PowerShell函数无法向Microsoft 365条件访问(CA)策略添加多个组

问题根源 #

New-AzureADMSConditionalAccessPolicy要求Conditions.Users.IncludeGroups属性传入组ID组成的数组，你将多个组ID用-join拼接为单个逗号分隔的字符串，等于把两个ID合并为一个无效的组ID提交，因此触发BadRequest错误。单组场景下拼接后字符串和原ID一致，所以不会报错。
另外你定义的ExcludedGroups参数为[string]类型，无法支持传入多个排除组，赋值时也存在同样的字符串拼接错误。

修正后的完整代码 #

function New-MFACAPolicy {
    param (
        [Parameter(Mandatory=$true, Position = 0)]
        [string[]]$Groups,

        [Parameter(Mandatory=$true)]
        [ValidateSet('enabled', 'enabledForReportingButNotEnforced', 'disabled')]
        [string]$State,

        [Parameter(Mandatory=$false)]
        [string[]]$ExcludedGroups
    )

    BEGIN{
        Test-AzureADConnection -ErrorAction SilentlyContinue

        #Create Empty Array
        $IncludedGroups = @()
        $ExclGroups = @()
        #Loop through Groups listed and add to array of Object ID's for each group
        foreach ($Group in $Groups) {
            $IncludedGroup = Get-AzureADMSGroup -SearchString $Group
            if ($IncludedGroup) {
                $IncludedGroups += $IncludedGroup.id
            } else {
                Write-Warning "未找到名称为 $Group 的组，已跳过"
            }
        }#Foreach

        if ($PSBoundParameters.ContainsKey('ExcludedGroups')) {
            foreach ($ExcludedGroup in $ExcludedGroups) {
                $ExclGroup = Get-AzureADMSGroup -SearchString $ExcludedGroup
                if ($ExclGroup) {
                    $ExclGroups += $ExclGroup.id 
                } else {
                    Write-Warning "未找到名称为 $ExcludedGroup 的排除组，已跳过"
                }
            }#Foreach
        }#If Excluded Groups parameter is specified

        # 校验至少有一个有效包含组
        if ($IncludedGroups.Count -eq 0) {
            Write-Error "无有效包含组，无法创建策略"
            return
        }

    }#Begin

    Process {
        $Conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
        $Conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
        $Conditions.Applications.IncludeApplications = "All"
        $Conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
        # 直接传入ID数组，不需要拼接为字符串
        $conditions.Users.IncludeGroups = $IncludedGroups
        $Conditions.ClientAppTypes = @('Browser','MobileAppsAndDesktopClients')
        $Controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
        $controls._Operator = "OR"
        $Controls.BuiltInControls = "mfa"

        if ($PSBoundParameters.ContainsKey('ExcludedGroups') -and $ExclGroups.Count -gt 0) {
            # 直接传入排除组ID数组
            $Conditions.Users.ExcludeGroups = $ExclGroups
        }#If ExlcudedGroups parameter specified 

        New-AzureADMSConditionalAccessPolicy -DisplayName "CA001: Require MFA for all Licensed Users" -State $State -Conditions $Conditions -GrantControls $Controls
    }#Process
}

主要修改点 #

• 移除了多余的组ID字符串拼接操作，直接将ID数组赋值给对应属性
• 将ExcludedGroups参数类型调整为[string[]]，支持传入多个排除组
• 增加了组搜索结果的空值校验和提示，避免无效ID导致的报错
• 增加了包含组的非空校验，避免创建无效策略

内容的提问来源于stack exchange，提问作者adriancmilian