Conditional Access target resources
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8e37c97 · +27 −14 lines · also on GitHub
⋯ 227 unchanged lines
228228
)
229229
230230
# Pull oauth2PermissionGrants (paging)
231
−$uri = "https://graph.microsoft.com/beta/oauth2PermissionGrants?`$select=clientId,scope"
231
+$uri = "https://graph.microsoft.com/beta/oauth2PermissionGrants?`$select=clientId,scope,consentType"
232232
$grants = @()
233233
while ($uri) {
234234
$resp = Invoke-MgGraphRequest -Method GET -Uri $uri
⋯ 3 unchanged lines
238238
239239
# Build baseline-only candidate set (paste-safe: no leading pipes)
240240
$candidates = @()
241
−foreach ($g in ($grants | Group-Object clientId)) {
242
− $spObjectId = $g.Name
243241
244
− $scopes = $g.Group |
245
− ForEach-Object { ($_.scope -split '\s+') } |
246
− Where-Object { $_ -and $_.Trim() -ne "" } |
247
− Sort-Object -Unique
242
+$scopesByClient = @{} # key: clientId string, value: HashSet[string]
243
+foreach ($g in $grants) {
244
+ $cid = $g.clientId.ToString().Trim()
248245
249
− if ($scopes.Count -gt 0) {
250
− $outside = $scopes | Where-Object { $_ -notin $BaselineScopes }
251
− if ($outside.Count -eq 0) {
252
− $candidates += [PSCustomObject]@{
253
− ServicePrincipalObjectId = $spObjectId
254
− Scopes = ($scopes -join " ")
255
− }
246
+ if (-not $scopesByClient.ContainsKey($cid)) {
247
+ # Use HashSet for fast add + uniqueness
248
+ $scopesByClient[$cid] = [System.Collections.Generic.HashSet[string]]::new(
249
+ [System.StringComparer]::OrdinalIgnoreCase
250
+ )
251
+ }
252
+
253
+ foreach ($s in ($g.scope -split '\s+')) {
254
+ if ($s -and $s.Trim().Length -gt 0) {
255
+ [void]$scopesByClient[$cid].Add($s.Trim())
256
+ }
257
+ }
258
+}
259
+
260
+$candidates = foreach ($cid in $scopesByClient.Keys) {
261
+ $scopes = $scopesByClient[$cid]
262
+
263
+ # Outside baseline?
264
+ $outside = $scopes | Where-Object { $_ -notin $BaselineScopes }
265
+ if ($outside.Count -eq 0 -and $scopes.Count -gt 0) {
266
+ [PSCustomObject]@{
267
+ ServicePrincipalObjectId = $cid
268
+ Scopes = ($scopes -join ' ')
256269
}
257270
}
258271
}
⋯ 157 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:32 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.