microsoftgraph / microsoftgraph/msgraph-sdk-powershell

Get-MgBetaIdentityConditionalAccessPolicy does not return ExcludeGuestsOrExternalUsers "members"

Open
#3,011 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Status: Needs Investigation
Dominant language
C#
Stars
898
Forks
230
Avg merge
2d 5h
Merged PRs (30d)
31

Description

Describe the bug

I want to create a conditional access policy that excludes a specific service provider, to generate the required JSON body I created the policy in the user interface and fetched the policy via Get-MgBetaIdentityConditionalAccessPolicy. However, the Microsoft.Graph.Beta.PowerShell.Models.MicrosoftGraphConditionalAccessPolicy does not contain the "members" property and values. I was able to find the body I need by using the -debug parameter. I suspect this issue affects include and exclude for more than just serviceproviders but have not confirmed that.

"excludeGuestsOrExternalUsers": {
        "guestOrExternalUserTypes": "serviceProvider",
        "externalTenants": {
          "@odata.type": "#microsoft.graph.conditionalAccessEnumeratedExternalTenants",
          "membershipKind": "enumerated",
          "members": [
            "xxxxxxxxx-xxxx-xxxx-xxxxx-xxxxxxxxxxxxx"
          ]
        }
      }
Expected behavior

The Microsoft.Graph.Beta.PowerShell.Models.MicrosoftGraphConditionalAccessPolicy object should contain the excluded members.

How to reproduce
  1. Using the entra ID portal, create a conditional access policy with an excluded service provider
  2. Run the command $p = Get-MgBetaIdentityConditionalAccessPolicy -id
  3. Look for the tenantID that was excluded and you will see that it is not present. It should be at:
    $p.conditions.users.ExcludeGuestsOrExternalUsers
SDK Version

2.24.0

Latest version known to work for scenario above?

No response

Known Workarounds

None

Debug output
Click to expand log ```
</details>


### Configuration

Name                           Value
----                           -----
PSVersion                      7.4.3
PSEdition                      Core
GitCommitId                    7.4.3
OS                             Microsoft Windows 10.0.14393
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

### Other information
No other information

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with Get-MgBetaIdentityConditionalAccessPolicy on a policy excluding a service provider, then inspect $p.conditions.users.ExcludeGuestsOrExternalUsers and compare it with the debug JSON. The work is done when the MicrosoftGraphConditionalAccessPolicy object exposes the excluded external-tenant members and the returned value matches the policy response.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, powershell
Domain
api, backend-api-design
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.