pre-filter service principal type before enrichment to improve performance

Co-authored-by: Copilot <copilot@github.com>

Author: sandeepjha000

src/powershell/private/tests-shared/Get-ApplicationsWithInsufficientOwners.ps1

@@ -18,13 +18,12 @@ function Get-ApplicationsWithInsufficientOwners {
         [string[]]$PrivilegeLevel
     )
 
-    # Get all apps with permissions
-    $allApps = Get-ApplicationsWithPermissions -Database $Database
+    # Get apps with permissions, pre-filtered to Application type only to avoid enriching non-ownable types (e.g. Managed Identities)
+    $allApps = Get-ApplicationsWithPermissions -Database $Database -ServicePrincipalType 'Application'
 
-    # Filter by privilege level and owner count using Where-Object (more efficient)
-    # Only include Application type
+    # Filter the retrieved applications by privilege level and owner count
     $filteredApps = $allApps | Where-Object {
-        ($PrivilegeLevel -contains $_.Risk) -and ($_.OwnerCount -lt 2) -and ($_.servicePrincipalType -eq 'Application')
+        ($PrivilegeLevel -contains $_.Risk) -and ($_.OwnerCount -lt 2)
     }
 
     Write-PSFMessage "Filtered to $($filteredApps.Count) applications with < 2 owners matching privilege levels: $($PrivilegeLevel -join ', ')" -Level Verbose

src/powershell/private/tests-shared/Get-ApplicationsWithPermissions.ps1

@@ -12,7 +12,10 @@ function Get-ApplicationsWithPermissions {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory = $true)]
-        $Database
+        $Database,
+
+        [Parameter()]
+        [string[]]$ServicePrincipalType
     )
 
     # Query ServicePrincipal objects with permissions
@@ -51,6 +54,12 @@ order by spsi.lastSignInActivity.lastSignInDateTime
         return @()
     }
 
+    # Optionally filter by servicePrincipalType before enrichment to avoid unnecessary per-item DB calls
+    if ($ServicePrincipalType) {
+        $results = $results | Where-Object { $ServicePrincipalType -contains $_.servicePrincipalType }
+        Write-PSFMessage "Pre-filtered to $($results.Count) service principals of type(s): $($ServicePrincipalType -join ', ')" -Level Verbose
+    }
+
     # Enrich each app with permissions and risk classification (using Test-21770 pattern)
     $enrichedApps = @()