11<#
22. SYNOPSIS
33Returns all hard-to-manage environments of an Azure DevOps organization
4-
4+
55. DESCRIPTION
66An Azure DevOps automation script that returns all environments of an Azure DevOps organization without an administrator or with only a single user in administrator role
77
@@ -34,14 +34,14 @@ PS> .\Get-EnvironmentsWithoutOrSingleAdmin.ps1 -PersonalAccessToken "PAT_HERE" -
3434#>
3535PARAM
3636(
37- [Parameter (Mandatory = $true , Position = 0 , HelpMessage = " Azure DevOps personal access token (PAT) with scopes: User Profile (Read), Project and Team (Read), Build (Read), Environment (Read & manage)." )]
38- [string ] $PersonalAccessToken
39- ,
40- [Parameter (Mandatory = $true , Position = 1 )]
41- [string ] $OrganizationName
42- ,
43- [Parameter (Mandatory = $false , Position = 2 )]
44- [switch ] $PrintToConsole = $false
37+ [Parameter (Mandatory = $true , Position = 0 , HelpMessage = " Azure DevOps personal access token (PAT) with scopes: User Profile (Read), Project and Team (Read), Build (Read), Environment (Read & manage)." )]
38+ [string ] $PersonalAccessToken
39+ ,
40+ [Parameter (Mandatory = $true , Position = 1 )]
41+ [string ] $OrganizationName
42+ ,
43+ [Parameter (Mandatory = $false , Position = 2 )]
44+ [switch ] $PrintToConsole = $false
4545)
4646
4747$base64encodedPAT = [Convert ]::ToBase64String([System.Text.Encoding ]::UTF8.GetBytes(" `:$PersonalAccessToken " ))
@@ -53,35 +53,35 @@ $projects = $response.value
5353$environments = [System.Collections.ArrayList ]::new()
5454
5555foreach ($project in $projects ) {
56- $uri = " https://dev.azure.com/{0}/{1}/_apis/pipelines/environments?api-version=7.2-preview.1" -f $Organizationname , $project.name
57- $response = Invoke-RestMethod - Method Get - Uri $uri - Headers @ {' Authorization' = " Basic $base64encodedPAT " }
58-
59- $envs = $response.value
60- foreach ($env in $envs ) {
61- $uri = " https://dev.azure.com/{0}/_apis/securityroles/scopes/distributedtask.environmentreferencerole/roleassignments/resources/{1}_{2}?api-version=7.1-preview.1" -f $Organizationname , $project.id , $env.id
62- $response = Invoke-RestMethod - Method Get - Uri $uri - Headers @ {' Authorization' = " Basic $base64encodedPAT " }
63-
64- $assignmentsToAdministratorRole = $response.value | ? { $_.role.identifier -eq " distributedtask.environmentreferencerole.Administrator" }
65-
66- # add to result list, if no administrator role assignment exists
67- if ($assignmentsToAdministratorRole.Count -eq 0 ) {
68- $null = $environments.Add ($env )
69- # add to result list, if only a single user is assigned to the administrator role
70- } elseif ($assignmentsToAdministratorRole -ne $null -and $assignmentsToAdministratorRole.Count -eq $null -and $assignmentsToAdministratorRole.identity.displayName -notcontains " \" ) {
71- $null = $environments.Add ($env )
72- } else {
73- Write-Host " Environment '$ ( $env.name ) ' ($ ( $env.id ) ) has more than one user assigned to the administrator role" - ForegroundColor Yellow
74- }
75- }
56+ $uri = " https://dev.azure.com/{0}/{1}/_apis/pipelines/environments?api-version=7.2-preview.1" -f $Organizationname , $project.name
57+ $response = Invoke-RestMethod - Method Get - Uri $uri - Headers @ {' Authorization' = " Basic $base64encodedPAT " }
58+
59+ $envs = $response.value
60+ foreach ($env in $envs ) {
61+ $uri = " https://dev.azure.com/{0}/_apis/securityroles/scopes/distributedtask.environmentreferencerole/roleassignments/resources/{1}_{2}?api-version=7.1-preview.1" -f $Organizationname , $project.id , $env.id
62+ $response = Invoke-RestMethod - Method Get - Uri $uri - Headers @ {' Authorization' = " Basic $base64encodedPAT " }
63+
64+ $assignmentsToAdministratorRole = $response.value | ? { $_.role.identifier -eq " distributedtask.environmentreferencerole.Administrator" }
65+
66+ # add to result list, if no administrator role assignment exists
67+ if ($assignmentsToAdministratorRole.Count -eq 0 ) {
68+ $null = $environments.Add ($env )
69+ # add to result list, if only a single user is assigned to the administrator role
70+ } elseif ($assignmentsToAdministratorRole -ne $null -and $assignmentsToAdministratorRole.Count -eq $null -and $assignmentsToAdministratorRole.identity.displayName -notcontains " \" ) {
71+ $null = $environments.Add ($env )
72+ } else {
73+ Write-Host " Environment '$ ( $env.name ) ' ($ ( $env.id ) ) has more than one user assigned to the administrator role" - ForegroundColor Yellow
74+ }
75+ }
7676}
7777
7878if ($PrintToConsole ) {
79- Write-Host " Azure DevOps organization: $OrganizationName " - ForegroundColor Green
80- Write-Host (" Projects count: {0}" -f $projects.Count ) - ForegroundColor Green
81- Write-Host (" Environments without or with single admin: {0}" -f $envs.Count ) - ForegroundColor Green
82- Write-Host " "
79+ Write-Host " Azure DevOps organization: $OrganizationName " - ForegroundColor Green
80+ Write-Host (" Projects count: {0}" -f $projects.Count ) - ForegroundColor Green
81+ Write-Host (" Environments without or with single admin: {0}" -f $envs.Count ) - ForegroundColor Green
82+ Write-Host " "
8383
84- $environments | Format-Table - AutoSize - Wrap - Property id, name, @ {Name = " projectId" ; Expression = {$_.project.id }}, @ {Name = " projectName" ; Expression = {($projects | ? id -eq $_.project.id ).name}}
84+ $environments | Format-Table - AutoSize - Wrap - Property id, name, @ {Name = " projectId" ; Expression = {$_.project.id }}, @ {Name = " projectName" ; Expression = {($projects | ? id -eq $_.project.id ).name}}
8585}
8686
8787return $environments
0 commit comments