Add custom xtap cmdlets

src/Identity.SignIns/beta/custom/ConvertTo-EntraXTAPFlatOutput.ps1

@@ -0,0 +1,195 @@
+# ----------------------------------------------------------------------------------
+#
+# Copyright Microsoft Corporation
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ----------------------------------------------------------------------------------
+
+<#
+.Synopsis
+    Internal helper: projects a CrossTenantAccessPolicy API response into the flat
+    parameter-aligned output shape shared by the *-DefaultEntraXTAP and
+    *-PartnerEntraXTAP cmdlets.
+
+.Description
+    Decodes the nested TargetConfiguration model back into the flat property names
+    that match the new cmdlet input parameters:
+
+    Default mode (IsPartner = $false): emits Id + flat properties.
+    Partner mode (IsPartner = $true):  emits PartnerTenantId + flat properties.
+
+    Output property mapping:
+      M365CollaborationInbound.Users.accessType         → M365CollaborationInbound  ("Allowed"|"Blocked")
+      M365CollaborationInbound.Users.targets[user]      → M365CollaborationInboundTargetUsers
+      M365CollaborationOutbound.UsersAndGroups.accessType → M365CollaborationOutbound ("Allowed"|"Blocked")
+      M365CollaborationOutbound.UsersAndGroups.targets[user]  → M365CollaborationOutboundTargetUsers
+      M365CollaborationOutbound.UsersAndGroups.targets[group] → M365CollaborationOutboundTargetGroups
+      AppServiceConnectInbound.Applications.accessType  → AppServiceConnectInbound  ("Allowed"|"Blocked")
+      AppServiceConnectInbound.Applications.targets[application] → AppServiceConnectInboundTargetApplications
+#>
+function ConvertTo-EntraXTAPFlatOutput {
+    param(
+        [Parameter(Mandatory = $true)]
+        $Result,
+
+        [Parameter()]
+        [switch]
+        $IsPartner
+    )
+
+    # Helper: capitalise first letter of accessType for enum output ("allowed" → "Allowed")
+    function Format-AccessType {
+        param([string]$Value)
+        if ([string]::IsNullOrEmpty($Value)) { return $null }
+        return [System.Globalization.CultureInfo]::InvariantCulture.TextInfo.ToTitleCase($Value.ToLower())
+    }
+
+    # Helper: extract target IDs from a TargetConfiguration for a given targetType.
+    function Get-TargetIds {
+        param($Config, [string]$TargetType)
+        if ($null -eq $Config -or $null -eq $Config.Targets) { return $null }
+        $ids = @($Config.Targets | Where-Object { $_.TargetType -eq $TargetType } | ForEach-Object { $_.Target })
+        if ($ids.Count -eq 0) { return $null }
+        return $ids
+    }
+
+    # ------------------------------------------------------------------
+    # M365CollaborationInbound  →  .Users  (user targets only)
+    # ------------------------------------------------------------------
+    $inboundConfig        = if ($null -ne $Result.M365CollaborationInbound) { $Result.M365CollaborationInbound.Users } else { $null }
+    $inboundAccessType    = if ($null -ne $inboundConfig) { Format-AccessType $inboundConfig.AccessType } else { $null }
+    $inboundUsers         = if ($null -ne $inboundConfig) { Get-TargetIds -Config $inboundConfig -TargetType 'user' } else { $null }
+
+    # ------------------------------------------------------------------
+    # M365CollaborationOutbound  →  .UsersAndGroups  (user + group)
+    # ------------------------------------------------------------------
+    $outboundConfig       = if ($null -ne $Result.M365CollaborationOutbound) { $Result.M365CollaborationOutbound.UsersAndGroups } else { $null }
+    $outboundAccessType   = if ($null -ne $outboundConfig) { Format-AccessType $outboundConfig.AccessType } else { $null }
+    $outboundUsers        = if ($null -ne $outboundConfig) { Get-TargetIds -Config $outboundConfig -TargetType 'user'  } else { $null }
+    $outboundGroups       = if ($null -ne $outboundConfig) { Get-TargetIds -Config $outboundConfig -TargetType 'group' } else { $null }
+
+    # ------------------------------------------------------------------
+    # AppServiceConnectInbound  →  .Applications  (application targets)
+    # ------------------------------------------------------------------
+    $appConfig            = if ($null -ne $Result.AppServiceConnectInbound) { $Result.AppServiceConnectInbound.Applications } else { $null }
+    $appAccessType        = if ($null -ne $appConfig) { Format-AccessType $appConfig.AccessType } else { $null }
+    $appIds               = if ($null -ne $appConfig) { Get-TargetIds -Config $appConfig -TargetType 'application' } else { $null }
+
+    # ------------------------------------------------------------------
+    # Emit flat output — property names match cmdlet input parameters.
+    # ------------------------------------------------------------------
+    if ($IsPartner) {
+        [PSCustomObject]@{
+            PartnerTenantId                      = $Result.TenantId
+            M365CollaborationInbound             = $inboundAccessType
+            M365CollaborationInboundTargetUsers        = $inboundUsers
+            M365CollaborationOutbound            = $outboundAccessType
+            M365CollaborationOutboundTargetUsers       = $outboundUsers
+            M365CollaborationOutboundTargetGroups      = $outboundGroups
+            AppServiceConnectInbound             = $appAccessType
+            AppServiceConnectInboundTargetApplications = $appIds
+        }
+    } else {
+        [PSCustomObject]@{
+            Id                                   = $Result.Id
+            IsServiceDefault                     = $Result.IsServiceDefault
+            M365CollaborationInbound             = $inboundAccessType
+            M365CollaborationInboundTargetUsers        = $inboundUsers
+            M365CollaborationOutbound            = $outboundAccessType
+            M365CollaborationOutboundTargetUsers       = $outboundUsers
+            M365CollaborationOutboundTargetGroups      = $outboundGroups
+            AppServiceConnectInbound             = $appAccessType
+            AppServiceConnectInboundTargetApplications = $appIds
+        }
+    }
+}
+
+<#
+.Synopsis
+    Internal helper: projects a M365CapabilityBase API response into the flat
+    parameter-aligned output shape shared by the *-DefaultM365XTAPCapability and
+    *-PartnerM365XTAPCapability cmdlets.
+
+.Description
+    Decodes the nested M365CapabilityInboundAccess model back into the flat
+    property names that match the cmdlet input parameters:
+
+      InboundAccess.IsAllowed        → IsAllowed
+      InboundAccess.ResourceScopes
+        .Included[ResourceType=user]  → IncludedUsers
+        .Included[ResourceType=group] → IncludedGroups
+        .Excluded[ResourceType=user]  → ExcludedUsers
+        .Excluded[ResourceType=group] → ExcludedGroups
+
+    Default mode (IsPartner = $false):
+      Emits CapabilityId, LastModifiedDateTime, IsAllowed, Included/Excluded Users/Groups.
+
+    Partner mode (IsPartner = $true):
+      Prepends PartnerTenantId before CapabilityId.
+#>
+function ConvertTo-EntraXTAPM365CapabilityFlatOutput {
+    param(
+        [Parameter(Mandatory = $true)]
+        $Result,
+
+        [Parameter()]
+        [switch]
+        $IsPartner
+    )
+
+    # ------------------------------------------------------------------
+    # Helper: extract resource IDs from a scope array for a given type.
+    # ------------------------------------------------------------------
+    function Get-ScopeIds {
+        param($Scopes, [string]$ResourceType)
+        if ($null -eq $Scopes) { return $null }
+        $ids = @($Scopes | Where-Object { $_.ResourceType -eq $ResourceType } | ForEach-Object { $_.ResourceId })
+        if ($ids.Count -eq 0) { return $null }
+        return $ids
+    }
+
+    $inbound        = $Result.InboundAccess
+    $isAllowed      = if ($null -ne $inbound) { $inbound.IsAllowed } else { $null }
+    $includedUsers  = $null
+    $includedGroups = $null
+    $excludedUsers  = $null
+    $excludedGroups = $null
+
+    if ($null -ne $inbound -and $null -ne $inbound.ResourceScopes) {
+        $includedUsers  = Get-ScopeIds -Scopes $inbound.ResourceScopes.Included -ResourceType 'user'
+        $includedGroups = Get-ScopeIds -Scopes $inbound.ResourceScopes.Included -ResourceType 'group'
+        $excludedUsers  = Get-ScopeIds -Scopes $inbound.ResourceScopes.Excluded -ResourceType 'user'
+        $excludedGroups = Get-ScopeIds -Scopes $inbound.ResourceScopes.Excluded -ResourceType 'group'
+    }
+
+    if ($IsPartner) {
+        [PSCustomObject]@{
+            PartnerTenantId      = $Result.AdditionalProperties['tenantId']
+            CapabilityId         = $Result.Name
+            LastModifiedDateTime = $Result.LastModifiedDateTime
+            IsAllowed            = $isAllowed
+            IncludedUsers        = $includedUsers
+            IncludedGroups       = $includedGroups
+            ExcludedUsers        = $excludedUsers
+            ExcludedGroups       = $excludedGroups
+        }
+    } else {
+        [PSCustomObject]@{
+            CapabilityId         = $Result.Name
+            LastModifiedDateTime = $Result.LastModifiedDateTime
+            IsAllowed            = $isAllowed
+            IncludedUsers        = $includedUsers
+            IncludedGroups       = $includedGroups
+            ExcludedUsers        = $excludedUsers
+            ExcludedGroups       = $excludedGroups
+        }
+    }
+}
+

src/Identity.SignIns/beta/custom/Get-DefaultEntraXTAP.ps1

@@ -0,0 +1,107 @@
+# ----------------------------------------------------------------------------------
+#
+# Copyright Microsoft Corporation
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ----------------------------------------------------------------------------------
+
+<#
+.Synopsis
+    Gets the M365 Collaboration and App Service Connect settings from the tenant-wide
+    default Cross-Tenant Access Policy (XTAP) configuration.
+
+.Description
+    Provides a flattened, user-friendly interface over
+    Get-MgBetaPolicyCrossTenantAccessPolicyDefault.
+
+    The default configuration is a singleton — there is exactly one per tenant.
+    This cmdlet scopes the output to the three properties that are configurable
+    via Update-DefaultEntraXTAP:
+
+      - M365CollaborationInbound    (inbound user access)
+      - M365CollaborationOutbound   (outbound users and groups access)
+      - AppServiceConnectInbound    (inbound application access)
+
+    All other properties (B2B, InboundTrust, TenantRestrictions, etc.) are excluded
+    from both the API request ($select) and the output object.
+
+.Example
+    # Get the default M365 Collaboration and App Service Connect settings
+    Get-DefaultEntraXTAP
+
+.Outputs
+    Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphCrossTenantAccessPolicyConfigurationDefault
+
+.Link
+    https://learn.microsoft.com/en-us/graph/api/crosstenantaccesspolicydefaultconfiguration-get
+    https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.beta.identity.signins/get-mgbetapolicycrosstenantaccesspolicydefault
+#>
+function Get-DefaultEntraXTAP {
+    [OutputType([Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphCrossTenantAccessPolicyConfigurationDefault])]
+    [CmdletBinding(DefaultParameterSetName = 'Get',
+                   PositionalBinding = $false)]
+    param(
+
+        # ── Pipeline / runtime ────────────────────────────────────────────
+        [Parameter(DontShow)]
+        [Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
+        [System.Management.Automation.SwitchParameter]
+        ${Break},
+
+        [Parameter(DontShow)]
+        [ValidateNotNull()]
+        [Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
+        [Microsoft.Graph.Beta.PowerShell.Runtime.SendAsyncStep[]]
+        ${HttpPipelineAppend},
+
+        [Parameter(DontShow)]
+        [ValidateNotNull()]
+        [Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
+        [Microsoft.Graph.Beta.PowerShell.Runtime.SendAsyncStep[]]
+        ${HttpPipelinePrepend},
+
+        [Parameter(DontShow)]
+        [Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
+        [System.Uri]
+        ${Proxy},
+
+        [Parameter(DontShow)]
+        [ValidateNotNull()]
+        [Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
+        [System.Management.Automation.PSCredential]
+        ${ProxyCredential},
+
+        [Parameter(DontShow)]
+        [Microsoft.Graph.Beta.PowerShell.Category('Runtime')]
+        [System.Management.Automation.SwitchParameter]
+        ${ProxyUseDefaultCredentials}
+    )
+
+    begin {
+    }
+
+    process {
+        # Request only the three properties exposed by Update-DefaultEntraXTAP.
+        $selectProps = 'id', 'isServiceDefault', 'm365CollaborationInbound', 'm365CollaborationOutbound', 'appServiceConnectInbound'
+
+        Write-Verbose "Getting default XTAP configuration (scoped to M365Collaboration and AppServiceConnect)."
+
+        $result = Get-MgBetaPolicyCrossTenantAccessPolicyDefault `
+            -Property $selectProps `
+            @PSBoundParameters
+
+        if ($null -eq $result) { return }
+
+        ConvertTo-EntraXTAPFlatOutput -Result $result
+    }
+
+    end {
+    }
+}