jsa2 / caoptics Goto Github PK
View Code? Open in Web Editor NEWCA Optics - Azure AD Conditional Access Gap Analyzer
License: MIT License
CA Optics - Azure AD Conditional Access Gap Analyzer
License: MIT License
If you use beta endpoint new guest types can be exposed. CAOptics does not factor that in yet, as it uses v1.0 (ga) for policies. Customers who edit existing policies with guest conditions via GUI, will see the policies updated to the new conditions, enabling some new CA requirements, and migrating old features there. These changes will not be picked up by current version of CAOptics
On a new Windows machine with Node.js installed, I ran nvm use 16
(README permalink) and got the message:
node vv16.18.0 (64-bit) is not installed or cannot be found.
Should a "first time use" walkthrough include instructions to install Node.js and then run nvm install 16
or nvm install latest
?
The Graph API endpoints and authentication URIs are coded to use the worldwide instances at [*.]microsoft.com
, which prevents customers in other instances from using the tool. GCC and GCC-HIGH use the graph.microsoft.us
endpoint and login.microsoftonline.us
authentication endpoint. It would be great to offer a parameter to choose the relevant Azure instance/environment name and update these endpoints accordingly.
In my testing so far, I have been working around this with a search-replace of those two sets of strings, and also creating my initial connection with the following additional az login
options before continuing:
az cloud set --name AzureUSGovernment
az login --tenant <TENANT_ID>
I can fork with my edits, or go into a new branch if you'd like to create that at this time.
Consider if this could be introduced as feature behind tag. Ensure this can be done with reader permissions https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-filter-for-applications
Remove policy cache when this option is used
Hi there, first of all, thanks for your tool.
I am running the command as:
node ./ca/main.js --mapping --allTerminations --clearPolicyCache --clearMappingCache
Unfortunately the tool only reports on accounts created in AAD. I use ADsync with synced hashes, so all regular users exist in AAD (the domain differs tho because of tiered the accounts, but they exist in the same tenant and the admin account I run caOptics with has the rights to read them).
Is there any way to report on the complete set of users?
There is no need to resolve individual group members, when you use https://graph.microsoft.com/beta/{user/group}/{id}/memberOf
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.