Skip to content

Add option to get transitive members of groups #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wipash wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add option to get transitive members of groups #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
030633a
Add option to pass additional headers to graph req
wipash Jun 30, 2022
49941b7
Get transitive members
wipash Jun 30, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions HelperFunctions.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,18 +22,24 @@ function Get-GraphRequestRecursive {
[Parameter(Mandatory = $true,
ValueFromPipeline = $true,
Position = 1)]
[String] $Url
[String] $Url,

# Graph headers
[Parameter(Mandatory = $false,
Position = 2)]
[Hashtable] $AdditionalHeaders = @{}
)

Write-Debug "Fetching url $Url"
$Result = Invoke-RestMethod $Url -Headers @{Authorization = "Bearer $AccessToken" } -Verbose:$false
$Headers = @{Authorization = "Bearer $AccessToken" } + $AdditionalHeaders
$Result = Invoke-RestMethod $Url -Headers $Headers -Verbose:$false
if ($Result.value) {
$Result.value
}

# Calls itself when there is a nextlink, in order to get next page
if ($Result.'@odata.nextLink') {
Get-GraphRequestRecursive -Url $Result.'@odata.nextLink' -AccessToken $AccessToken
Get-GraphRequestRecursive -Url $Result.'@odata.nextLink' -AccessToken $AccessToken -AdditionalHeaders $AdditionalHeaders
}
}

Expand Down
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,8 @@ The following can be useful if you have multple Azure ADs or limitations in scop
| AADGroupScopingConfig | 2 | Additional info required to determine groups (filter etc.) | id eq '<objectid>' |
| GroupDeprovisioningMethod | Yes | Determines what to do when source AAD group is deleted | Delete / ConvertToDistributionGroup / PrintWarning / DoNothing |
| ADGroupNamePattern | No | Format string for AD group name, {0} = displayName from AAD, {1} = objectId from AAD, {2} = mailNickname from AAD | {0} ({1}) |
| Environment | No | Azure Environment (default to AzurePublic) | AzureCloud / AzureUSGovernment |
| Environment | No | Azure Environment (default to AzurePublic) | AzureCloud / AzureUSGovernment |
| TransitiveMembers | No | Retrieves a flat list of members from all child groups of the AAD group | true |

1. If AuthenticationMethod is ClientCredentials
2. If AADGroupScopingMethod is GroupMemberOfGroup or AADGroupScopingConfig
Expand Down Expand Up @@ -193,4 +194,4 @@ PAM bastion forest support using the AD optional feature for PAM and msDS-Shadow
```
$of = get-ADOptionalFeature -filter "name -eq 'privileged access management feature'"
Enable-ADOptionalFeature $of -scope ForestOrConfigurationSet -target ((Get-ADForest).RootDomain)
```
```
8 changes: 6 additions & 2 deletions Run.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,8 +95,12 @@ $ErrorActionPreference = "Continue" # No need to fail hard anymore. This reduces
Write-Verbose "Processing all memberships"
Foreach($ScopedGroup in $ScopedGroups) {
Write-Verbose " - Processing group '$($ScopedGroup.displayName)' ($($ScopedGroup.id))"
$Members = Get-GraphRequestRecursive -Url "$($graphEndpoints.GraphUrl)/v1.0/groups/$($ScopedGroup.id)/members?`$select=id,userType,displayName,userPrincipalName,onPremisesDistinguishedName,onPremisesImmutableId" -AccessToken $AccessToken

if ($Config.TransitiveMembers -eq 'true') {
$Members = Get-GraphRequestRecursive -Url "$($graphEndpoints.GraphUrl)/v1.0/groups/$($ScopedGroup.id)/transitiveMembers/microsoft.graph.user?`$count=true&`$select=id,userType,displayName,userPrincipalName,onPremisesDistinguishedName,onPremisesImmutableId" -AccessToken $AccessToken -AdditionalHeaders @{ConsistencyLevel = 'eventual' }
} else {
$Members = Get-GraphRequestRecursive -Url "$($graphEndpoints.GraphUrl)/v1.0/groups/$($ScopedGroup.id)/members?`$select=id,userType,displayName,userPrincipalName,onPremisesDistinguishedName,onPremisesImmutableId" -AccessToken $AccessToken
}

# Get all onPremisesDistinguishedName values from AAD, which should be our correct list
$ExpectedADMembers = $Members |
Where-Object onPremisesDistinguishedName |
Expand Down