false): emits Id + flat properties.
26+
Partner mode (IsPartner = $true): emits PartnerTenantId + flat properties.
27+
28+
Output property mapping:
29+
M365CollaborationInbound.Users.accessType → M365CollaborationInbound ("Allowed"|"Blocked")
30+
M365CollaborationInbound.Users.targets[user] → M365CollaborationInboundTargetUsers
31+
M365CollaborationOutbound.UsersAndGroups.accessType → M365CollaborationOutbound ("Allowed"|"Blocked")
32+
M365CollaborationOutbound.UsersAndGroups.targets[user] → M365CollaborationOutboundTargetUsers
33+
M365CollaborationOutbound.UsersAndGroups.targets[group] → M365CollaborationOutboundTargetGroups
34+
AppServiceConnectInbound.Applications.accessType → AppServiceConnectInbound ("Allowed"|"Blocked")
35+
AppServiceConnectInbound.Applications.targets[application] → AppServiceConnectInboundTargetApplications
36+
#>
37+
function ConvertTo-EntraXTAPFlatOutput {
38+
param(
39+
[Parameter(Mandatory = $true)]
40+
$Result,
41+
42+
[Parameter()]
43+
[switch]
44+
$IsPartner
45+
)
46+
47+
# Helper: capitalise first letter of accessType for enum output ("allowed" → "Allowed")
48+
function Format-AccessType {
49+
param([string]$Value)
50+
if ([string]::IsNullOrEmpty($Value)) { return $null }
51+
return [System.Globalization.CultureInfo]::InvariantCulture.TextInfo.ToTitleCase($Value.ToLower())
52+
}
53+
54+
# Helper: extract target IDs from a TargetConfiguration for a given targetType.
55+
function Get-TargetIds {
56+
param($Config, [string]$TargetType)
57+
if ($null -eq $Config -or $null -eq $Config.Targets) { return $null }
58+
$ids = @($Config.Targets | Where-Object { $_.TargetType -eq $TargetType } | ForEach-Object { $_.Target })
59+
if ($ids.Count -eq 0) { return $null }
60+
return $ids
61+
}
62+
63+
# ------------------------------------------------------------------
64+
# M365CollaborationInbound → .Users (user targets only)
65+
# ------------------------------------------------------------------
66+
$inboundConfig = if ($null -ne $Result.M365CollaborationInbound) { $Result.M365CollaborationInbound.Users } else { $null }
67+
$inboundAccessType = if ($null -ne $inboundConfig) { Format-AccessType $inboundConfig.AccessType } else { $null }
68+
$inboundUsers = if ($null -ne $inboundConfig) { Get-TargetIds -Config $inboundConfig -TargetType 'user' } else { $null }
69+
70+
# ------------------------------------------------------------------
71+
# M365CollaborationOutbound → .UsersAndGroups (user + group)
72+
# ------------------------------------------------------------------
73+
$outboundConfig = if ($null -ne $Result.M365CollaborationOutbound) { $Result.M365CollaborationOutbound.UsersAndGroups } else { $null }
74+
$outboundAccessType = if ($null -ne $outboundConfig) { Format-AccessType $outboundConfig.AccessType } else { $null }
75+
$outboundUsers = if ($null -ne $outboundConfig) { Get-TargetIds -Config $outboundConfig -TargetType 'user' } else { $null }
76+
$outboundGroups = if ($null -ne $outboundConfig) { Get-TargetIds -Config $outboundConfig -TargetType 'group' } else { $null }
77+
78+
# ------------------------------------------------------------------
79+
# AppServiceConnectInbound → .Applications (application targets)
80+
# ------------------------------------------------------------------
81+
$appConfig = if ($null -ne $Result.AppServiceConnectInbound) { $Result.AppServiceConnectInbound.Applications } else { $null }
82+
$appAccessType = if ($null -ne $appConfig) { Format-AccessType $appConfig.AccessType } else { $null }
83+
$appIds = if ($null -ne $appConfig) { Get-TargetIds -Config $appConfig -TargetType 'application' } else { $null }
84+
85+
# ------------------------------------------------------------------
86+
# Emit flat output — property names match cmdlet input parameters.
87+
# ------------------------------------------------------------------
88+
if ($IsPartner) {
89+
[PSCustomObject]@{
90+
PartnerTenantId = $Result.TenantId
91+
M365CollaborationInbound = $inboundAccessType
92+
M365CollaborationInboundTargetUsers = $inboundUsers
93+
M365CollaborationOutbound = $outboundAccessType
94+
M365CollaborationOutboundTargetUsers = $outboundUsers
95+
M365CollaborationOutboundTargetGroups = $outboundGroups
96+
AppServiceConnectInbound = $appAccessType
97+
AppServiceConnectInboundTargetApplications = $appIds
98+
}
99+
} else {
100+
[PSCustomObject]@{
101+
Id = $Result.Id
102+
IsServiceDefault = $Result.IsServiceDefault
103+
M365CollaborationInbound = $inboundAccessType
104+
M365CollaborationInboundTargetUsers = $inboundUsers
105+
M365CollaborationOutbound = $outboundAccessType
106+
M365CollaborationOutboundTargetUsers = $outboundUsers
107+
M365CollaborationOutboundTargetGroups = $outboundGroups
108+
AppServiceConnectInbound = $appAccessType
109+
AppServiceConnectInboundTargetApplications = $appIds
110+
}
111+
}
112+
}
113+
114+
<#
115+
.Synopsis
116+
Internal helper: projects a M365CapabilityBase API response into the flat
117+
parameter-aligned output shape shared by the *-DefaultM365XTAPCapability and
118+
*-PartnerM365XTAPCapability cmdlets.
119+
120+
.Description
121+
Decodes the nested M365CapabilityInboundAccess model back into the flat
122+
property names that match the cmdlet input parameters:
123+
124+
InboundAccess.IsAllowed → IsAllowed
125+
InboundAccess.ResourceScopes
126+
.Included[ResourceType=user] → IncludedUsers
127+
.Included[ResourceType=group] → IncludedGroups
128+
.Excluded[ResourceType=user] → ExcludedUsers
129+
.Excluded[ResourceType=group] → ExcludedGroups
130+
131+
Default mode (IsPartner = $false):
132+
Emits CapabilityId, LastModifiedDateTime, IsAllowed, Included/Excluded Users/Groups.
133+
134+
Partner mode (IsPartner = $true):
135+
Prepends PartnerTenantId before CapabilityId.
136+
#>
137+
function ConvertTo-EntraXTAPM365CapabilityFlatOutput {
138+
param(
139+
[Parameter(Mandatory = $true)]
140+
$Result,
141+
142+
[Parameter()]
143+
[switch]
144+
$IsPartner
145+
)
146+
147+
# ------------------------------------------------------------------
148+
# Helper: extract resource IDs from a scope array for a given type.
149+
# ------------------------------------------------------------------
150+
function Get-ScopeIds {
151+
param($Scopes, [string]$ResourceType)
152+
if ($null -eq $Scopes) { return $null }
153+
$ids = @($Scopes | Where-Object { $_.ResourceType -eq $ResourceType } | ForEach-Object { $_.ResourceId })
154+
if ($ids.Count -eq 0) { return $null }
155+
return $ids
156+
}
157+
158+
$inbound = $Result.InboundAccess
159+
$isAllowed = if ($null -ne $inbound) { $inbound.IsAllowed } else { $null }
160+
$includedUsers = $null
161+
$includedGroups = $null
162+
$excludedUsers = $null
163+
$excludedGroups = $null
164+
165+
if ($null -ne $inbound -and $null -ne $inbound.ResourceScopes) {
166+
$includedUsers = Get-ScopeIds -Scopes $inbound.ResourceScopes.Included -ResourceType 'user'
167+
$includedGroups = Get-ScopeIds -Scopes $inbound.ResourceScopes.Included -ResourceType 'group'
168+
$excludedUsers = Get-ScopeIds -Scopes $inbound.ResourceScopes.Excluded -ResourceType 'user'
169+
$excludedGroups = Get-ScopeIds -Scopes $inbound.ResourceScopes.Excluded -ResourceType 'group'
170+
}
171+
172+
if ($IsPartner) {
173+
[PSCustomObject]@{
174+
PartnerTenantId = $Result.AdditionalProperties['tenantId']
175+
CapabilityId = $Result.Name
176+
LastModifiedDateTime = $Result.LastModifiedDateTime
177+
IsAllowed = $isAllowed
178+
IncludedUsers = $includedUsers
179+
IncludedGroups = $includedGroups
180+
ExcludedUsers = $excludedUsers
181+
ExcludedGroups = $excludedGroups
182+
}
183+
} else {
184+
[PSCustomObject]@{
185+
CapabilityId = $Result.Name
186+
LastModifiedDateTime = $Result.LastModifiedDateTime
187+
IsAllowed = $isAllowed
188+
IncludedUsers = $includedUsers
189+
IncludedGroups = $includedGroups
190+
ExcludedUsers = $excludedUsers
191+
ExcludedGroups = $excludedGroups
192+
}
193+
}
194+
}
195+

‎src/Identity.SignIns/beta/custom/Get-DefaultEntraXTAP.ps1‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# ----------------------------------------------------------------------------------
2+
#
3+
# Copyright Microsoft Corporation
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
# ----------------------------------------------------------------------------------
14+
15+
<#
16+
.Synopsis
17+
Gets the M365 Collaboration and App Service Connect settings from the tenant-wide
18+
default Cross-Tenant Access Policy (XTAP) configuration.
19+
20+
.Description
21+
Provides a flattened, user-friendly interface over
22+
Get-MgBetaPolicyCrossTenantAccessPolicyDefault.
23+
24+
The default configuration is a singleton — there is exactly one per tenant.
25+
This cmdlet scopes the output to the three properties that are configurable
26+
via Update-DefaultEntraXTAP:
27+
28+
- M365CollaborationInbound (inbound user access)
29+
- M365CollaborationOutbound (outbound users and groups access)
30+
- AppServiceConnectInbound (inbound application access)
31+
32+
All other properties (B2B, InboundTrust, TenantRestrictions, etc.) are excluded
33+
from both the API request ($select) and the output object.
34+
35+
.Example
36+
# Get the default M365 Collaboration and App Service Connect settings
37+
Get-DefaultEntraXTAP
38+
39+
.Outputs
40+
Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphCrossTenantAccessPolicyConfigurationDefault
41+
42+
.Link
43+
https://learn.microsoft.com/en-us/graph/api/crosstenantaccesspolicydefaultconfiguration-get
44+
https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.beta.identity.signins/get-mgbetapolicycrosstenantaccesspolicydefault
45+
#>
46+
function Get-DefaultEntraXTAP {
47+
[OutputType([Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphCrossTenantAccessPolicyConfigurationDefault])]
48+
[CmdletBinding(DefaultParameterSetName = 'Get',
49+
PositionalBinding = $false)]
50+
param(
51+
52+
# ── Pipeline / runtime ────────────────────────────────────────────
53+
[Parameter(DontShow)]
54+
[Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
55+
[System.Management.Automation.SwitchParameter]
56+
${Break},
57+
58+
[Parameter(DontShow)]
59+
[ValidateNotNull()]
60+
[Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
61+
[Microsoft.Graph.Beta.PowerShell.Runtime.SendAsyncStep[]]
62+
${HttpPipelineAppend},
63+
64+
[Parameter(DontShow)]
65+
[ValidateNotNull()]
66+
[Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
67+
[Microsoft.Graph.Beta.PowerShell.Runtime.SendAsyncStep[]]
68+
${HttpPipelinePrepend},
69+
70+
[Parameter(DontShow)]
71+
[Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
72+
[System.Uri]
73+
${Proxy},
74+
75+
[Parameter(DontShow)]
76+
[ValidateNotNull()]
77+
[Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
78+
[System.Management.Automation.PSCredential]
79+
${ProxyCredential},
80+
81+
[Parameter(DontShow)]
82+
[Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
83+
[System.Management.Automation.SwitchParameter]
84+
${ProxyUseDefaultCredentials}
85+
)
86+
87+
begin {
88+
}
89+
90+
process {
91+
# Request only the three properties exposed by Update-DefaultEntraXTAP.
92+
$selectProps = 'id', 'isServiceDefault', 'm365CollaborationInbound', 'm365CollaborationOutbound', 'appServiceConnectInbound'
93+
94+
Write-Verbose "Getting default XTAP configuration (scoped to M365Collaboration and AppServiceConnect)."
95+
96+
$result = Get-MgBetaPolicyCrossTenantAccessPolicyDefault `
97+
-Property $selectProps `
98+
@PSBoundParameters
99+
100+
if ($null -eq $result) { return }
101+
102+
ConvertTo-EntraXTAPFlatOutput -Result $result
103+
}
104+
105+
end {
106+
}
107+
}

0 commit comments

Comments
 (0)