Add CustomSecurityAttributes column to ServicePrincipal table (#1055)

Author: alexandair

src/powershell/assets/export-tenant.config.psd1

@@ -87,7 +87,7 @@ Note: Avoid using the same names as used for the "General Parameters" section of
 @{
 	Name = 'ServicePrincipal'
 	Uri = 'beta/servicePrincipals'
-	QueryString = '$expand=appRoleAssignments&$top=999'
+	QueryString = '$expand=appRoleAssignments&$top=999&$select=id,deletedDateTime,accountEnabled,alternativeNames,createdByAppId,createdDateTime,deviceManagementAppType,appDescription,appDisplayName,appId,applicationTemplateId,appOwnerOrganizationId,appRoleAssignmentRequired,assignmentRequiredForPrincipalTypes,description,disabledByMicrosoftStatus,displayName,errorUrl,homepage,isAuthorizationServiceEnabled,isDisabled,isManagementRestricted,loginUrl,logoutUrl,notes,notificationEmailAddresses,preferredSingleSignOnMode,preferredTokenSigningKeyEndDateTime,preferredTokenSigningKeyThumbprint,publisherName,replyUrls,samlMetadataUrl,samlSLOBindingType,servicePrincipalNames,servicePrincipalType,signInAudience,tags,tokenEncryptionKeyId,certification,samlSingleSignOnSettings,addIns,api,appRoles,info,keyCredentials,publishedPermissionScopes,passwordCredentials,resourceSpecificApplicationPermissions,verifiedPublisher,customSecurityAttributes'
 	RelatedPropertyNames = @('oauth2PermissionGrants')
 	Type = 'Default' # PrivilegedGroup
 

src/powershell/doc/readme.md

@@ -54,8 +54,11 @@ optionally to Azure. When connecting using Microsoft Graph PowerShell, the follo
 
 The consent prompt is only displayed if the Graph PowerShell app does not already have these permissions.
 
+> **Note:** To read Custom Security Attributes on service principals, the account running the assessment must also be assigned the **Attribute Assignment Reader** (or **Attribute Assignment Administrator**) Entra ID role. Without this role, Custom Security Attribute values will be returned as null.
+
 - AuditLog.Read.All
 - CrossTenantInformation.ReadBasic.All
+- CustomSecAttributeAssignment.Read.All
 - DeviceManagementApps.Read.All
 - DeviceManagementConfiguration.Read.All
 - DeviceManagementManagedDevices.Read.All

src/powershell/private/db/content/Get-TableSchemaConfig.ps1

@@ -23,6 +23,11 @@ function Get-TableSchemaConfig {
     )
 
     $configs = @{
+        'ServicePrincipal' = @{
+            'use_union_by_name' = $true
+            'sample_size' = 50
+            'reason' = 'customSecurityAttributes is an open complex type with varying nested keys across service principals'
+        }
         'ServicePrincipalSignIn' = @{
             'use_union_by_name' = $true
             'sample_size' = 50  # Sample more files to avoid schema inference issues

src/powershell/public/Get-ZtGraphScope.ps1

@@ -34,6 +34,7 @@ Function Get-ZtGraphScope {
     $scopes = @( #IMPORTANT: Read note above before adding any new scopes.
         'AuditLog.Read.All'
         'CrossTenantInformation.ReadBasic.All'
+        'CustomSecAttributeAssignment.Read.All'
         'DeviceManagementApps.Read.All'
         'DeviceManagementConfiguration.Read.All'
         'DeviceManagementManagedDevices.Read.All'