diff --git a/tools/monitor-delegation-changes/monitor-delegation.ps1 b/tools/monitor-delegation-changes/monitor-delegation.ps1 index aa440d8..c277efa 100644 --- a/tools/monitor-delegation-changes/monitor-delegation.ps1 +++ b/tools/monitor-delegation-changes/monitor-delegation.ps1 @@ -13,49 +13,57 @@ $profileClient = [Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClien $token = $profileClient.AcquireAccessToken($currentContext.Tenant.Id) $listOperations = @{ - Uri = "https://management.azure.com/providers/microsoft.insights/eventtypes/management/values?api-version=2015-04-01&`$filter=eventTimestamp ge '$($dateFormatForQuery)'" + Uri = "https://management.azure.com/providers/microsoft.insights/eventtypes/management/values?api-version=2015-04-01&`$filter=eventTimestamp ge '$($dateFormatForQuery)'" Headers = @{ - Authorization = "Bearer $($token.AccessToken)" + Authorization = "Bearer $($token.AccessToken)" 'Content-Type' = 'application/json' } - Method = 'GET' + Method = 'GET' } $list = Invoke-RestMethod @listOperations -$showOperations = $list.value -if ($showOperations.operationName.value -eq "Microsoft.Resources/tenants/register/action") -{ - $registerOutputs = $showOperations | Where-Object -FilterScript {$_.eventName.value -eq "EndRequest" -and $_.resourceType.value -and $_.operationName.value -eq "Microsoft.Resources/tenants/register/action"} - foreach ($registerOutput in $registerOutputs) - { +# First link can be empty - and point to a next link (or potentially multiple pages) +# While you get more data - continue fetching and add result +while($list.nextLink){ + $list2 = Invoke-RestMethod $list.nextLink -Headers $listOperations.Headers -Method Get + $data+=$list2.value; + $list.nextLink = $list2.nextlink; +} + +$showOperations = $data; + +if ($showOperations.operationName.value -eq "Microsoft.Resources/tenants/register/action") { + $registerOutputs = $showOperations | Where-Object -FilterScript { $_.eventName.value -eq "EndRequest" -and $_.resourceType.value -and $_.operationName.value -eq "Microsoft.Resources/tenants/register/action" } + foreach ($registerOutput in $registerOutputs) { + + $eventDescription = $registerOutput.description | ConvertFrom-Json; + $registerOutputdata = [pscustomobject]@{ - Event = "An Azure customer has registered delegated resources to your Azure tenant"; - DelegatedResourceId = $registerOutput.description |%{$_.split('"')[11]}; - CustomerTenantId = $registerOutput.description |%{$_.split('"')[7]}; - CustomerSubscriptionId = $registerOutput.subscriptionId; + Event = "An Azure customer has registered delegated resources to your Azure tenant"; + DelegatedResourceId = $eventDescription.delegationResourceId; + CustomerTenantId = $eventDescription.subscriptionTenantId; + CustomerSubscriptionId = $eventDescription.subscriptionId; CustomerDelegationStatus = $registerOutput.status.value; - EventTimeStamp = $registerOutput.eventTimestamp; + EventTimeStamp = $registerOutput.eventTimestamp; } $registerOutputdata | Format-List } } -if ($showOperations.operationName.value -eq "Microsoft.Resources/tenants/unregister/action") -{ - $unregisterOutputs = $showOperations | Where-Object -FilterScript {$_.eventName.value -eq "EndRequest" -and $_.resourceType.value -and $_.operationName.value -eq "Microsoft.Resources/tenants/unregister/action"} - foreach ($unregisterOutput in $unregisterOutputs) - { +if ($showOperations.operationName.value -eq "Microsoft.Resources/tenants/unregister/action") { + $unregisterOutputs = $showOperations | Where-Object -FilterScript { $_.eventName.value -eq "EndRequest" -and $_.resourceType.value -and $_.operationName.value -eq "Microsoft.Resources/tenants/unregister/action" } + foreach ($unregisterOutput in $unregisterOutputs) { + $eventDescription = $registerOutput.description | ConvertFrom-Json; $unregisterOutputdata = [pscustomobject]@{ - Event = "An Azure customer has unregistered delegated resources from your Azure tenant"; - DelegatedResourceId = $unregisterOutput.description |%{$_.split('"')[11]}; - CustomerTenantId = $unregisterOutput.description |%{$_.split('"')[7]}; - CustomerSubscriptionId = $unregisterOutput.subscriptionId; + Event = "An Azure customer has unregistered delegated resources from your Azure tenant"; + DelegatedResourceId = $eventDescription.delegationResourceId; + CustomerTenantId = $eventDescription.subscriptionTenantId; + CustomerSubscriptionId = $eventDescription.subscriptionId; CustomerDelegationStatus = $unregisterOutput.status.value; - EventTimeStamp = $unregisterOutput.eventTimestamp; + EventTimeStamp = $unregisterOutput.eventTimestamp; } $unregisterOutputdata | Format-List } } -else -{ +else { Write-Output "No new delegation events for tenant: $($currentContext.Tenant.TenantId)" }