Skip to content

fixes issue #21 #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fixes issue #21 #22

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 78 additions & 4 deletions DCToolbox.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2182,6 +2182,9 @@ function Export-DCConditionalAccessPolicyDesign {

.PARAMETER PrefixFilter
Only export the policys with this prefix.

.PARAMETER SuffixFilter
Only export the policys with this suffix.

.INPUTS
None
Expand Down Expand Up @@ -2210,13 +2213,23 @@ function Export-DCConditionalAccessPolicyDesign {
PrefixFilter = 'RING1'
}
Export-DCConditionalAccessPolicyDesign @Parameters

.EXAMPLE
$Parameters = @{
ClientID = ''
ClientSecret = ''
FilePath = 'C:\Temp\Conditional Access.json'
SuffixFilter = 'RING1'
}
Export-DCConditionalAccessPolicyDesign @Parameters
#>



# ----- [Initialisations] -----

# Script parameters.
[CmdletBinding(DefaultParameterSetName = 'PrefixFilter')]
param (
[parameter(Mandatory = $true)]
[string]$ClientID,
Expand All @@ -2227,8 +2240,13 @@ function Export-DCConditionalAccessPolicyDesign {
[parameter(Mandatory = $false)]
[string]$FilePath = "$((Get-Location).Path)\Conditional Access Backup $(Get-Date -Format 'yyyy-MM-dd').json",

[parameter(Mandatory = $false)]
[string]$PrefixFilter
[parameter(Mandatory = $false,
ParameterSetName = 'PrefixFilter')]
[string]$PrefixFilter,

[parameter(Mandatory = $false,
ParameterSetName = 'SuffixFilter')]
[string]$SuffixFilter
)


Expand All @@ -2249,6 +2267,10 @@ function Export-DCConditionalAccessPolicyDesign {
Write-Verbose -Verbose -Message "Prefix filter was set and only policies beginning with '$PrefixFilter' will be exported!"
}

if ($SuffixFilter) {
Write-Verbose -Verbose -Message "Suffix filter was set and only policies ending with '$SuffixFilter' will be exported!"
}


# Export all Conditional Access policies from Microsoft Graph as JSON.
Write-Verbose -Verbose -Message "Exporting Conditional Access policies to '$FilePath'..."
Expand All @@ -2262,6 +2284,13 @@ function Export-DCConditionalAccessPolicyDesign {
$GraphUri = 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies'
}

if ($SuffixFilter) {
$GraphUri = "https://graph.microsoft.com/beta/identity/conditionalAccess/policies?`$filter=endsWith(displayName,'$SuffixFilter')"
}
else {
$GraphUri = 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies'
}

Invoke-DCMsGraphQuery -AccessToken $AccessToken -GraphMethod 'GET' -GraphUri $GraphUri | Sort-Object createdDateTime | ConvertTo-Json -Depth 10 | Out-File -Force:$true -FilePath $FilePath

# Perform some clean up in the file.
Expand Down Expand Up @@ -2321,6 +2350,9 @@ function Import-DCConditionalAccessPolicyDesign {

.PARAMETER PrefixFilter
Only import (and delete) the policys with this prefix in the JSON file.

.PARAMETER SuffixFilter
Only import (and delete) the policys with this suffix in the JSON file.

.INPUTS
JSON file containing your Conditional Access policies.
Expand Down Expand Up @@ -2354,6 +2386,18 @@ function Import-DCConditionalAccessPolicyDesign {
PrefixFilter = 'RING2'
}

Import-DCConditionalAccessPolicyDesign @Parameters

.EXAMPLE
$Parameters = @{
ClientID = ''
ClientSecret = ''
FilePath = 'C:\Temp\Conditional Access.json'
SkipReportOnlyMode = $true
DeleteAllExistingPolicies = $true
SuffixFilter = 'RING2'
}

Import-DCConditionalAccessPolicyDesign @Parameters
#>

Expand All @@ -2362,6 +2406,7 @@ function Import-DCConditionalAccessPolicyDesign {
# ----- [Initialisations] -----

# Script parameters.
CmdletBinding(DefaultParameterSetName = 'PrefixFilter')]
param (
[parameter(Mandatory = $true)]
[string]$ClientID,
Expand All @@ -2378,8 +2423,13 @@ function Import-DCConditionalAccessPolicyDesign {
[parameter(Mandatory = $false)]
[switch]$DeleteAllExistingPolicies,

[parameter(Mandatory = $false)]
[string]$PrefixFilter
[parameter(Mandatory = $false,
ParameterSetName = 'PrefixFilter')]
[string]$PrefixFilter,

[parameter(Mandatory = $false,
ParameterSetName = 'SuffixFilter')]
[string]$SuffixFilter
)


Expand All @@ -2400,6 +2450,10 @@ function Import-DCConditionalAccessPolicyDesign {
Write-Verbose -Verbose -Message "Prefix filter was set and only policies beginning with '$PrefixFilter' will be affected!"
}

if ($SuffixFilter) {
Write-Verbose -Verbose -Message "Suffix filter was set and only policies ending with '$SuffixFilter' will be affected!"
}


# Import policies from JSON file.
Write-Verbose -Verbose -Message "Importing JSON from '$FilePath'..."
Expand All @@ -2426,6 +2480,13 @@ function Import-DCConditionalAccessPolicyDesign {

Invoke-DCMsGraphQuery -AccessToken $AccessToken -GraphMethod 'DELETE' -GraphUri $GraphUri -ErrorAction SilentlyContinue | Out-Null
}

if ($Policy.displayName.EndsWith($SuffixFilter)) {
Start-Sleep -Seconds 1
$GraphUri = "https://graph.microsoft.com/beta/identity/conditionalAccess/policies/$($Policy.id)"

Invoke-DCMsGraphQuery -AccessToken $AccessToken -GraphMethod 'DELETE' -GraphUri $GraphUri -ErrorAction SilentlyContinue | Out-Null
}
}
}

Expand All @@ -2448,6 +2509,19 @@ function Import-DCConditionalAccessPolicyDesign {
Write-Error -Message $_.Exception.Message -ErrorAction Continue
}
}

if ($Policy.displayName.EndsWith($SuffixFilter)) {
Start-Sleep -Seconds 1
Write-Verbose -Verbose -Message "Creating '$($Policy.DisplayName)'..."

try {
# Create new policies.
Invoke-DCMsGraphQuery -AccessToken $AccessToken -GraphMethod 'POST' -GraphUri $GraphUri -GraphBody ($Policy | ConvertTo-Json -Depth 10) | Out-Null
}
catch {
Write-Error -Message $_.Exception.Message -ErrorAction Continue
}
}
}


Expand Down