PowerShell Script to get Conditional Access Properties

Question

I have the below script that gets users (pull UPNs) exempted from all conditional access policies and I am trying to then get assigned admin roles (Any role, permanent or eligible) to those users only.&nbsp;NB. This is the specific part I need help with. Otherwise the rest of the script pulls other information I need.$allpolicies = Get-AzureADMSConditionalAccessPolicy | Where-Object {$_.State -ne 'Disabled' }
$allpolicies | ForEach-Object {

# Loop through each conditional access policy and get which users are excluded from each policy and their directory roles
    
    foreach($user in ($_.Conditions).Users.ExcludeUsers){
    $upn = (Get-AzureADUser -ObjectId $user).userPrincipalName
# Get the Azure roles assigned to the user
    $roles = Get-AzureADDirectoryRole
    foreach($role in $roles) {
    Get-AzureADDirectoryRoleMember  -ObjectId $upn.userPrincipalName | select @{e={$role.userPrincipalName}}, userPrincipalName}

New-object -typename PSobject -property @{
            ID                           = $_.Id
            DisplayName                  = $_.DisplayName
            Policy_State                 = $_.State
            TargetType                   = 'User'
            TargetName                   = $upn
            AzureADRoles                 = $roles

}

}
}&nbsp;I get the below error message from the script:&nbsp;Get-AzureADDirectoryRoleMember : Cannot bind argument to parameter 'ObjectId' because it is null.At line:29 char:47+ ... -AzureADDirectoryRoleMember -ObjectId $upn.userPrincipalName | selec ...+ ~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo : InvalidData: (:) [Get-AzureADDirectoryRoleMember], ParameterBindingValidationException+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.Open.AzureAD16.PowerShell.GetAzureADDirectoryRoleMembers&nbsp;&nbsp;I can tell I am not using the correct parameters and or arguments with the&nbsp;Get-AzureADDirectoryRoleMember. Any assistance is welcome

raviraj_nallasivam · Answer

Thabs15&nbsp;Hi$upn = (Get-AzureADUser -ObjectId $user).userPrincipalNameIn the above line, it fetches the userPrincipalName and assigns to $upn string variable.Get-AzureADDirectoryRoleMember  -ObjectId $upn.userPrincipalName | select @{e={$role.userPrincipalName}}, userPrincipalName}In the above line, you are accessing the userPrincipalName from $upn string variable.&nbsp;&nbsp;Get-AzureADDirectoryRoleMember : Cannot bind argument to parameter 'ObjectId' because it is null.At line:29 char:47+ ... -AzureADDirectoryRoleMember -ObjectId $upn.userPrincipalName | selec ...+ ~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo : InvalidData: (:) [Get-AzureADDirectoryRoleMember], ParameterBindingValidationException+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.Open.AzureAD16.PowerShell.GetAzureADDirectoryRoleMembers&nbsp;Because $upn is a string variable and accessing it as object, it is passed as null to Get-AzureADDirectoryRoleMember -ObjectId parameter. &nbsp;Replace $upn.userPrincipalName to $upn in line number 11.&nbsp;Please mark answer as "Best Response" if it solves your problem.&nbsp;RegardsRaviraj.&nbsp;

thabs15 · Answer

Raviraj_Nallasivam&nbsp;&nbsp;Thank you for your response&nbsp;I tried your suggestion and I now get the error message below which I have been looking up to see if I can figure it out.&nbsp;# Loop through each conditional access policy and get which users are excluded from each policy and their directory roles
    
    foreach($user in ($_.Conditions).Users.ExcludeUsers){
    $upn = (Get-AzureADUser -ObjectId $user).userPrincipalName
    $roles = Get-AzureADDirectoryRole | Where-Object {$_.displayName -eq $role}
    Get-AzureADDirectoryRoleMember -ObjectId $upn | Where-Object {$_.TargetName -eq $upn}

New-object -typename PSobject -property @{
            ID                           = $_.Id
            DisplayName                  = $_.DisplayName
            Policy_State                 = $_.State
            TargetType                   = 'User'
            TargetName                   = $upn
            AzureADRoles                 = $roles​
        }

}&nbsp;Get-AzureADDirectoryRoleMember : Error occurred while executing GetAzureADDirectoryRoleMembersCode: Request_BadRequestMessage: Invalid object identifier '&lt;help&gt;example_account&lt;/help&gt;@contoso.com'.RequestId: 290*9ff6-***-4883-8a52-***DateTimeStamp: Thu, 23 Mar 2023 13:31:48 GMTHttpStatusCode: BadRequestHttpStatusDescription: Bad RequestHttpResponseStatus: CompletedAt line:28 char:5+ &nbsp; &nbsp; Get-AzureADDirectoryRoleMember -ObjectId $upn | Where-Object {$_. ...+ &nbsp; &nbsp; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~&nbsp; &nbsp; + CategoryInfo &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: NotSpecified: (:) [Get-AzureADDirectoryRoleMember], ApiException&nbsp; &nbsp; + FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetAzureADDirectoryRoleMembers&nbsp;Note: I retracted the color text

Forum Discussion

PowerShell Script to get Conditional Access Properties

2 Replies

Resources