functions/general/Get-TmfRequiredScope.ps1
|
function Get-TmfRequiredScope { <# .SYNOPSIS Returns required Microsoft Graph permission scopes. .DESCRIPTION Depending on the resources you want to configure, different Microsoft Graph permission scopes are required. This command returns the required scopes. .PARAMETER All Return all scopes that TMF requires. .PARAMETER Groups Return all scopes required for managing group-resources. .PARAMETER Users Return all scopes required for managing user-resources. .PARAMETER NamedLocations Return all scopes required for managing namedLocation-resources. .PARAMETER Agreements Return all scopes required for managing agreement-resources. .PARAMETER ConditionalAccessPolicies Return all scopes required for managing conditionalAccessPolicy-resources. .PARAMETER ConditionalAccessPolicies Return all scopes required for managing administrativeUnit-resources. .EXAMPLE PS> Connect-MgGraph -Scopes (Get-TMFRequiredScope -Groups) Requests access to Microsoft Graph with all required scopes for changes to group-resources. .EXAMPLE PS> Connect-MgGraph -Scopes (Get-TMFRequiredScope -All) Requests access to Microsoft Graph with access to all resources the TMF can handle. #> [CmdletBinding(DefaultParameterSetName = 'All')] Param ( [Parameter(ParameterSetName = "SpecifiedComponents")] [switch] $AccessReviews, [Parameter(ParameterSetName = "SpecifiedComponents")] [switch] $RoleManagement, [Parameter(ParameterSetName = "SpecifiedComponents")] [switch] $Groups, [Parameter(ParameterSetName = "SpecifiedComponents")] [switch] $Users, [Parameter(ParameterSetName = "SpecifiedComponents")] [switch] $NamedLocations, [Parameter(ParameterSetName = "SpecifiedComponents")] [switch] $Agreements, [Parameter(ParameterSetName = "SpecifiedComponents")] [switch] $ConditionalAccessPolicies, [Parameter(ParameterSetName = "SpecifiedComponents")] [switch] $EntitlementManagement, [Parameter(ParameterSetName = "SpecifiedComponents")] [switch] $AdministrativeUnits, [Parameter(ParameterSetName = "SpecifiedComponents")] [switch] $Policies, [Parameter(ParameterSetName = "All")] [switch] $All ) begin { [string[]] $scopes = @() } process { if($AccessReviews -or $All) { $scopes += "Group.Read.All", "AccessReview.ReadWrite.All", "RoleManagement.Read.Directory", "Directory.Read.All", "Directory.AccessAsUser.All" } if($RoleManagement -or $All) { $scopes += "RoleManagement.ReadWrite.Directory", "Directory.AccessAsUser.All", "RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.Directory","RoleManagementPolicy.ReadWrite.AzureADGroup" } if ($Groups -or $All) { $scopes += "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "Directory.ReadWrite.All", "Directory.AccessAsUser.All" } if ($Users -or $All) { $scopes += "User.ReadWrite.All" } if ($NamedLocations -or $All) { $scopes += "Policy.ReadWrite.ConditionalAccess" } if ($Agreements -or $All) { $scopes += "Agreement.ReadWrite.All" } if ($ConditionalAccessPolicies -or $All) { $scopes += "Policy.ReadWrite.ConditionalAccess", "Policy.Read.All", "RoleManagement.Read.Directory", "Application.Read.All", "Agreement.Read.All", "Group.Read.All" } if ($EntitlementManagement -or $All) { $scopes += "EntitlementManagement.ReadWrite.All" } if ($AdministrativeUnits -or $All) { $scopes += "AdministrativeUnit.ReadWrite.All", "Directory.AccessAsUser.All", "RoleManagement.ReadWrite.Directory" } if ($Policies -or $All) { $scopes += "Policy.ReadWrite.AuthenticationMethod", "Policy.ReadWrite.Authorization", "Policy.ReadWrite.AuthenticationFlows" } return ($scopes | Sort-Object -Unique) } } |