Skip to content

Commit 444dc53

Browse files
jazunteemerill
jazuntee
and
merill
authored
Preview (#63)
* Fixed bug for instances where .principal prop didn't exist * Fixed issue with incorrect variable name for $InputObject * Role-assignments (#62) * update role assignment collection logic * Update pbit to match pwsh output * Fix module version check * Fix bug on tenants with no P2 licenses * Fix warning on tenants with no AAD licenses * Remove resource not found warnings * Remove auth method registration warning * Remove posh test gallery from cd pipeline Co-authored-by: Merill Fernando <[email protected]>
1 parent bd6b3d3 commit 444dc53

13 files changed

+164
-144
lines changed

‎CONTRIBUTING.md

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Contributing
2+
3+
This project welcomes contributions and suggestions. Most contributions require you to agree to a
4+
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
5+
the rights to use your contribution. For details, visit <https://cla.opensource.microsoft.com>.
6+
7+
When you submit a pull request, a CLA bot will automatically determine whether you need to provide
8+
a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
9+
provided by the bot. You will only need to do this once across all repos using our CLA.
10+
11+
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
12+
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
13+
contact [[email protected]](mailto:[email protected]) with any additional questions or comments.
14+
15+
<!-- ## Build -->
16+
17+
<!-- ## Test -->
18+
19+
## Power BI Template Updates
20+
21+
Updating the Power BI Template files (.pbit) can be tricky and must align with changes to the PowerShell data collection process. Power BI also has a [Data Privacy Firewall](https://docs.microsoft.com/en-us/power-query/dataprivacyfirewall) which prevents accidental data leakage between data sources. This firewall can sometimes prevent our assessment templates from loading when a query combines or joins data from multiple files, for example, oauth2PermissionGrants.csv + servicePrincipals.json. In our case, all the data sources have the same privacy level which should allow them to be combined but Power BI may still prevent loading with the following error:
22+
Query 'Query1' (step 'Source') references other queries or steps, so it may not directly access a data source. Please rebuild this data combination.
23+
24+
One option to avoid this error is to turn off the Data Privacy Firewall by setting [Power BI Desktop privacy level](https://docs.microsoft.com/en-us/power-bi/enterprise/desktop-privacy-levels) to "Ignore the Privacy levels" when the template fails to load the data.
25+
26+
However, in order to avoid changing this setting whenever the template is instantiated, we can "rebuild this data combination" to avoid the firewall restrictions by introducing a proxy [function](https://docs.microsoft.com/en-us/power-query/custom-function) for each data sources used in the combination query. You can see some examples of this in the existing templates where queries will reference f_oauth2PermissionGrants() and f_servicePrincipals() which are proxy functions for the oauth2PermissionGrants and servicePrincipal data source tables rather than referencing those tables directly.

‎README.md

+2
Original file line numberDiff line numberDiff line change
@@ -147,3 +147,5 @@ provided by the bot. You will only need to do this once across all repos using o
147147
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
148148
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
149149
contact [[email protected]](mailto:[email protected]) with any additional questions or comments.
150+
151+
For more detailed guidance and recommendations for contributing, see the page for [contributing](CONTRIBUTING.md).

‎assets/AzureADAssessment-ConditionalAccess.pbit

28.7 KB
Binary file not shown.

‎assets/AzureADAssessment.pbit

-2.51 KB
Binary file not shown.

‎build/azure-pipelines/azure-pipelines-cd.yml

+36-36
Original file line numberDiff line numberDiff line change
@@ -119,43 +119,43 @@ stages:
119119
moduleName: '$(moduleName)'
120120
moduleVersion: '$(moduleVersion)'
121121

122-
- stage: DeployTest
123-
displayName: 'Deploy Test'
124-
dependsOn:
125-
- Build
126-
jobs:
127-
- job: Prepare
128-
variables:
129-
skipComponentGovernanceDetection: true
130-
steps:
131-
- download: current
132-
artifact: '$(artifactModuleSigned)'
133-
- task: PowerShell@2
134-
name: ModuleInfo
135-
displayName: 'Get PowerShell Module Information'
136-
inputs:
137-
filePath: '$(System.DefaultWorkingDirectory)/build/Get-PSModuleInfo.ps1'
138-
arguments: '-ModuleManifestPath "$(Pipeline.Workspace)/$(artifactModuleSigned)/*/*.psd1"'
139-
pwsh: true
122+
# - stage: DeployTest
123+
# displayName: 'Deploy Test'
124+
# dependsOn:
125+
# - Build
126+
# jobs:
127+
# - job: Prepare
128+
# variables:
129+
# skipComponentGovernanceDetection: true
130+
# steps:
131+
# - download: current
132+
# artifact: '$(artifactModuleSigned)'
133+
# - task: PowerShell@2
134+
# name: ModuleInfo
135+
# displayName: 'Get PowerShell Module Information'
136+
# inputs:
137+
# filePath: '$(System.DefaultWorkingDirectory)/build/Get-PSModuleInfo.ps1'
138+
# arguments: '-ModuleManifestPath "$(Pipeline.Workspace)/$(artifactModuleSigned)/*/*.psd1"'
139+
# pwsh: true
140140

141-
- deployment: Publish
142-
environment: Test
143-
dependsOn: Prepare
144-
variables:
145-
moduleName: '$[ dependencies.Prepare.outputs[''ModuleInfo.moduleName''] ]'
146-
moduleVersion: '$[ dependencies.Prepare.outputs[''ModuleInfo.moduleVersion''] ]'
147-
strategy:
148-
runOnce:
149-
deploy:
150-
steps:
151-
- template: template-psmodule-publish.yml
152-
parameters:
153-
moduleName: '$(moduleName)'
154-
RepositorySourceLocation: 'https://www.poshtestgallery.com/api/v2'
155-
NuGetApiKeyAzureConnection: 'GTP - Architecture (980e0e9f-178a-4c38-9372-f17806c6b944)'
156-
NuGetApiKeyVaultName: 'codesign-kv'
157-
NuGetApiKeySecretName: 'PSTestGallery-API-Key'
158-
Unlist: true
141+
# - deployment: Publish
142+
# environment: Test
143+
# dependsOn: Prepare
144+
# variables:
145+
# moduleName: '$[ dependencies.Prepare.outputs[''ModuleInfo.moduleName''] ]'
146+
# moduleVersion: '$[ dependencies.Prepare.outputs[''ModuleInfo.moduleVersion''] ]'
147+
# strategy:
148+
# runOnce:
149+
# deploy:
150+
# steps:
151+
# - template: template-psmodule-publish.yml
152+
# parameters:
153+
# moduleName: '$(moduleName)'
154+
# RepositorySourceLocation: 'https://www.poshtestgallery.com/api/v2'
155+
# NuGetApiKeyAzureConnection: 'GTP - Architecture (980e0e9f-178a-4c38-9372-f17806c6b944)'
156+
# NuGetApiKeyVaultName: 'codesign-kv'
157+
# NuGetApiKeySecretName: 'PSTestGallery-API-Key'
158+
# Unlist: true
159159

160160
- stage: Production
161161
displayName: 'Deploy Production'

‎src/Complete-AADAssessmentReports.ps1

+3-3
Original file line numberDiff line numberDiff line change
@@ -66,18 +66,18 @@ function Complete-AADAssessmentReports {
6666

6767
## Expand Data Package
6868
Write-Progress -Id 0 -Activity 'Microsoft Azure AD Assessment Complete Reports' -Status 'Expand Data' -PercentComplete 0
69-
#Expand-Archive $Path -DestinationPath $OutputDirectoryData -Force -ErrorAction Stop
7069
# Remove destination before extract
7170
if (Test-Path -Path $OutputDirectoryData) {
7271
Remove-Item $OutputDirectoryData -Recurse -Force
7372
}
7473
# Extract content
74+
#Expand-Archive $Path -DestinationPath $OutputDirectoryData -Force -ErrorAction Stop
7575
[System.IO.Compression.ZipFile]::ExtractToDirectory($Path,$OutputDirectoryData)
7676
$AssessmentDetail = Get-Content $AssessmentDetailPath -Raw | ConvertFrom-Json
7777
#Check for DataFiles
7878
$OutputDirectoryAAD = Join-Path $OutputDirectoryData 'AAD-*' -Resolve -ErrorAction Stop
7979
[array] $DataFiles = Get-Item -Path (Join-Path $OutputDirectoryAAD "*") -Include "*Data.xml"
80-
$SkippedReportOutput = $DataFiles -and $DataFiles.Count -eq 9
80+
$SkippedReportOutput = $DataFiles -and $DataFiles.Count -ge 8
8181

8282
## Check the provided archive
8383
$archiveState = Test-AADAssessmentPackage -Path $Path -SkippedReportOutput $SkippedReportOutput
@@ -87,7 +87,7 @@ function Complete-AADAssessmentReports {
8787
}
8888

8989
# Check assessment version
90-
$moduleVersion = $MyInvocation.MyCommand.ScriptBlock.Module.Version
90+
$moduleVersion = $MyInvocation.MyCommand.Module.Version
9191
[System.Version]$packageVersion = $AssessmentDetail.AssessmentVersion
9292
if ($packageVersion.Build -eq -1) {
9393
Write-Warning "The package was not generate with a module installed from the PowerShell Gallery"

‎src/Export-AADAssessmentReportData.ps1

+9-8
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ function Export-AADAssessmentReportData {
158158
$LookupCache.userRegistrationDetails.Clear()
159159
}
160160

161-
# notificaiton emails report
161+
# notificaiton emails report (Remove on next release)
162162
if (!(Test-Path -Path (Join-Path $OutputDirectory "NotificationsEmailsReport.csv")) -or $Force) {
163163
# load unique data
164164
$OrganizationData = Get-Content -Path (Join-Path $SourceDirectory "organization.json") -Raw | ConvertFrom-Json
@@ -186,18 +186,19 @@ function Export-AADAssessmentReportData {
186186
# role assignment report
187187
if (!(Test-Path -Path (Join-Path $OutputDirectory "RoleAssignmentReport.csv")) -or $Force) {
188188
# Set file header
189-
Set-Content -Path (Join-Path $OutputDirectory "RoleAssignmentReport.csv") -Value "id,directoryScopeId,directoryScopeObjectId,directoryScopeDisplayName,directoryScopeType,roleDefinitionId,roleDefinitionTemplateId,roleDefinitionDisplayName,principalId,principalDisplayName,principalType,memberType,status,assignmentType,startDateTime,endDateTime"
189+
Set-Content -Path (Join-Path $OutputDirectory "RoleAssignmentReport.csv") -Value "id,directoryScopeId,directoryScopeObjectId,directoryScopeDisplayName,directoryScopeType,roleDefinitionId,roleDefinitionTemplateId,roleDefinitionDisplayName,principalId,principalDisplayName,principalType,principalMail,principalOtherMails,memberType,assignmentType,startDateTime,endDateTime"
190190
# load unique data
191-
[array] $roleAssignmentSchedulesData = @()
192-
[array] $roleEligibilitySchedulesData = @()
191+
[array] $roleAssignmentScheduleInstancesData = @()
192+
[array] $roleEligibilityScheduleInstancesData = @()
193193
[array] $roleAssignmentsData = @()
194194
if ($licenseType -eq "P2") {
195-
$roleAssignmentSchedulesData = Import-Clixml -Path (Join-Path $SourceDirectory "roleAssignmentSchedulesData.xml")
196-
$roleEligibilitySchedulesData = Import-Clixml -Path (Join-Path $SourceDirectory "roleEligibilitySchedulesData.xml")
195+
$roleAssignmentScheduleInstancesData = Import-Clixml -Path (Join-Path $SourceDirectory "roleAssignmentScheduleInstancesData.xml")
196+
$roleEligibilityScheduleInstancesData = Import-Clixml -Path (Join-Path $SourceDirectory "roleEligibilityScheduleInstancesData.xml")
197197
} else {
198198
$roleAssignmentsData = Import-Clixml -Path (Join-Path $SourceDirectory "roleAssignmentsData.xml")
199199
}
200200
# load data if cache empty
201+
$OrganizationData = Get-Content -Path (Join-Path $SourceDirectory "organization.json") -Raw | ConvertFrom-Json
201202
if ($LookupCache.user.Count -eq 0) {
202203
Write-Output "Loading users in lookup cache"
203204
Import-Clixml -Path (Join-Path $SourceDirectory "userData.xml") | Add-AadObjectToLookupCache -Type user -LookupCache $LookupCache
@@ -220,13 +221,13 @@ function Export-AADAssessmentReportData {
220221
}
221222

222223
# generate the report
223-
Get-AADAssessRoleAssignmentReport -Offline -TenantHasP2 ($licenseType -eq "P2") -RoleAssignmentsData $roleAssignmentsData -RoleAssignmentSchedulesData $roleAssignmentSchedulesData -RoleEligibilitySchedulesData $roleEligibilitySchedulesData -OrganizationData $OrganizationData -AdministrativeUnitsData $LookupCache.administrativeUnit -UsersData $LookupCache.user -GroupsData $LookupCache.group -ApplicationsData $LookupCache.application -ServicePrincipalsData $LookupCache.servicePrincipal `
224+
Get-AADAssessRoleAssignmentReport -Offline -RoleAssignmentsData $roleAssignmentsData -RoleAssignmentScheduleInstancesData $roleAssignmentScheduleInstancesData -RoleEligibilityScheduleInstancesData $roleEligibilityScheduleInstancesData -OrganizationData $OrganizationData -AdministrativeUnitsData $LookupCache.administrativeUnit -UsersData $LookupCache.user -GroupsData $LookupCache.group -ApplicationsData $LookupCache.application -ServicePrincipalsData $LookupCache.servicePrincipal `
224225
| Use-Progress -Activity 'Exporting RoleAssignmentReport' -Property id -PassThru -WriteSummary `
225226
| Format-Csv `
226227
| Export-Csv -Path (Join-Path $OutputDirectory "RoleAssignmentReport.csv") -NoTypeInformation -Append
227228

228229
# clear unique data
229-
Remove-Variable roleAssignmentSchedulesData, roleEligibilitySchedulesData
230+
Remove-Variable roleAssignmentScheduleInstancesData, roleEligibilityScheduleInstancesData
230231
# clear cache as data is not further used by other reports
231232
$LookupCache.group.Clear()
232233
$LookupCache.administrativeUnit.Clear()

0 commit comments

Comments
 (0)