Skip to content

Commit ca0af43

Browse files
astaykovastaykov
authored
Merge pull request #1226 from alexandair/alex-ai-agent-identity-tables
2 parents 734a9b1 + d79fc70 commit ca0af43

5 files changed

Lines changed: 249 additions & 32 deletions

File tree

‎src/powershell/assets/export-model/AgentIdentity-model.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"@odata.context": "https://graph.microsoft.com/beta/$metadata#servicePrincipals/microsoft.graph.agentIdentity(sponsors(id))",
3+
"value": [
4+
{
5+
"isZtModelRow": true,
6+
"id": null,
7+
"agentIdentityBlueprintId": null,
8+
"agentAppId": null,
9+
"displayName": null,
10+
"accountEnabled": false,
11+
"servicePrincipalType": null,
12+
"disabledByMicrosoftStatus": null,
13+
"createdByAppId": null,
14+
"createdDateTime": "1900-01-01T00:00:00Z",
15+
"tags": [],
16+
"sponsors": [
17+
{
18+
"id": null,
19+
"@odata.type": null
20+
}
21+
]
22+
}
23+
]
24+
}

‎src/powershell/assets/export-model/AgentIdentityBlueprint-model.json‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{
2+
"@odata.context": "https://graph.microsoft.com/beta/$metadata#applications/microsoft.graph.agentIdentityBlueprint(sponsors(id))",
3+
"value": [
4+
{
5+
"isZtModelRow": true,
6+
"disabledByMicrosoftStatus": null,
7+
"publisherDomain": null,
8+
"keyCredentials": [],
9+
"verifiedPublisher": {
10+
"displayName": null,
11+
"verifiedPublisherId": null,
12+
"addedDateTime": "1900-01-01T00:00:00Z"
13+
},
14+
"createdDateTime": "1900-01-01T00:00:00Z",
15+
"appId": null,
16+
"createdByAppId": null,
17+
"displayName": null,
18+
"optionalClaims": null,
19+
"owners": [],
20+
"sponsors": [
21+
{
22+
"id": null,
23+
"@odata.type": null
24+
}
25+
],
26+
"api": {
27+
"oauth2PermissionScopes": [],
28+
"requestedAccessTokenVersion": 2,
29+
"knownClientApplications": [],
30+
"tokenEncryptionSetting": {
31+
"automatedTokenVersion": {
32+
"available": [],
33+
"current": null
34+
},
35+
"scheme": null,
36+
"audience": null
37+
},
38+
"acceptMappedClaims": null,
39+
"preAuthorizedApplications": []
40+
},
41+
"appRoles": [],
42+
"info": {
43+
"logoUrl": null,
44+
"privacyStatementUrl": null,
45+
"marketingUrl": null,
46+
"supportUrl": null,
47+
"termsOfServiceUrl": null
48+
},
49+
"requiredResourceAccess": [],
50+
"uniqueName": null,
51+
"groupMembershipClaims": null,
52+
"tokenEncryptionKeyId": null,
53+
"web": {
54+
"redirectUris": [],
55+
"redirectUriSettings": [],
56+
"logoutUrl": null,
57+
"enabledResponseModes": null,
58+
"implicitGrantSettings": {
59+
"enableIdTokenIssuance": false,
60+
"enableAccessTokenIssuance": false
61+
},
62+
"homePageUrl": null
63+
},
64+
"certification": null,
65+
"identifierUris": [],
66+
"tags": [],
67+
"serviceManagementReference": null,
68+
"managerApplications": [],
69+
"description": null,
70+
"id": null,
71+
"passwordCredentials": [],
72+
"signInAudience": null
73+
}
74+
]
75+
}

‎src/powershell/assets/export-model/AgentIdentityBlueprintPrincipal-model.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"@odata.context": "https://graph.microsoft.com/beta/$metadata#servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal(sponsors(id))",
3+
"value": [
4+
{
5+
"isZtModelRow": true,
6+
"id": null,
7+
"appId": null,
8+
"displayName": null,
9+
"appDisplayName": null,
10+
"appDescription": null,
11+
"publisherName": null,
12+
"accountEnabled": false,
13+
"appRoleAssignmentRequired": false,
14+
"servicePrincipalType": null,
15+
"signInAudience": null,
16+
"disabledByMicrosoftStatus": null,
17+
"createdByAppId": null,
18+
"appOwnerOrganizationId": null,
19+
"tags": [],
20+
"servicePrincipalNames": [],
21+
"publishedPermissionScopes": [
22+
{
23+
"id": null,
24+
"value": null,
25+
"isEnabled": false,
26+
"adminConsentDisplayName": null,
27+
"adminConsentDescription": null,
28+
"userConsentDisplayName": null,
29+
"isPrivate": false,
30+
"userConsentDescription": null,
31+
"type": null
32+
}
33+
],
34+
"appRoles": [
35+
{
36+
"id": null,
37+
"value": null,
38+
"isEnabled": false,
39+
"isPreAuthorizationRequired": false,
40+
"origin": null,
41+
"description": null,
42+
"allowedMemberTypes": [],
43+
"isPrivate": false,
44+
"displayName": null
45+
}
46+
],
47+
"info": {
48+
"privacyStatementUrl": null,
49+
"marketingUrl": null,
50+
"logoUrl": null,
51+
"supportUrl": null,
52+
"termsOfServiceUrl": null
53+
},
54+
"verifiedPublisher": {
55+
"addedDateTime": "1900-01-01T00:00:00Z",
56+
"displayName": null,
57+
"verifiedPublisherId": null
58+
},
59+
"sponsors": [
60+
{
61+
"id": null,
62+
"@odata.type": null
63+
}
64+
]
65+
}
66+
]
67+
}

‎src/powershell/assets/export-tenant.config.psd1‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ Note: Avoid using the same names as used for the "General Parameters" section of
7575
Name = 'Application'
7676
Uri = 'beta/applications'
7777
QueryString = '$top=999'
78-
RelatedPropertyNames = @('sponsors')
78+
RelatedPropertyNames = @()
7979
Type = 'Default' # PrivilegedGroup
8080

8181
Pillar = @('Identity', 'Network', 'AI')
@@ -88,7 +88,7 @@ Note: Avoid using the same names as used for the "General Parameters" section of
8888
Name = 'ServicePrincipal'
8989
Uri = 'beta/servicePrincipals'
9090
QueryString = '$expand=appRoleAssignments&$top=999&$select=id,deletedDateTime,accountEnabled,alternativeNames,createdByAppId,createdDateTime,deviceManagementAppType,appDescription,appDisplayName,appId,applicationTemplateId,appOwnerOrganizationId,appRoleAssignmentRequired,assignmentRequiredForPrincipalTypes,description,disabledByMicrosoftStatus,displayName,errorUrl,homepage,isAuthorizationServiceEnabled,isDisabled,isManagementRestricted,loginUrl,logoutUrl,notes,notificationEmailAddresses,preferredSingleSignOnMode,preferredTokenSigningKeyEndDateTime,preferredTokenSigningKeyThumbprint,publisherName,replyUrls,samlMetadataUrl,samlSLOBindingType,servicePrincipalNames,servicePrincipalType,signInAudience,tags,tokenEncryptionKeyId,certification,samlSingleSignOnSettings,addIns,api,appRoles,info,keyCredentials,publishedPermissionScopes,passwordCredentials,resourceSpecificApplicationPermissions,verifiedPublisher,customSecurityAttributes,agentIdentityBlueprintId'
91-
RelatedPropertyNames = @('oauth2PermissionGrants', 'owners', 'sponsors')
91+
RelatedPropertyNames = @('oauth2PermissionGrants', 'owners')
9292
Type = 'Default' # PrivilegedGroup
9393

9494
Pillar = @('Identity', 'Network', 'AI')
@@ -110,6 +110,36 @@ Note: Avoid using the same names as used for the "General Parameters" section of
110110
ExcludePlan = @('Free') # Free
111111
MaximumQueryTime = '%MaximumSignInLogQueryTime%'
112112
}
113+
@{
114+
Name = 'AgentIdentityBlueprint'
115+
Uri = 'beta/applications/microsoft.graph.agentIdentityBlueprint'
116+
QueryString = '$top=999&$expand=sponsors($select=id)'
117+
RelatedPropertyNames = @()
118+
Type = 'Default'
119+
120+
Pillar = 'AI'
121+
# Environment = $null # 'Global'
122+
}
123+
@{
124+
Name = 'AgentIdentity'
125+
Uri = 'beta/servicePrincipals/microsoft.graph.agentIdentity'
126+
QueryString = '$top=999&$expand=sponsors($select=id)'
127+
RelatedPropertyNames = @()
128+
Type = 'Default'
129+
130+
Pillar = 'AI'
131+
# Environment = $null # 'Global'
132+
}
133+
@{
134+
Name = 'AgentIdentityBlueprintPrincipal'
135+
Uri = 'beta/servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal'
136+
QueryString = '$top=999&$expand=sponsors($select=id)'
137+
RelatedPropertyNames = @()
138+
Type = 'Default'
139+
140+
Pillar = 'AI'
141+
# Environment = $null # 'Global'
142+
}
113143
@{
114144
Name = 'User'
115145
Uri = 'beta/users'

‎src/powershell/private/export/Export-Database.ps1‎

Lines changed: 51 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -181,55 +181,76 @@ as
181181
throw $_
182182
}
183183

184-
if ($Pillar -in ('All', 'Identity')) {
184+
# ---------------------------------------------------------------------------
185+
# Resolve which table groups are needed. Each table is imported at most once.
186+
# ---------------------------------------------------------------------------
187+
188+
# Identity and Network need User; AI does not.
189+
$needsUser = $Pillar -in ('All', 'Identity', 'Network')
190+
191+
# All pillars except Devices need Application and ServicePrincipal.
192+
$needsApplicationAndServicePrincipal = $Pillar -in ('All', 'Identity', 'Network', 'AI')
193+
194+
# AI-specific derived-type tables that carry sponsor relationships inline.
195+
$needsAgentIdentity = $Pillar -in ('All', 'AI')
196+
197+
# Identity and AI need SignIn; Network does not.
198+
$needsSignIn = $Pillar -in ('All', 'Identity', 'AI')
199+
200+
# All pillars except Devices share the Role table family.
201+
$needsRoles = $Pillar -in ('All', 'Identity', 'Network', 'AI')
202+
203+
# Tables exclusive to the Identity pillar.
204+
$needsIdentityExtras = $Pillar -in ('All', 'Identity')
205+
206+
# Tables exclusive to the Devices pillar.
207+
$needsDevices = $Pillar -in ('All', 'Devices')
208+
209+
# ---------------------------------------------------------------------------
210+
# Import tables — each table loaded exactly once.
211+
# ---------------------------------------------------------------------------
212+
213+
if ($needsUser) {
185214
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'User' -LogsPath $LogsPath
215+
}
216+
217+
if ($needsApplicationAndServicePrincipal) {
186218
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'Application' -LogsPath $LogsPath
187219
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'ServicePrincipal' -LogsPath $LogsPath
188-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'ServicePrincipalSignIn' -LogsPath $LogsPath
220+
}
221+
222+
if ($needsAgentIdentity) {
223+
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'AgentIdentityBlueprint' -LogsPath $LogsPath
224+
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'AgentIdentity' -LogsPath $LogsPath
225+
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'AgentIdentityBlueprintPrincipal' -LogsPath $LogsPath
226+
}
227+
228+
if ($needsSignIn) {
189229
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'SignIn' -LogsPath $LogsPath
230+
}
231+
232+
if ($needsRoles) {
190233
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleDefinition' -LogsPath $LogsPath
191234
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignment' -LogsPath $LogsPath
192235
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignmentGroup' -LogsPath $LogsPath
193236
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignmentScheduleInstance' -LogsPath $LogsPath
194237
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignmentScheduleInstanceGroup' -LogsPath $LogsPath
195238
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleEligibilityScheduleInstance' -LogsPath $LogsPath
196239
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleEligibilityScheduleInstanceGroup' -LogsPath $LogsPath
240+
}
241+
242+
if ($needsIdentityExtras) {
243+
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'ServicePrincipalSignIn' -LogsPath $LogsPath
197244
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleManagementPolicyAssignment' -LogsPath $LogsPath
198245
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'UserRegistrationDetails' -LogsPath $LogsPath
199246
}
200247

201-
if ($Pillar -in ('All', 'Devices')) {
248+
if ($needsDevices) {
202249
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'Device' -LogsPath $LogsPath
203250
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'ConfigurationPolicy' -LogsPath $LogsPath
204251
}
205252

206-
if ($Pillar -in ('All', 'Network')) {
207-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'User' -LogsPath $LogsPath
208-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'Application' -LogsPath $LogsPath
209-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'ServicePrincipal' -LogsPath $LogsPath
210-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleDefinition' -LogsPath $LogsPath
211-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignment' -LogsPath $LogsPath
212-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignmentGroup' -LogsPath $LogsPath
213-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignmentScheduleInstance' -LogsPath $LogsPath
214-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignmentScheduleInstanceGroup' -LogsPath $LogsPath
215-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleEligibilityScheduleInstance' -LogsPath $LogsPath
216-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleEligibilityScheduleInstanceGroup' -LogsPath $LogsPath
217-
}
218-
219-
if ($Pillar -in ('All', 'AI')) {
220-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'Application' -LogsPath $LogsPath
221-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'ServicePrincipal' -LogsPath $LogsPath
222-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'SignIn' -LogsPath $LogsPath
223-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleDefinition' -LogsPath $LogsPath
224-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignment' -LogsPath $LogsPath
225-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignmentGroup' -LogsPath $LogsPath
226-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignmentScheduleInstance' -LogsPath $LogsPath
227-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleAssignmentScheduleInstanceGroup' -LogsPath $LogsPath
228-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleEligibilityScheduleInstance' -LogsPath $LogsPath
229-
Import-EntraTableLogged -Database $database -ExportPath $ExportPath -TableName 'RoleEligibilityScheduleInstanceGroup' -LogsPath $LogsPath
230-
}
231-
232-
if ($Pillar -in ('All', 'Identity', 'Network', 'AI')) {
253+
if ($needsRoles) {
233254
New-ViewRole -Database $database
234255
}
235256

0 commit comments

Comments
 (0)