Default Management Group docs | ||||||||||||||||||||||||
Management Group Name: $($mgName -replace "<", "<" -replace ">", ">") | ||||||||||||||||||||||||
Management Group Id: $mgId | ||||||||||||||||||||||||
Management Group Path: $mgPath | ||||||||||||||||||||||||
|
"@
+ }
foreach ($subEntry in $subscriptions | sort-object -Property subscription, subscriptionId) {
- $subPath = $htSubscriptionsMgPath.($subEntry.subscriptionId).pathDelimited
+ #$subPath = $htSubscriptionsMgPath.($subEntry.subscriptionId).pathDelimited
if ($subscriptionLinkedCount -gt 1) {
- $script:html += @"
+ if (-not $NoScopeInsights) {
+ $script:html += @"
"@
+ }
}
#exactly 1
else {
- $script:html += @"
+ if (-not $NoScopeInsights) {
+ $script:html += @"
"@
+ }
}
#endregion tableSubForMgHTML
#rsi
#region ScopeInsights
-function tableMgSubDetailsHTML($mgOrSub, $mgChild, $subscriptionId) {
+function tableMgSubDetailsHTML($mgOrSub, $mgChild, $subscriptionId, $subscriptionsMgId) {
$script:scopescnter++
$htmlScopeInsights = $null
$htmlScopeInsights = [System.Text.StringBuilder]::new()
@@ -5277,6 +5287,7 @@ function tableMgSubDetailsHTML($mgOrSub, $mgChild, $subscriptionId) {
#SubscriptionDetails
#$subscriptionId = "b2ac7057-8edf-4617-a1f7-5ed6b44ef2c8"
#$subscriptionDetailsReleatedQuery = $optimizedTableForPathQuerySub | Where-Object { $_.SubscriptionId -eq $subscriptionId }
+ $subPath = $htSubscriptionsMgPath.($subscriptionId).pathDelimited
$subscriptionDetailsReleatedQuery = $htSubDetails.($subscriptionId).details
$subscriptionState = ($subscriptionDetailsReleatedQuery).SubscriptionState
$subscriptionQuotaId = ($subscriptionDetailsReleatedQuery).SubscriptionQuotaId
@@ -5312,10 +5323,11 @@ function tableMgSubDetailsHTML($mgOrSub, $mgChild, $subscriptionId) {
#endregion ScopeInsightsBaseCollection
if ($mgOrSub -eq "sub") {
-
[void]$htmlScopeInsights.AppendLine(@"
- $($subEntry.subscription -replace "<", "<" -replace ">", ">") ($($subEntry.subscriptionId))
"@
+ }
}
-
- $script:html += @"
-
State: $subscriptionState - | ||||||||||||||||||||||||
Subscription Name: $($subscriptionDetailsReleatedQuery.subscription -replace "<", "<" -replace ">", ">") | ||||||||||||||||||||||||
Subscription Id: $($subscriptionDetailsReleatedQuery.subscriptionId) | ||||||||||||||||||||||||
Subscription Path: $subPath | ||||||||||||||||||||||||
State: $subscriptionState | ||||||||||||||||||||||||
QuotaId: $subscriptionQuotaId | ||||||||||||||||||||||||
ASC Secure Score: $subscriptionASCPoints Video , Blog , docs | ||||||||||||||||||||||||
|
@@ -5796,17 +5808,17 @@ tf.init();}}
No Consumption data available "@) } - - [void]$htmlScopeInsights.AppendLine(@" - | ||||||||||||||||||||||||
|
-"@)
}
else {
[void]$htmlScopeInsights.AppendLine(@"
No Consumption data available as parameter -NoAzureConsumption was applied "@) } + + [void]$htmlScopeInsights.AppendLine(@" + | ||||||||||||||||||||||||
|
+"@)
#endregion ScopeInsightsConsumptionSub
#$endScopeInsightsConsumptionSub = get-date
#Write-Host " **ScopeInsightsConsumptionSub data duration: $((NEW-TIMESPAN -Start $startScopeInsightsConsumptionSub -End $endScopeInsightsConsumptionSub).TotalSeconds) seconds"
@@ -7999,18 +8011,36 @@ btn_reset: true, highlight_keywords: true, alternate_rows: true, auto_filter: {
else {
[void]$htmlScopeInsights.AppendLine(@"
$(($rbacAll | measure-object).count) Role assignments - | ||||||||||||||||||||||||
| $($type) | @@ -16315,7 +16344,7 @@ tf.init(); $policyAssignmentsPolicyDefinitionId = ($assignmentInfo.properties.policyDefinitionId).ToLower() $policyAssignmentspolicyDefinitionIdGuid = $policyAssignmentsPolicyDefinitionId -replace ".*/" - if ($policyAssignmentsPolicyVariant4ht -eq "policy"){ + if ($policyAssignmentsPolicyVariant4ht -eq "policy") { if (($htCacheDefinitionsPolicy).($policyAssignmentsPolicyDefinitionId)) { $definitionInfo = ($htCacheDefinitionsPolicy).($policyAssignmentsPolicyDefinitionId) } @@ -16323,7 +16352,7 @@ tf.init(); $definitionInfo = "unknown" } } - if ($policyAssignmentsPolicyVariant4ht -eq "policySet"){ + if ($policyAssignmentsPolicyVariant4ht -eq "policySet") { if (($htCacheDefinitionsPolicySet).($policyAssignmentsPolicyDefinitionId)) { $definitionInfo = ($htCacheDefinitionsPolicySet).($policyAssignmentsPolicyDefinitionId) } @@ -16337,7 +16366,7 @@ tf.init(); $policyAssignmentsPolicyDefinitionId = ($assignmentInfo.properties.policyDefinitionId).ToLower() $policyAssignmentspolicyDefinitionIdGuid = $policyAssignmentsPolicyDefinitionId -replace ".*/" - if ($policyAssignmentsPolicyVariant4ht -eq "policy"){ + if ($policyAssignmentsPolicyVariant4ht -eq "policy") { if (($htCacheDefinitionsPolicy).($policyAssignmentsPolicyDefinitionId)) { $definitionInfo = ($htCacheDefinitionsPolicy).($policyAssignmentsPolicyDefinitionId) } @@ -16345,7 +16374,7 @@ tf.init(); $definitionInfo = "unknown" } } - if ($policyAssignmentsPolicyVariant4ht -eq "policySet"){ + if ($policyAssignmentsPolicyVariant4ht -eq "policySet") { if (($htCacheDefinitionsPolicySet).($policyAssignmentsPolicyDefinitionId)) { $definitionInfo = ($htCacheDefinitionsPolicySet).($policyAssignmentsPolicyDefinitionId) } @@ -16368,7 +16397,7 @@ tf.init(); $policyAssignmentsPolicyDefinitionId = ($assignmentInfo.properties.policyDefinitionId).Tolower() $policyAssignmentspolicyDefinitionIdGuid = $policyAssignmentsPolicyDefinitionId -replace ".*/" - if ($policyAssignmentsPolicyVariant4ht -eq "policy"){ + if ($policyAssignmentsPolicyVariant4ht -eq "policy") { if (($htCacheDefinitionsPolicy).($policyAssignmentsPolicyDefinitionId)) { $definitionInfo = ($htCacheDefinitionsPolicy).($policyAssignmentsPolicyDefinitionId) } @@ -16376,7 +16405,7 @@ tf.init(); $definitionInfo = "unknown" } } - if ($policyAssignmentsPolicyVariant4ht -eq "policySet"){ + if ($policyAssignmentsPolicyVariant4ht -eq "policySet") { if (($htCacheDefinitionsPolicySet).($policyAssignmentsPolicyDefinitionId)) { $definitionInfo = ($htCacheDefinitionsPolicySet).($policyAssignmentsPolicyDefinitionId) } @@ -16503,26 +16532,27 @@ tf.init(); #endregion AADSPManagedIdentity #region AADSPCredExpiry - $startAADSPCredExpiryLoop = get-date - Write-Host " processing TenantSummary AAD SP Apps CredExpiry" + if (-not $skipApplications) { + $startAADSPCredExpiryLoop = get-date + Write-Host " processing TenantSummary AAD SP Apps CredExpiry" - $servicePrincipalsOfTypeApplicationCount = ($servicePrincipalsOfTypeApplication | Measure-Object).Count + $servicePrincipalsOfTypeApplicationCount = ($servicePrincipalsOfTypeApplication | Measure-Object).Count - if ($servicePrincipalsOfTypeApplicationCount -gt 0) { - $tfCount = $servicePrincipalsOfTypeApplicationCount - $htmlTableId = "TenantSummary_AADSPCredExpiry" + if ($servicePrincipalsOfTypeApplicationCount -gt 0) { + $tfCount = $servicePrincipalsOfTypeApplicationCount + $htmlTableId = "TenantSummary_AADSPCredExpiry" - $servicePrincipalsOfTypeApplicationSecretsExpiring = $servicePrincipalsOfTypeApplication | Where-Object { $htAppDetails.($_).appPasswordCredentialsGracePeriodExpiryCount -gt 0 } - $servicePrincipalsOfTypeApplicationSecretsExpiringCount = ($servicePrincipalsOfTypeApplicationSecretsExpiring | Measure-Object).Count - $servicePrincipalsOfTypeApplicationCertificatesExpiring = $servicePrincipalsOfTypeApplication | Where-Object { $htAppDetails.($_).appKeyCredentialsGracePeriodExpiryCount -gt 0 } - $servicePrincipalsOfTypeApplicationCertificatesExpiringCount = ($servicePrincipalsOfTypeApplicationCertificatesExpiring | Measure-Object).Count - if ($servicePrincipalsOfTypeApplicationSecretsExpiringCount -gt 0 -or $servicePrincipalsOfTypeApplicationCertificatesExpiringCount -gt 0) { - $warningOrNot = "" - } - else { - $warningOrNot = "" - } - [void]$htmlTenantSummary.AppendLine(@" + $servicePrincipalsOfTypeApplicationSecretsExpiring = $servicePrincipalsOfTypeApplication | Where-Object { $htAppDetails.($_).appPasswordCredentialsGracePeriodExpiryCount -gt 0 } + $servicePrincipalsOfTypeApplicationSecretsExpiringCount = ($servicePrincipalsOfTypeApplicationSecretsExpiring | Measure-Object).Count + $servicePrincipalsOfTypeApplicationCertificatesExpiring = $servicePrincipalsOfTypeApplication | Where-Object { $htAppDetails.($_).appKeyCredentialsGracePeriodExpiryCount -gt 0 } + $servicePrincipalsOfTypeApplicationCertificatesExpiringCount = ($servicePrincipalsOfTypeApplicationCertificatesExpiring | Measure-Object).Count + if ($servicePrincipalsOfTypeApplicationSecretsExpiringCount -gt 0 -or $servicePrincipalsOfTypeApplicationCertificatesExpiringCount -gt 0) { + $warningOrNot = "" + } + else { + $warningOrNot = "" + } + [void]$htmlTenantSummary.AppendLine(@"||||||||||||||||||||||||
| $($htAppDetails.$serviceprincipalApp.spGraphDetails.appId) | $($htAppDetails.$serviceprincipalApp.spGraphDetails.displayName) | @@ -16558,50 +16588,50 @@ tf.init();$($htAppDetails.$serviceprincipalApp.spGraphDetails.Id) | $($htAppDetails.$serviceprincipalApp.appGraphDetails.Id) | "@ - if ($htAppDetails.$serviceprincipalApp.appPasswordCredentialsCount) { - @" + if ($htAppDetails.$serviceprincipalApp.appPasswordCredentialsCount) { + @"$($htAppDetails.$serviceprincipalApp.appPasswordCredentialsCount) | $($htAppDetails.$serviceprincipalApp.appPasswordCredentialsExpiredCount) | $($htAppDetails.$serviceprincipalApp.appPasswordCredentialsGracePeriodExpiryCount) | $($htAppDetails.$serviceprincipalApp.appPasswordCredentialsExpiryOKCount) | $($htAppDetails.$serviceprincipalApp.appPasswordCredentialsExpiryOKMoreThan2YearsCount) | "@ - } - else { - @" + } + else { + @"0 | 0 | 0 | 0 | 0 | "@ - } + } - if ($htAppDetails.$serviceprincipalApp.appKeyCredentialsCount) { - @" + if ($htAppDetails.$serviceprincipalApp.appKeyCredentialsCount) { + @"$($htAppDetails.$serviceprincipalApp.appKeyCredentialsCount) | $($htAppDetails.$serviceprincipalApp.appKeyCredentialsExpiredCount) | $($htAppDetails.$serviceprincipalApp.appKeyCredentialsGracePeriodExpiryCount) | $($htAppDetails.$serviceprincipalApp.appKeyCredentialsExpiryOKCount) | $($htAppDetails.$serviceprincipalApp.appKeyCredentialsExpiryOKMoreThan2YearsCount) | "@ - } - else { - @" + } + else { + @"0 | 0 | 0 | 0 | 0 | "@ - } + } - @" + @"
Azure DevOps Pipeline | ServicePrincipal (Service Connection)
- Add assignment for the Azure DevOps Service Connection's Service Principal to AAD Role Directory readers
💡 Directory readers
- Option 2 (explicit permission model)
| Feature | Permissions | -Parameter | |
|---|---|---|---|
| Get AAD Guest Users |
+ Get AAD Users |
Azure DevOps Service Connection's App registration grant with Microsoft Graph permissions: Application permissions / User / User.Read.All 💡 Get user |
- n/a |
| Get AAD Groups |
Azure DevOps Service Connection's App registration grant with Microsoft Graph permissions: Application permissions / Group / Group.Read.All 💡 Get group |
- NoAADGroupsResolveMembers | |
| Get AAD SP/App |
Azure DevOps Service Connection's App registration grant with Microsoft Graph permissions: Application permissions / Application / Application.Read.All 💡 Get servicePrincipal, Get application |
- n/a |
![](`"https://www.azadvertizer.net/azgovvizv4/icon/Icon-general-2-Subscriptions.svg`"){kind=icon}
$mgLinkedSubsCount"
- }
- if ($mgLinkedSubsCount -gt 0 -and $subscriptionsOutOfScopelinkedCount -gt 0) {
- $subInfo = "$mgLinkedSubsCount ![](`"https://www.azadvertizer.net/azgovvizv4/icon/Icon-general-2-Subscriptions_excluded_r.svg`"){kind=icon}
$subscriptionsOutOfScopelinkedCount"
- }
- if ($mgLinkedSubsCount -eq 0 -and $subscriptionsOutOfScopelinkedCount -gt 0) {
- $subInfo = "$subscriptionsOutOfScopelinkedCount"
- }
- if ($mgLinkedSubsCount -eq 0 -and $subscriptionsOutOfScopelinkedCount -eq 0) {
- $subInfo = "![](`"https://www.azadvertizer.net/azgovvizv4/icon/Icon-general-2-Subscriptions_grey.svg`"){kind=icon}
"
- }
+ $mgLinkedSubsCount = ((($optimizedTableForPathQuery | Where-Object { $_.MgId -eq $mgChild -and -not [String]::IsNullOrEmpty($_.SubscriptionId) }).SubscriptionId | Get-Unique) | measure-object).count
+ $subscriptionsOutOfScopelinkedCount = ($outOfScopeSubscriptions | Where-Object { $_.ManagementGroupId -eq $mgChild } | Measure-Object).count
+ if ($mgLinkedSubsCount -gt 0 -and $subscriptionsOutOfScopelinkedCount -eq 0) {
+ $subInfo = "$mgLinkedSubsCount"
+ }
+ if ($mgLinkedSubsCount -gt 0 -and $subscriptionsOutOfScopelinkedCount -gt 0) {
+ $subInfo = "$mgLinkedSubsCount $subscriptionsOutOfScopelinkedCount"
+ }
+ if ($mgLinkedSubsCount -eq 0 -and $subscriptionsOutOfScopelinkedCount -gt 0) {
+ $subInfo = "$subscriptionsOutOfScopelinkedCount"
+ }
+ if ($mgLinkedSubsCount -eq 0 -and $subscriptionsOutOfScopelinkedCount -eq 0) {
+ $subInfo = ""
+ }
- if ($mgName -eq $mgId) {
- $mgNameAndOrId = "$($mgName -replace "<", "<" -replace ">", ">")"
- }
- else {
- $mgNameAndOrId = "$($mgName -replace "<", "<" -replace ">", ">") ($mgId)"
- }
+ if ($mgName -eq $mgId) {
+ $mgNameAndOrId = "$($mgName -replace "<", "<" -replace ">", ">")"
+ }
+ else {
+ $mgNameAndOrId = "$($mgName -replace "<", "<" -replace ">", ">") ($mgId)"
+ }
- $script:html += @"
+ $script:html += @"
$servicePrincipalsOfTypeApplicationCount AAD ServicePrincipals type=Application
+"@) + } + + $endAADSPCredExpiryLoop = get-date + Write-Host " TenantSummary AAD SP Apps CredExpiry processing duration: $((NEW-TIMESPAN -Start $startAADSPCredExpiryLoop -End $endAADSPCredExpiryLoop).TotalMinutes) minutes ($((NEW-TIMESPAN -Start $startAADSPCredExpiryLoop -End $endAADSPCredExpiryLoop).TotalSeconds) seconds)" } else { [void]$htmlTenantSummary.AppendLine(@" -$servicePrincipalsOfTypeApplicationCount AAD ServicePrincipals type=Application
+No information on AAD ServicePrincipals type=Application as Guest account does not have enough permissions
"@) } - - $endAADSPCredExpiryLoop = get-date - Write-Host " TenantSummary AAD SP Apps CredExpiry processing duration: $((NEW-TIMESPAN -Start $startAADSPCredExpiryLoop -End $endAADSPCredExpiryLoop).TotalMinutes) minutes ($((NEW-TIMESPAN -Start $startAADSPCredExpiryLoop -End $endAADSPCredExpiryLoop).TotalSeconds) seconds)" #endregion AADSPCredExpiry #region AADSPExternalSP @@ -19718,17 +19754,40 @@ createBearerToken -targetEndPoint "MSGraphAPI" $arrayAPICallTracking = [System.Collections.ArrayList]::Synchronized((New-Object System.Collections.ArrayList)) $arrayAPICallTrackingCustomDataCollection = [System.Collections.ArrayList]::Synchronized((New-Object System.Collections.ArrayList)) + + + #region validationAccess #validation / check 'Microsoft Graph API' Access $permissionCheckResults = @() -#todo -#guest user ?? + +$userType = "n/a" +if ($accountType -eq "User") { + $currentTask = "Checking AAD UserType" + Write-Host $currentTask + $uri = "$(($htAzureEnvironmentRelatedUrls).($checkContext.Environment.Name).MSGraphUrl)/v1.0/me?`$select=userType" + $method = "GET" + $checkUserType = AzAPICall -uri $uri -method $method -listenOn "Content" -currentTask $currentTask + if ($checkUserType -eq "unknown") { + $userType = $checkUserType + } + else { + $userType = $checkUserType.userType + } + Write-Host " AAD UserType: $($userType)" -ForegroundColor Yellow +} +$htParameters.userType = $userType + + if ($htParameters.AzureDevOpsWikiAsCode -eq $true -or $accountType -eq "ServicePrincipal") { - Write-Host "Checking AzDO ServicePrincipal permissions" - + + if ($htParameters.AzureDevOpsWikiAsCode -eq $true -or $accountType -eq "ServicePrincipal") { + Write-Host "Checking ServicePrincipal permissions" + } $permissionsCheckFailed = $false + $currentTask = "Test AAD Users Read permission" $uri = "$(($htAzureEnvironmentRelatedUrls).($checkContext.Environment.Name).MSGraphUrl)/v1.0/users?`$count=true&`$top=1" $method = "GET" @@ -19741,6 +19800,7 @@ if ($htParameters.AzureDevOpsWikiAsCode -eq $true -or $accountType -eq "ServiceP $permissionCheckResults += "AAD Users Read permission check PASSED" } + $currentTask = "Test AAD Groups Read permission" $uri = "$(($htAzureEnvironmentRelatedUrls).($checkContext.Environment.Name).MSGraphUrl)/v1.0/groups?`$count=true&`$top=1" $method = "GET" @@ -19763,7 +19823,7 @@ if ($htParameters.AzureDevOpsWikiAsCode -eq $true -or $accountType -eq "ServiceP } else { $permissionCheckResults += "AAD ServicePrincipals Read permission check PASSED" - } + } } #endregion validationAccess @@ -19924,6 +19984,7 @@ if ($accountType -eq "User") { } #> +<# $userType = "n/a" if ($accountType -eq "User") { $currentTask = "Checking AAD UserType" @@ -19939,6 +20000,7 @@ if ($accountType -eq "User") { } Write-Host " AAD UserType: $($userType)" -ForegroundColor Yellow } +#> $newTable = [System.Collections.ArrayList]::Synchronized((New-Object System.Collections.ArrayList)) @@ -20238,6 +20300,15 @@ if ($htParameters.HierarchyMapOnly -eq $false) { $paramsUsed += "NoScopeInsights: false " } + if ($NoSingleSubscriptionOutput) { + Write-Host " No single Subscription output will not be created (-NoSingleSubscriptionOutput = $($NoSingleSubscriptionOutput))" -ForegroundColor Green + $paramsUsed += "NoSingleSubscriptionOutput: true " + } + else { + Write-Host " Single Subscription output will be created (-NoSingleSubscriptionOutput = $($NoSingleSubscriptionOutput))" -ForegroundColor Yellow + $paramsUsed += "NoSingleSubscriptionOutput: false " + } + if ($NoResourceProvidersDetailed -eq $true) { Write-Host " ResourceProvider Detailed for TenantSummary disabled (-NoResourceProvidersDetailed = $($NoResourceProvidersDetailed))" -ForegroundColor Green $paramsUsed += "NoResourceProvidersDetailed: $($NoResourceProvidersDetailed) " @@ -20464,6 +20535,7 @@ if ($htParameters.HierarchyMapOnly -eq $false) { $htNamingValidation.ManagementGroup = @{} #[System.Collections.Hashtable]::Synchronized((New-Object System.Collections.Hashtable)) #@{} $htPrincipals = [System.Collections.Hashtable]::Synchronized((New-Object System.Collections.Hashtable)) #@{} $htServicePrincipals = [System.Collections.Hashtable]::Synchronized((New-Object System.Collections.Hashtable)) #@{} + $htDailySummary = @{} #subscriptions $startGetSubscriptions = get-date @@ -20803,6 +20875,7 @@ if ($htParameters.HierarchyMapOnly -eq $false) { $htAzureEnvironmentRelatedUrls = $using:htAzureEnvironmentRelatedUrls $htBearerAccessToken = $using:htBearerAccessToken #Array&HTs + $htParameters = $using:htParameters $arrayAPICallTracking = $using:arrayAPICallTracking $allConsumptionData = $using:allConsumptionData $htSubscriptionsMgPath = $using:htSubscriptionsMgPath @@ -20983,6 +21056,7 @@ if ($htParameters.HierarchyMapOnly -eq $false) { $htAzureEnvironmentRelatedUrls = $using:htAzureEnvironmentRelatedUrls $htBearerAccessToken = $using:htBearerAccessToken #Array&HTs + $htParameters = $using:htParameters $arrayAPICallTracking = $using:arrayAPICallTracking $htSubscriptionsMgPath = $using:htSubscriptionsMgPath $htAllSubscriptionsFromAPI = $using:htAllSubscriptionsFromAPI @@ -21205,7 +21279,6 @@ if ($htParameters.HierarchyMapOnly -eq $false) { $requestPolicyDefinitionAPI = AzAPICall -uri $uri -method $method -currentTask $currentTask Write-Host " $($requestPolicyDefinitionAPI.Count) BuiltIn PolicyDefinitions returned by API" $builtinPolicyDefinitions = $requestPolicyDefinitionAPI.where( { $_.properties.policyType -eq "BuiltIn" } ) - Write-Host " $($builtinPolicyDefinitions.Count) BuiltIn PolicyDefinitions API filtered by BuiltIn" $builtInPolicyDefinitionsCount = $builtinPolicyDefinitions.Count foreach ($builtinPolicyDefinition in $builtinPolicyDefinitions) { @@ -21280,8 +21353,6 @@ if ($htParameters.HierarchyMapOnly -eq $false) { ($htCacheDefinitionsPolicy).(($builtinPolicyDefinition.Id).ToLower()).RoleDefinitionIds = "n/a" } } - Write-Host " ht $(($htCacheDefinitionsPolicy).Keys.Count) BuiltIn PolicyDefinitions" - #test $currentTask = "Caching built-in PolicySet definitions" Write-Host " $currentTask" @@ -21322,7 +21393,6 @@ if ($htParameters.HierarchyMapOnly -eq $false) { } ($htCacheDefinitionsPolicySet).(($builtinPolicySetDefinition.Id).ToLower()).Json = $builtinPolicySetDefinition } - Write-Host " ht $(($htCacheDefinitionsPolicySet).Keys.Count) BuiltIn PolicySetDefinitions" $currentTask = "Caching built-in Role definitions" Write-Host " $currentTask" @@ -21344,7 +21414,6 @@ if ($htParameters.HierarchyMapOnly -eq $false) { ($htCacheDefinitionsRole).($roleDefinition.name).Json = ($roleDefinition.properties) ($htCacheDefinitionsRole).($roleDefinition.name).LinkToAzAdvertizer = "$($roleDefinition.properties.roleName)" } - Write-Host " ht $(($htCacheDefinitionsRole).Keys.Count) BuiltIn RoleDefinitions" $endDefinitionsCaching = get-date Write-Host "Caching built-in definitions duration: $((NEW-TIMESPAN -Start $startDefinitionsCaching -End $endDefinitionsCaching).TotalSeconds) seconds" @@ -22037,10 +22106,6 @@ if ($htParameters.HierarchyMapOnly -eq $false) { } } } - #test - if ($cnty -gt 0) { - #Write-Host "$cnty / $cntx added as guest" - } } $script:htAADGroupsDetails.($aadGroupId).MembersAllCount = $aadGroupMembersAllCount @@ -22093,6 +22158,7 @@ if ($htParameters.HierarchyMapOnly -eq $false) { $htAzureEnvironmentRelatedUrls = $using:htAzureEnvironmentRelatedUrls $htBearerAccessToken = $using:htBearerAccessToken #Array&HTs + $htParameters = $using:htParameters $htAADGroupsDetails = $using:htAADGroupsDetails $arrayGroupRoleAssignmentsOnServicePrincipals = $using:arrayGroupRoleAssignmentsOnServicePrincipals $arrayGroupRequestResourceNotFound = $using:arrayGroupRequestResourceNotFound @@ -22167,120 +22233,143 @@ if ($htParameters.HierarchyMapOnly -eq $false) { } #endregion dataprocessingAADGroups - #region NewAppSecret/Key and MI - Write-Host "Processing Service Principals (Applications and Managed Identities)" - $startSPAppMI = get-date - $htAppDetails = [System.Collections.Hashtable]::Synchronized((New-Object System.Collections.Hashtable)) #@{} - $currentDateUTC = (Get-Date).ToUniversalTime() - $arrayApplicationRequestResourceNotFound = [System.Collections.ArrayList]::Synchronized((New-Object System.Collections.ArrayList)) + #region Application + Write-Host "Processing Service Principals - Applications" $servicePrincipalsOfTypeApplication = $htServicePrincipals.Keys.where( { $htServicePrincipals.($_).servicePrincipalType -eq "Application" -and $htServicePrincipals.($_).appOwnerOrganizationId -eq $checkContext.Subscription.TenantId } ) - $servicePrincipalsOfTypeApplication | ForEach-Object -Parallel { - - #region UsingVARs - $currentDateUTC = $using:currentDateUTC - #fromOtherFunctions - $arrayAzureManagementEndPointUrls = $using:arrayAzureManagementEndPointUrls - $checkContext = $using:checkContext - $htAzureEnvironmentRelatedUrls = $using:htAzureEnvironmentRelatedUrls - $htBearerAccessToken = $using:htBearerAccessToken - #Array&HTs - $arrayApplicationRequestResourceNotFound = $using:arrayApplicationRequestResourceNotFound - $htAppDetails = $using:htAppDetails - $htServicePrincipals = $using:htServicePrincipals - #$arrayProgressedServicePrincipals = $using:arrayProgressedServicePrincipals - $arrayAPICallTracking = $using:arrayAPICallTracking - #$indicator = $using:indicator - #Functions - $function:AzAPICall = $using:funcAzAPICall - $function:createBearerToken = $using:funcCreateBearerToken - $function:GetJWTDetails = $using:funcGetJWTDetails - #endregion UsingVARs - - $sp = $htServicePrincipals.($_) - - $currentTask = "getApp $($sp.appId)" - $uri = "$(($htAzureEnvironmentRelatedUrls).($checkContext.Environment.Name).MSGraphUrl)/v1.0/applications?`$filter=appId eq '$($sp.appId)'" + if ($UserType -eq "Guest") { + #testing if Guest has enough permissions + $app4Test = $htServicePrincipals.($servicePrincipalsOfTypeApplication[0]) + $currentTask = "getApp Test $($app4Test.appId)" + $uri = "$(($htAzureEnvironmentRelatedUrls).($checkContext.Environment.Name).MSGraphUrl)/v1.0/applications?`$filter=appId eq '$($app4Test.appId)'" $method = "GET" - $getApplication = AzAPICall -uri $uri -method $method -currentTask $currentTask -getApp $true + $testGetApplication = AzAPICall -uri $uri -method $method -currentTask $currentTask -getApp $true + if ($testGetApplication -eq "skipApplications") { + $skipApplications = $true + Write-Host " Guest account does not have enough permissions, skipping Applications (Secrets & Certificates)" + } + } + if (-not $skipApplications) { + $startSPApp = get-date + $htAppDetails = [System.Collections.Hashtable]::Synchronized((New-Object System.Collections.Hashtable)) #@{} + $currentDateUTC = (Get-Date).ToUniversalTime() + $arrayApplicationRequestResourceNotFound = [System.Collections.ArrayList]::Synchronized((New-Object System.Collections.ArrayList)) + $servicePrincipalsOfTypeApplication | ForEach-Object -Parallel { + + #region UsingVARs + $currentDateUTC = $using:currentDateUTC + #fromOtherFunctions + $arrayAzureManagementEndPointUrls = $using:arrayAzureManagementEndPointUrls + $checkContext = $using:checkContext + $htAzureEnvironmentRelatedUrls = $using:htAzureEnvironmentRelatedUrls + $htBearerAccessToken = $using:htBearerAccessToken + #Array&HTs + $htParameters = $using:htParameters + $arrayApplicationRequestResourceNotFound = $using:arrayApplicationRequestResourceNotFound + $htAppDetails = $using:htAppDetails + $htServicePrincipals = $using:htServicePrincipals + #$arrayProgressedServicePrincipals = $using:arrayProgressedServicePrincipals + $arrayAPICallTracking = $using:arrayAPICallTracking + #$indicator = $using:indicator + #Functions + $function:AzAPICall = $using:funcAzAPICall + $function:createBearerToken = $using:funcCreateBearerToken + $function:GetJWTDetails = $using:funcGetJWTDetails + #endregion UsingVARs + + $sp = $htServicePrincipals.($_) + + $currentTask = "getApp $($sp.appId)" + $uri = "$(($htAzureEnvironmentRelatedUrls).($checkContext.Environment.Name).MSGraphUrl)/v1.0/applications?`$filter=appId eq '$($sp.appId)'" + $method = "GET" + $getApplication = AzAPICall -uri $uri -method $method -currentTask $currentTask -getApp $true - if ($getApplication -eq "Request_ResourceNotFound") { - $null = $arrayApplicationRequestResourceNotFound.Add([PSCustomObject]@{ - appId = $sp.appId - }) - } - else { - if (($getApplication | Measure-Object).Count -eq 0) { - Write-Host "$($sp.appId) no data returned / seems non existent?" + if ($getApplication -eq "Request_ResourceNotFound") { + $null = $arrayApplicationRequestResourceNotFound.Add([PSCustomObject]@{ + appId = $sp.appId + }) } else { - $script:htAppDetails.($sp.id) = @{} - $script:htAppDetails.($sp.id).servicePrincipalType = $sp.servicePrincipalType - $script:htAppDetails.($sp.id).spGraphDetails = $sp - $script:htAppDetails.($sp.id).appGraphDetails = $getApplication - - $appPasswordCredentialsCount = ($getApplication.passwordCredentials | Measure-Object).count - if ($appPasswordCredentialsCount -gt 0) { - $script:htAppDetails.($sp.id).appPasswordCredentialsCount = $appPasswordCredentialsCount - $appPasswordCredentialsExpiredCount = 0 - $appPasswordCredentialsGracePeriodExpiryCount = 0 - $appPasswordCredentialsExpiryOKCount = 0 - $appPasswordCredentialsExpiryOKMoreThan2YearsCount = 0 - foreach ($appPasswordCredential in $getApplication.passwordCredentials) { - $passwordExpiryTotalDays = (NEW-TIMESPAN -Start $currentDateUTC -End $appPasswordCredential.endDateTime).TotalDays - if ($passwordExpiryTotalDays -lt 0) { - $appPasswordCredentialsExpiredCount++ - } - elseif ($passwordExpiryTotalDays -lt $AADServicePrincipalExpiryWarningDays) { - $appPasswordCredentialsGracePeriodExpiryCount++ - } - else { - if ($passwordExpiryTotalDays -gt 730) { - $appPasswordCredentialsExpiryOKMoreThan2YearsCount++ + if (($getApplication).Count -eq 0) { + Write-Host "$($sp.appId) no data returned / seems non existent?" + } + else { + $script:htAppDetails.($sp.id) = @{} + $script:htAppDetails.($sp.id).servicePrincipalType = $sp.servicePrincipalType + $script:htAppDetails.($sp.id).spGraphDetails = $sp + $script:htAppDetails.($sp.id).appGraphDetails = $getApplication + + $appPasswordCredentialsCount = ($getApplication.passwordCredentials).count + if ($appPasswordCredentialsCount -gt 0) { + $script:htAppDetails.($sp.id).appPasswordCredentialsCount = $appPasswordCredentialsCount + $appPasswordCredentialsExpiredCount = 0 + $appPasswordCredentialsGracePeriodExpiryCount = 0 + $appPasswordCredentialsExpiryOKCount = 0 + $appPasswordCredentialsExpiryOKMoreThan2YearsCount = 0 + foreach ($appPasswordCredential in $getApplication.passwordCredentials) { + $passwordExpiryTotalDays = (NEW-TIMESPAN -Start $currentDateUTC -End $appPasswordCredential.endDateTime).TotalDays + if ($passwordExpiryTotalDays -lt 0) { + $appPasswordCredentialsExpiredCount++ + } + elseif ($passwordExpiryTotalDays -lt $AADServicePrincipalExpiryWarningDays) { + $appPasswordCredentialsGracePeriodExpiryCount++ } else { - $appPasswordCredentialsExpiryOKCount++ + if ($passwordExpiryTotalDays -gt 730) { + $appPasswordCredentialsExpiryOKMoreThan2YearsCount++ + } + else { + $appPasswordCredentialsExpiryOKCount++ + } } } + $script:htAppDetails.($sp.id).appPasswordCredentialsExpiredCount = $appPasswordCredentialsExpiredCount + $script:htAppDetails.($sp.id).appPasswordCredentialsGracePeriodExpiryCount = $appPasswordCredentialsGracePeriodExpiryCount + $script:htAppDetails.($sp.id).appPasswordCredentialsExpiryOKCount = $appPasswordCredentialsExpiryOKCount + $script:htAppDetails.($sp.id).appPasswordCredentialsExpiryOKMoreThan2YearsCount = $appPasswordCredentialsExpiryOKMoreThan2YearsCount } - $script:htAppDetails.($sp.id).appPasswordCredentialsExpiredCount = $appPasswordCredentialsExpiredCount - $script:htAppDetails.($sp.id).appPasswordCredentialsGracePeriodExpiryCount = $appPasswordCredentialsGracePeriodExpiryCount - $script:htAppDetails.($sp.id).appPasswordCredentialsExpiryOKCount = $appPasswordCredentialsExpiryOKCount - $script:htAppDetails.($sp.id).appPasswordCredentialsExpiryOKMoreThan2YearsCount = $appPasswordCredentialsExpiryOKMoreThan2YearsCount - } - - $appKeyCredentialsCount = ($getApplication.keyCredentials | Measure-Object).count - if ($appKeyCredentialsCount -gt 0) { - $script:htAppDetails.($sp.id).appKeyCredentialsCount = $appKeyCredentialsCount - $appKeyCredentialsExpiredCount = 0 - $appKeyCredentialsGracePeriodExpiryCount = 0 - $appKeyCredentialsExpiryOKCount = 0 - $appKeyCredentialsExpiryOKMoreThan2YearsCount = 0 - foreach ($appKeyCredential in $getApplication.keyCredentials) { - $keyCredentialExpiryTotalDays = (NEW-TIMESPAN -Start $currentDateUTC -End $appKeyCredential.endDateTime).TotalDays - if ($keyCredentialExpiryTotalDays -lt 0) { - $appKeyCredentialsExpiredCount++ - } - elseif ($keyCredentialExpiryTotalDays -lt $AADServicePrincipalExpiryWarningDays) { - $appKeyCredentialsGracePeriodExpiryCount++ - } - else { - if ($keyCredentialExpiryTotalDays -gt 730) { - $appKeyCredentialsExpiryOKMoreThan2YearsCount++ + + $appKeyCredentialsCount = ($getApplication.keyCredentials | Measure-Object).count + if ($appKeyCredentialsCount -gt 0) { + $script:htAppDetails.($sp.id).appKeyCredentialsCount = $appKeyCredentialsCount + $appKeyCredentialsExpiredCount = 0 + $appKeyCredentialsGracePeriodExpiryCount = 0 + $appKeyCredentialsExpiryOKCount = 0 + $appKeyCredentialsExpiryOKMoreThan2YearsCount = 0 + foreach ($appKeyCredential in $getApplication.keyCredentials) { + $keyCredentialExpiryTotalDays = (NEW-TIMESPAN -Start $currentDateUTC -End $appKeyCredential.endDateTime).TotalDays + if ($keyCredentialExpiryTotalDays -lt 0) { + $appKeyCredentialsExpiredCount++ + } + elseif ($keyCredentialExpiryTotalDays -lt $AADServicePrincipalExpiryWarningDays) { + $appKeyCredentialsGracePeriodExpiryCount++ } else { - $appKeyCredentialsExpiryOKCount++ + if ($keyCredentialExpiryTotalDays -gt 730) { + $appKeyCredentialsExpiryOKMoreThan2YearsCount++ + } + else { + $appKeyCredentialsExpiryOKCount++ + } } } + $script:htAppDetails.($sp.id).appKeyCredentialsExpiredCount = $appKeyCredentialsExpiredCount + $script:htAppDetails.($sp.id).appKeyCredentialsGracePeriodExpiryCount = $appKeyCredentialsGracePeriodExpiryCount + $script:htAppDetails.($sp.id).appKeyCredentialsExpiryOKCount = $appKeyCredentialsExpiryOKCount + $script:htAppDetails.($sp.id).appKeyCredentialsExpiryOKMoreThan2YearsCount = $appKeyCredentialsExpiryOKMoreThan2YearsCount } - $script:htAppDetails.($sp.id).appKeyCredentialsExpiredCount = $appKeyCredentialsExpiredCount - $script:htAppDetails.($sp.id).appKeyCredentialsGracePeriodExpiryCount = $appKeyCredentialsGracePeriodExpiryCount - $script:htAppDetails.($sp.id).appKeyCredentialsExpiryOKCount = $appKeyCredentialsExpiryOKCount - $script:htAppDetails.($sp.id).appKeyCredentialsExpiryOKMoreThan2YearsCount = $appKeyCredentialsExpiryOKMoreThan2YearsCount } } - } - } -Throttlelimit ($ThrottleLimit * 2) + + } -Throttlelimit ($ThrottleLimit * 2) + + $endSPApp = get-date + Write-Host "Processing Service Principals - Applications duration: $((NEW-TIMESPAN -Start $startSPApp -End $endSPApp).TotalMinutes) minutes ($((NEW-TIMESPAN -Start $startSPApp -End $endSPApp).TotalSeconds) seconds)" + } + #endregion Application + #region ManagedIdentity + Write-Host "Processing Service Principals - Managed Identities" + $startSPMI = get-date $htManagedIdentityForPolicyAssignment = @{} $htPolicyAssignmentManagedIdentity = @{} $htManagedIdentityDisplayName = @{} @@ -22304,9 +22393,9 @@ if ($htParameters.HierarchyMapOnly -eq $false) { } } } - $endSPAppMI = get-date - Write-Host "Processing Service Principals (Applications and Managed Identities) duration: $((NEW-TIMESPAN -Start $startSPAppMI -End $endSPAppMI).TotalMinutes) minutes ($((NEW-TIMESPAN -Start $startSPAppMI -End $endSPAppMI).TotalSeconds) seconds)" - #endregion NewAppSecret/Key and MI + $endSPMI = get-date + Write-Host "Processing Service Principals - Managed Identities duration: $((NEW-TIMESPAN -Start $startSPMI -End $endSPMI).TotalMinutes) minutes ($((NEW-TIMESPAN -Start $startSPMI -End $endSPMI).TotalSeconds) seconds)" + #endregion ManagedIdentity #resourcesAll $resourcesAllGroupedBySubcriptionId = $resourcesAll | group-object -property subscriptionId @@ -22362,12 +22451,12 @@ if ($htParameters.HierarchyMapOnly -eq $false) { $htAzureEnvironmentRelatedUrls = $using:htAzureEnvironmentRelatedUrls $htBearerAccessToken = $using:htBearerAccessToken #Array&HTs + $htParameters = $using:htParameters $ExludedResourceTypesDiagnosticsCapable = $using:ExludedResourceTypesDiagnosticsCapable $resourceTypesDiagnosticsArray = $using:resourceTypesDiagnosticsArray $htResourceTypesUniqueResource = $using:htResourceTypesUniqueResource $resourceTypesSummarizedArray = $using:resourceTypesSummarizedArray $arrayAPICallTracking = $using:arrayAPICallTracking - $htParameters = $using:htParameters #Functions $function:AzAPICallDiag = $using:funcAzAPICallDiag $function:createBearerToken = $using:funcCreateBearerToken @@ -22496,7 +22585,7 @@ if ($htParameters.HierarchyMapOnly -eq $false) { #region BuildHTML #testhelper -#$fileTimestamp = (get-date -format $FileTimeStampFormat) +$fileTimestamp = (get-date -format $FileTimeStampFormat) $startBuildHTML = get-date Write-Host "Building HTML" @@ -22796,30 +22885,84 @@ if ($htParameters.HierarchyMapOnly -eq $false) { $totalResourceTypesCount = ($resourceTypesDiagnosticsArray).Count Write-Host " Total Management Groups: $totalMgCount (depth $mgDepth)" + $htDailySummary."ManagementGroups" = $totalMgCount Write-Host " Total Subscriptions: $totalSubIncludedAndExcludedCount ($totalSubCount included; $totalSubOutOfScopeCount out-of-scope)" + $htDailySummary."Subscriptions" = $totalSubCount + $htDailySummary."SubscriptionsOutOfScope" = $totalSubOutOfScopeCount Write-Host " Total Custom Policy definitions: $tenantCustomPoliciesCount" + $htDailySummary."PolicyDefinitionsCustom" = $tenantCustomPoliciesCount Write-Host " Total Custom PolicySet definitions: $tenantCustompolicySetsCount" + $htDailySummary."PolicySetDefinitionsCustom" = $tenantCustompolicySetsCount Write-Host " Total Policy assignments: $($totalPolicyAssignmentsCount)" + $htDailySummary."PolicyAssignments" = $totalPolicyAssignmentsCount Write-Host " Total Policy assignments ManagementGroups $($totalPolicyAssignmentsCountMg)" + $htDailySummary."PolicyAssignments_ManagementGroups" = $totalPolicyAssignmentsCountMg Write-Host " Total Policy assignments Subscriptions $($totalPolicyAssignmentsCountSub)" + $htDailySummary."PolicyAssignments_Subscriptions" = $totalPolicyAssignmentsCountSub Write-Host " Total Policy assignments ResourceGroups: $($totalPolicyAssignmentsCountRg)" + $htDailySummary."PolicyAssignments_ResourceGroups" = $totalPolicyAssignmentsCountRg Write-Host " Total Custom Role definitions: $totalRoleDefinitionsCustomCount" + $htDailySummary."RoleDefinitionsCustom" = $totalRoleDefinitionsCustomCount Write-Host " Total Role assignments: $totalRoleAssignmentsCount" + $htDailySummary."TotalRoleAssignments" = $totalRoleAssignmentsCount Write-Host " Total Role assignments (Tenant): $totalRoleAssignmentsCountTen" + $htDailySummary."TotalRoleAssignments_Tenant" = $totalRoleAssignmentsCountTen Write-Host " Total Role assignments (ManagementGroups): $totalRoleAssignmentsCountMG" + $htDailySummary."TotalRoleAssignments_ManagementGroups" = $totalRoleAssignmentsCountMG Write-Host " Total Role assignments (Subscriptions): $totalRoleAssignmentsCountSub" + $htDailySummary."TotalRoleAssignments_Subscriptions" = $totalRoleAssignmentsCountSub Write-Host " Total Role assignments (ResourceGroups and Resources): $totalRoleAssignmentsResourceGroupsAndResourcesCount" + $htDailySummary."TotalRoleAssignments_RgRes" = $totalRoleAssignmentsResourceGroupsAndResourcesCount Write-Host " Total Blueprint definitions: $totalBlueprintDefinitionsCount" + $htDailySummary."Blueprints" = $totalBlueprintDefinitionsCount Write-Host " Total Blueprint assignments: $totalBlueprintAssignmentsCount" + $htDailySummary."BlueprintAssignments" = $totalBlueprintAssignmentsCount Write-Host " Total Resources: $totalResourceCount" + $htDailySummary."Resources" = $totalResourceCount Write-Host " Total Resource Types: $totalResourceTypesCount" + $htDailySummary."ResourceTypes" = $totalResourceTypesCount + + $rbacUnique = $rbacAll | Sort-Object -Property RoleAssignmentId -Unique + $rbacUniqueObjectIds = $rbacUnique | Sort-Object -Property ObjectId -Unique + $rbacUniqueObjectIdsNonPIM = $rbacUnique.where( { $_.RoleAssignmentPIMRelated -eq $false } ) | Sort-Object -Property ObjectId -Unique + $rbacUniqueObjectIdsPIM = $rbacUnique.where( { $_.RoleAssignmentPIMRelated -eq $true } ) | Sort-Object -Property ObjectId -Unique + + if ($rbacUniqueObjectIds.Count -gt 0) { + $rbacUniqueObjectIdsGrouped = $rbacUniqueObjectIds | Group-Object -Property ObjectType + foreach ($principalType in $rbacUniqueObjectIdsGrouped) { + #Write-Host "$($principalType.Name): $($principalType.Count)" + $htDailySummary."TotalUniquePrincipalWithPermission_$($principalType.Name)" = $principalType.Count + } + $htDailySummary."TotalUniquePrincipalWithPermission_SP" = $rbacUniqueObjectIds.where( { $_.ObjectType -like "SP*" } ).count + $htDailySummary."TotalUniquePrincipalWithPermission_User" = $rbacUniqueObjectIds.where( { $_.ObjectType -like "User*" } ).count + } + + if ($rbacUniqueObjectIdsNonPIM.Count -gt 0) { + $rbacUniqueObjectIdsNonPIMGrouped = $rbacUniqueObjectIdsNonPIM | Group-Object -Property ObjectType + foreach ($principalType in $rbacUniqueObjectIdsNonPIMGrouped) { + #Write-Host "$($principalType.Name): $($principalType.Count)" + $htDailySummary."TotalUniquePrincipalWithPermissionStatic_$($principalType.Name)" = $principalType.Count + } + $htDailySummary."TotalUniquePrincipalWithPermissionStatic_SP" = $rbacUniqueObjectIdsNonPIM.where( { $_.ObjectType -like "SP*" } ).count + $htDailySummary."TotalUniquePrincipalWithPermissionStatic_User" = $rbacUniqueObjectIdsNonPIM.where( { $_.ObjectType -like "User*" } ).count + } + + if ($rbacUniqueObjectIdsPIM.Count -gt 0) { + $rbacUniqueObjectIdsPIMGrouped = $rbacUniqueObjectIdsPIM | Group-Object -Property ObjectType + foreach ($principalType in $rbacUniqueObjectIdsPIMGrouped) { + #Write-Host "$($principalType.Name): $($principalType.Count)" + $htDailySummary."TotalUniquePrincipalWithPermissionPIM_$($principalType.Name)" = $principalType.Count + } + $htDailySummary."TotalUniquePrincipalWithPermissionPIM_SP" = $rbacUniqueObjectIdsPIM.where( { $_.ObjectType -like "SP*" } ).count + $htDailySummary."TotalUniquePrincipalWithPermissionPIM_User" = $rbacUniqueObjectIdsPIM.where( { $_.ObjectType -like "User*" } ).count + } $endSummarizeDataCollectionResults = get-date Write-Host " Summary data collection duration: $((NEW-TIMESPAN -Start $startSummarizeDataCollectionResults -End $endSummarizeDataCollectionResults).TotalSeconds) seconds" #endregion summarizeDataCollectionResults } -$html += @" +$html = @" @@ -22952,9 +23095,70 @@ $html += @" document.body.removeChild(link); } + +"@ +if ($htParameters.HierarchyMapOnly -eq $false) { + if (-not $NoSingleSubscriptionOutput) { - + if ($AzureDevOpsWikiAsCode) { + $HTMLPath = "HTML-Subscriptions_$($ManagementGroupId)" + if (Test-Path -LiteralPath "$($outputPath)$($DirectorySeparatorChar)$($HTMLPath)") { + Write-Host " Cleaning old state (Pipeline only)" + Remove-Item -Recurse -Force "$($outputPath)$($DirectorySeparatorChar)$($HTMLPath)" + } + } + else { + $HTMLPath = "HTML-Subscriptions_$($ManagementGroupId)_$($fileTimestamp)" + Write-Host " Creating new state ($($HTMLPath)) (local only))" + } + + $null = new-item -Name $HTMLPath -ItemType directory -path $outputPath + + $htmlSubscriptionOnlyStart = $html + $htmlSubscriptionOnlyStart += @" + + +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+"@
+
+ $htmlSubscriptionOnlyEnd = @"
+
+
+ ScopeInsights
+