Entra: read the tenant's licences once and skip the gated steps with one message - #43
Merged
Merged
Conversation
…gated steps with one message Get-EntraCapability reads the subscribed SKUs when the connection is established and records Known, EntraP1 and EntraP2 on it. New-EntraEnvironment skips Conditional Access policies without P1 and role eligibilities without P2, once, with one warning naming the licence and the step, instead of nine policy refusals and three eligibility warnings that each said the same thing in Graph's words; each skipped step carries its Reason. -IncludeUnlicensed attempts them regardless, and a tenant whose SKUs cannot be read gets every step as before. The report and the verifier stop asking for eligibilities a tenant without P2 cannot hold. Teardown deliberately ignores the probe. Verified live against the lab tenant: Known, no P1, no P2; one warning; both steps Skipped with their reasons; the verifier's warning gone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #42 (which is stacked on #41).
What
Get-EntraCapabilityreads/subscribedSkusinsideConnect-EntraEnvironmentand recordsCapabilitieson the connection:Known,EntraP1,EntraP2(P2 or Governance),Plans. A plan counts only on an enabled SKU and when provisioned.New-EntraEnvironmentthen skips Conditional Access policies without P1 and role eligibilities without P2 with one warning naming the licence and the step, instead of nine policy refusals and three eligibility warnings that each said the same thing in Graph's words. Each skipped step carries aReasonin the result (-Skipones say so too).-IncludeUnlicensedattempts them regardless.The rule that keeps this safe:
Known = $false(the app could not read the SKUs) means every step runs, as before. The probe can remove noise; it can never remove a step the tenant would have run. The report and the verifier stop asking Graph for eligibilities a tenant without P2 cannot hold, so the one read Graph refuses is never made. Teardown deliberately ignores the probe: a tenant whose P2 lapsed may still hold eligibilities Graph will not show.Live
Against the lab tenant:
Known=True P1=False P2=False, one warning, both stepsSkippedwith their reasons, the verifier's eligibility warning gone.Gates
Unit suite 2,623 passed shuffled on 7 (1 skipped) and 2,624 on 5.1, 0 failed. Analyzer clean. New suite
Get-EntraCapability.Tests.ps1; aLicencecontext inNew-EntraEnvironment.Tests.ps1; cases in the Entra report and verifier suites. Entra README, CHANGELOG, Tests/README and a CLAUDE.md invariant.