microsoftgraph / microsoftgraph/msgraph-sdk-powershell
Get-MgBetaIdentityConditionalAccessPolicy does not return ExcludeGuestsOrExternalUsers "members"
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 898
- Forks
- 230
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 31
Description
Describe the bug
I want to create a conditional access policy that excludes a specific service provider, to generate the required JSON body I created the policy in the user interface and fetched the policy via Get-MgBetaIdentityConditionalAccessPolicy. However, the Microsoft.Graph.Beta.PowerShell.Models.MicrosoftGraphConditionalAccessPolicy does not contain the "members" property and values. I was able to find the body I need by using the -debug parameter. I suspect this issue affects include and exclude for more than just serviceproviders but have not confirmed that.
"excludeGuestsOrExternalUsers": {
"guestOrExternalUserTypes": "serviceProvider",
"externalTenants": {
"@odata.type": "#microsoft.graph.conditionalAccessEnumeratedExternalTenants",
"membershipKind": "enumerated",
"members": [
"xxxxxxxxx-xxxx-xxxx-xxxxx-xxxxxxxxxxxxx"
]
}
}
Expected behavior
The Microsoft.Graph.Beta.PowerShell.Models.MicrosoftGraphConditionalAccessPolicy object should contain the excluded members.
How to reproduce
- Using the entra ID portal, create a conditional access policy with an excluded service provider
- Run the command $p = Get-MgBetaIdentityConditionalAccessPolicy -id
- Look for the tenantID that was excluded and you will see that it is not present. It should be at:
$p.conditions.users.ExcludeGuestsOrExternalUsers
SDK Version
2.24.0
Latest version known to work for scenario above?
No response
Known Workarounds
None
Debug output
Click to expand log
```</details>
### Configuration
Name Value
---- -----
PSVersion 7.4.3
PSEdition Core
GitCommitId 7.4.3
OS Microsoft Windows 10.0.14393
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
### Other information
No other information
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with Get-MgBetaIdentityConditionalAccessPolicy on a policy excluding a service provider, then inspect $p.conditions.users.ExcludeGuestsOrExternalUsers and compare it with the debug JSON. The work is done when the MicrosoftGraphConditionalAccessPolicy object exposes the excluded external-tenant members and the returned value matches the policy response.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, powershell
- Domain
- api, backend-api-design
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100