fix: exclude Managed Identities from application ownership checks

Co-authored-by: Copilot <copilot@github.com>

Author: sandeepjha000

src/powershell/private/tests-shared/Get-ApplicationsWithInsufficientOwners.ps1

@@ -18,13 +18,11 @@ function Get-ApplicationsWithInsufficientOwners {
         [string[]]$PrivilegeLevel
     )
 
-    # Get apps with permissions, pre-filtered to Application type only to avoid enriching non-ownable types (e.g. Managed Identities)
-    $allApps = Get-ApplicationsWithPermissions -Database $Database -ServicePrincipalType 'Application'
+    # Get all apps with permissions, excluding Managed Identities before enrichment as owners cannot be assigned to them
+    $allApps = Get-ApplicationsWithPermissions -Database $Database -ExcludeServicePrincipalType 'ManagedIdentity'
 
-    # Filter the retrieved applications by privilege level and owner count
-    $filteredApps = $allApps | Where-Object {
-        ($PrivilegeLevel -contains $_.Risk) -and ($_.OwnerCount -lt 2)
-    }
+    # Filter by privilege level and owner count
+    $filteredApps = $allApps | Where-Object {($PrivilegeLevel -contains $_.Risk) -and ($_.OwnerCount -lt 2)}
 
     Write-PSFMessage "Filtered to $($filteredApps.Count) applications with < 2 owners matching privilege levels: $($PrivilegeLevel -join ', ')" -Level Verbose
 

src/powershell/private/tests-shared/Get-ApplicationsWithPermissions.ps1

@@ -15,7 +15,8 @@ function Get-ApplicationsWithPermissions {
         $Database,
 
         [Parameter()]
-        [string[]]$ServicePrincipalType
+        [ValidateSet('Application', 'ManagedIdentity', 'Legacy', 'ServiceIdentity')]
+        [string[]]$ExcludeServicePrincipalType
     )
 
     # Query ServicePrincipal objects with permissions
@@ -54,10 +55,10 @@ order by spsi.lastSignInActivity.lastSignInDateTime
         return @()
     }
 
-    # Optionally filter by servicePrincipalType before enrichment to avoid unnecessary per-item DB calls
-    if ($ServicePrincipalType) {
-        $results = $results | Where-Object { $ServicePrincipalType -contains $_.servicePrincipalType }
-        Write-PSFMessage "Pre-filtered to $($results.Count) service principals of type(s): $($ServicePrincipalType -join ', ')" -Level Verbose
+    # Exclude specified service principal types before enrichment to avoid unnecessary per-item DB calls
+    if ($ExcludeServicePrincipalType) {
+        $results = $results | Where-Object { $ExcludeServicePrincipalType -notcontains $_.servicePrincipalType }
+        Write-PSFMessage "Excluded $($ExcludeServicePrincipalType -join ', ') type(s), $($results.Count) service principals remaining" -Level Verbose
     }
 
     # Enrich each app with permissions and risk classification (using Test-21770 pattern)