jsa2 / caoptics Goto Github PK

If you use beta endpoint new guest types can be exposed. CAOptics does not factor that in yet, as it uses v1.0 (ga) for policies. Customers who edit existing policies with guest conditions via GUI, will see the policies updated to the new conditions, enabling some new CA requirements, and migrating old features there. These changes will not be picked up by current version of CAOptics

On a new Windows machine with Node.js installed, I ran nvm use 16 (README permalink) and got the message:

node vv16.18.0 (64-bit) is not installed or cannot be found.

Should a "first time use" walkthrough include instructions to install Node.js and then run nvm install 16 or nvm install latest?

The Graph API endpoints and authentication URIs are coded to use the worldwide instances at [*.]microsoft.com, which prevents customers in other instances from using the tool. GCC and GCC-HIGH use the graph.microsoft.us endpoint and login.microsoftonline.us authentication endpoint. It would be great to offer a parameter to choose the relevant Azure instance/environment name and update these endpoints accordingly.

In my testing so far, I have been working around this with a search-replace of those two sets of strings, and also creating my initial connection with the following additional az login options before continuing:

az cloud set --name AzureUSGovernment
az login --tenant <TENANT_ID>

I can fork with my edits, or go into a new branch if you'd like to create that at this time.

None can be evaluated in policies. Remove policies from filter that contain none from filters

Consider if this could be introduced as feature behind tag. Ensure this can be done with reader permissions https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-filter-for-applications

Remove policy cache when this option is used

Hi there, first of all, thanks for your tool.

I am running the command as:

node ./ca/main.js --mapping --allTerminations --clearPolicyCache --clearMappingCache

Unfortunately the tool only reports on accounts created in AAD. I use ADsync with synced hashes, so all regular users exist in AAD (the domain differs tho because of tiered the accounts, but they exist in the same tenant and the admin account I run caOptics with has the rights to read them).

Is there any way to report on the complete set of users?

There is no need to resolve individual group members, when you use https://graph.microsoft.com/beta/{user/group}/{id}/memberOf