PowerShell添加类型开关参数实现Azure AD资源按范围查询问题

Param(
    [Parameter(Mandatory=$true)]
    [ValidatePattern("^[a-z_0-9]{8}[-][a-z_0-9]{4}[-][a-z_0-9]{4}[-][a-z_0-9]{4}[-][a-z_0-9]{12}")]
    $objectID,

    [Parameter()]
    [switch]$user,
    [switch]$group,
    [switch]$SP,
    [switch]$app
)

# 无指定类型开关时默认开启全量查询
if (-not ($user.IsPresent -or $group.IsPresent -or $app.IsPresent -or $SP.IsPresent)) {
    $user = $group = $app = $SP = $true
}

# 定义通用双ID查询函数，避免重复代码
function Search-AzADResource {
    param(
        [string]$ResourceType,
        [string]$Id
    )
    $result = $null
    switch ($ResourceType) {
        "Application" {
            # 先查ObjectId
            $result = Get-AzADApplication -ObjectId $Id -ErrorAction SilentlyContinue
            if ($result) {
                Write-Host "匹配应用（ObjectId匹配）"
                return $result | Format-List ObjectType, DisplayName, Id, Type, ApplicationId
            }
            # 再查ApplicationId
            $result = Get-AzADApplication -ApplicationId $Id -ErrorAction SilentlyContinue
            if ($result) {
                Write-Host "匹配应用（ApplicationId匹配）"
                return $result | Format-List ObjectType, DisplayName, Id, Type, ApplicationId
            }
        }
        "ServicePrincipal" {
            # 先查ObjectId
            $result = Get-AzADServicePrincipal -ObjectId $Id -ErrorAction SilentlyContinue
            if ($result) {
                Write-Host "匹配服务主体（ObjectId匹配）"
                return $result | Format-List ObjectType, DisplayName, Id, Type, ApplicationId
            }
            # 再查ApplicationId
            $result = Get-AzADServicePrincipal -ApplicationId $Id -ErrorAction SilentlyContinue
            if ($result) {
                Write-Host "匹配服务主体（ApplicationId匹配）"
                return $result | Format-List ObjectType, DisplayName, Id, Type, ApplicationId
            }
        }
    }
    return $null
}

$found = $false

# 按指定类型查询
if ($user.IsPresent) {
    $res = Get-AzADUser -ObjectId $objectID -ErrorAction SilentlyContinue
    if ($res) {
        $found = $true
        Write-Host "匹配用户"
        $res | Format-List Mail, DisplayName
    }
}

if ($group.IsPresent) {
    $res = Get-AzADGroup -ObjectId $objectID -ErrorAction SilentlyContinue
    if ($res) {
        $found = $true
        Write-Host "匹配用户组"
        $res | Format-List DisplayName, Description, Id
    }
}

if ($app.IsPresent) {
    $res = Search-AzADResource -ResourceType Application -Id $objectID
    if ($res) {
        $found = $true
        $res
    }
}

if ($SP.IsPresent) {
    $res = Search-AzADResource -ResourceType ServicePrincipal -Id $objectID
    if ($res) {
        $found = $true
        $res
    }
}

# 所有查询都无结果时输出警告
if (-not $found) {
    Write-Warning "Object does not exist."
}

实现逻辑说明 #

1. 默认全量查询实现：脚本启动后首先判断四个类型开关是否全部未激活，如果是则将四个开关全部设为启用，自动走全范围查询，完全符合你要求的调用习惯。
2. 应用/服务主体双ID查询实现：封装了通用的Search-AzADResource函数，针对应用和服务主体两类资源，默认先尝试用传入ID作为ObjectId查询，无结果时再自动尝试作为ApplicationId查询，不需要额外处理参数判断，同时返回匹配类型标识，方便区分是通过哪类ID查到的结果。所有查询都加了-ErrorAction SilentlyContinue避免查不到资源时抛出不必要的错误信息，只在最后所有查询都无结果时统一输出警告。

内容的提问来源于stack exchange，提问作者P Wang