From ee863d95ff4c5fd7f6d5ded5605c5b3d375b219c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A5re=20Overg=C3=A5rd?= Date: Thu, 9 Apr 2026 05:47:56 +0200 Subject: [PATCH 1/2] Add TODO and BUGs for next version --- EntraReporter/functions/Get-EntraIdRoleAssignment.ps1 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/EntraReporter/functions/Get-EntraIdRoleAssignment.ps1 b/EntraReporter/functions/Get-EntraIdRoleAssignment.ps1 index 94a7d9a..c9b45e5 100644 --- a/EntraReporter/functions/Get-EntraIdRoleAssignment.ps1 +++ b/EntraReporter/functions/Get-EntraIdRoleAssignment.ps1 @@ -34,6 +34,10 @@ function Get-EntraIdRoleAssignment { $RoleName ) + # TODO: Add switch to include expired assigments + + # TODO: Add switch to include accounts with sign-in disabled + #region Internal functions # Resolve-AssignmentWindow: compute the effective assignment window from principal and user time windows @@ -354,6 +358,8 @@ function Get-EntraIdRoleAssignment { Resolve-EntraIDRoleSchedule -Schedule $schedule -State 'Eligible' } + # BUG: Eligible assignments which has been activated generates two entries, one showing eligible and one showing assigned. This is because the principal schedule and user schedule for the assignment are both eligible, so when we resolve the effective state, we get eligible for both entries. We need to add a check to see if there is an active assignment for the same principal and user, and if so, we should skip the eligible entry since it is not actually eligible but rather already active. This will require checking the role assignment schedules for an assigned entry with the same principal and user that overlaps in time with the eligible entry, which may be a bit complex but should be doable. In the meantime, we will emit both entries to avoid missing any data, but this may lead to some confusion in the output since it will show both eligible and assigned entries for active assignments. + Write-Progress -Activity $activityName -Completed $resolvedGroupSchedules | Sort-Object -Property RoleName, UserDisplayName From fc2aa4bd923dfe7c705f002bc6d385ebd43dc3c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A5re=20Overg=C3=A5rd?= Date: Sat, 11 Apr 2026 07:22:10 +0200 Subject: [PATCH 2/2] Remove duplicates for eligible roles that has been activated. --- CHANGELOG.md | 6 ++++++ EntraReporter/EntraReporter.psd1 | 2 +- EntraReporter/functions/Get-EntraIdRoleAssignment.ps1 | 10 ++++++---- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 433edc5..bc0f7d5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## 0.3.1 (2026-04-11) + +### Fixed + +- Users with eligble assignments that has been activated are no longer present twice in output. + ## 0.3.0 (2026-04-05) ### Added diff --git a/EntraReporter/EntraReporter.psd1 b/EntraReporter/EntraReporter.psd1 index 7d2a15c..bcb2efc 100644 --- a/EntraReporter/EntraReporter.psd1 +++ b/EntraReporter/EntraReporter.psd1 @@ -4,7 +4,7 @@ RootModule = 'EntraReporter.psm1' # Version number of this module. - ModuleVersion = '0.3.0' + ModuleVersion = '0.3.1' # Supported PSEditions CompatiblePSEditions = @('Core', 'Desktop') diff --git a/EntraReporter/functions/Get-EntraIdRoleAssignment.ps1 b/EntraReporter/functions/Get-EntraIdRoleAssignment.ps1 index c9b45e5..e5ce865 100644 --- a/EntraReporter/functions/Get-EntraIdRoleAssignment.ps1 +++ b/EntraReporter/functions/Get-EntraIdRoleAssignment.ps1 @@ -34,9 +34,9 @@ function Get-EntraIdRoleAssignment { $RoleName ) - # TODO: Add switch to include expired assigments + # TODO: Add switch to include expired assigments. These are not included by default and may require additional API calls to fetch historical assignment data, so we will implement this as an optional switch to avoid unnecessary API calls for users who do not need this information. - # TODO: Add switch to include accounts with sign-in disabled + # TODO: Consider options for adding a property showing whether accounts have sign-in disabled, stop showing them default, and add switch to include them. This will require fetching additional information about the principal (user/service principal) for each assignment to check the sign-in status, which may lead to a significant increase in API calls. #region Internal functions @@ -178,6 +178,10 @@ function Get-EntraIdRoleAssignment { } foreach ($scheduleEntry in $scheduleEntries ) { + # Ignore eligble entries that has been activated to avoid emitting duplicate entries for the same user that would show up as both eligible and assigned. + if ($scheduleEntry.assignmentType -eq 'activated') { + continue + } if ($scheduleEntry.principal.'@odata.type' -eq '#microsoft.graph.user') { # User member found; create normalized assignment entry $roleEntrySplat = @{ @@ -358,8 +362,6 @@ function Get-EntraIdRoleAssignment { Resolve-EntraIDRoleSchedule -Schedule $schedule -State 'Eligible' } - # BUG: Eligible assignments which has been activated generates two entries, one showing eligible and one showing assigned. This is because the principal schedule and user schedule for the assignment are both eligible, so when we resolve the effective state, we get eligible for both entries. We need to add a check to see if there is an active assignment for the same principal and user, and if so, we should skip the eligible entry since it is not actually eligible but rather already active. This will require checking the role assignment schedules for an assigned entry with the same principal and user that overlaps in time with the eligible entry, which may be a bit complex but should be doable. In the meantime, we will emit both entries to avoid missing any data, but this may lead to some confusion in the output since it will show both eligible and assigned entries for active assignments. - Write-Progress -Activity $activityName -Completed $resolvedGroupSchedules | Sort-Object -Property RoleName, UserDisplayName