Skip to content

Update Remediate-InvalidAADObjectRoleAssignments.ps1 #477

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fume wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update Remediate-InvalidAADObjectRoleAssignments.ps1 #477

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions Scripts/RemediationScripts/Remediate-InvalidAADObjectRoleAssignments.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,9 +53,9 @@ function Pre_requisites
This command would check pre requisites modules to perform remediation.
#>

Write-Host "Required modules are: Az.Resources, AzureAD, Az.Accounts" -ForegroundColor Cyan
Write-Host "Required modules are: Az.Resources, AzureAD (or AzureADPreview), Az.Accounts, Az.ResourceGraph" -ForegroundColor Cyan
Copy link
Contributor

@asimks asimks Oct 17, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is Az.ResourceGraph really being used? @MJaithra could you confirm

Copy link
Contributor

@MJaithra MJaithra Oct 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, the module Az.ResourceGraph is being used

Write-Host "Checking for required modules..."
$availableModules = $(Get-Module -ListAvailable Az.Resources, AzureAD, Az.Accounts)
$availableModules = $(Get-Module -ListAvailable Az.Resources, AzureAD, AzureADPreview, Az.Accounts, Az.ResourceGraph)

# Checking if 'Az.Accounts' module is available or not.
if($availableModules.Name -notcontains 'Az.Accounts')
Expand Down Expand Up @@ -83,15 +83,15 @@ function Pre_requisites
if($availableModules.Name -notcontains 'Az.ResourceGraph')
{
Write-Host "Installing module Az.ResourceGraph..." -ForegroundColor Yellow
Install-Module -Name AzureAD -Scope CurrentUser -Repository 'PSGallery'
Install-Module -Name Az.ResourceGraph -Scope CurrentUser -Repository 'PSGallery'
}
else
{
Write-Host "Az.ResourceGraph module is available." -ForegroundColor Green
}

# Checking if 'AzureAD' module is available or not.
if($availableModules.Name -notcontains 'AzureAD')
# Checking if 'AzureAD' or 'AzureADPreview' module is available or not.
if(($availableModules.Name -notcontains 'AzureAD') -and ($availableModules.Name -notcontains 'AzureADPreview'))
Copy link
Contributor

@asimks asimks Oct 17, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is any command being used which might be present in AzureAd but not in preview package. @MJaithra could you please check

Copy link
Contributor

@MJaithra MJaithra Oct 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, a few commands, such as Get-AzureADTenantDetail and Get-AzureADObjectByObjectId are being used in this script which are available in the AzureAD module but not in the preview package.

To resolve this, we can force the installation of the AzureAD module, which will allow us to install it even if the preview module exists. Additionally, using the -Prefix parameter when importing the module can help prevent confusion between commands that are common to both modules.

Copy link
Contributor

@asimks asimks Oct 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So above code needs to be modified to support the installation of the AzureAD module even if preview is available

Copy link
Author

@fume fume Nov 7, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI, both the commands you mentioned are present in AzureADPreview

https://learn.microsoft.com/en-us/powershell/module/AzureAD/get-azureadtenantdetail?view=azureadps-2.0-preview

https://learn.microsoft.com/en-us/powershell/module/azuread/get-azureadobjectbyobjectid?view=azureadps-2.0-preview

{
Write-Host "Installing module AzureAD..." -ForegroundColor Yellow
Install-Module -Name AzureAD -Scope CurrentUser -Repository 'PSGallery'
Expand Down Expand Up @@ -687,4 +687,4 @@ Remove-AzTSInvalidAADAccounts -SubscriptionId '<Sub_Id>' `
Note:
1. Set '-DryRun' as '$true' for pre-check, if you want to validate role assignments before remediation.
2. If you want to perform remediation only for DryRun output, use '-FilePath' parameter and set '-DryRun' as 'False'.
#>
#>