Add error handling to AAD Get-MgBetaUser and put redundant code into a function

[tkol2022]

💡 Summary

While testing #794 @buidav uncovered an edge case where if you delete a user or move them out of a group while ScubaGear is running, the AAD function Get-PrivilegedUser calls to Get-MgBetaUser can produce errors that prematurely halt the software. Although the probability of this happening is low, it would be good to handle this event gracefully. We also have redundant code that handles calling this graph function and processing it output so it would be good to put that into a utility function.

Implementation notes

This implementation is specific to Get-PrivilegedUser but the assignee should review the Get-PrivilegedRole function to see if similar enhancements are applicable there.

• Inside of the function, find all calls to Get-MgBetaUser and determine the common code associated with that API. Create a utility function that takes the following arguments, the PrivilegedUsers hashtable, the user's ID and a role name. The function will retrieve information about the user from the Get-MgBetaUser API and add it to the hashtable. Here is an example code block from the function that processes a specific user.

  if (-Not $PrivilegedUsers.ContainsKey($UserObjectId)) {
      $AADUser = Get-MgBetaUser -ErrorAction Stop -Filter "Id eq '$UserObjectId'"
      $PrivilegedUsers[$AADUser.Id] = @{"DisplayName"=$AADUser.DisplayName; "OnPremisesImmutableId"=$AADUser.OnPremisesImmutableId; "roles"=@()}
  }
  # If the current role has not already been added to the user's roles array then add the role
  if ($PrivilegedUsers[$UserObjectId].roles -notcontains $Role.DisplayName) {
      $PrivilegedUsers[$UserObjectId].roles += $Role.DisplayName
  }

• Add error handling with a try catch block around the Get-MgBetaUser inside the function. If the error Request_ResourceNotFound occurs then handle the exception by writing to the debug output. Here is an example catch block that you may need to tweak.

catch {
                    if ($_.FullyQualifiedErrorId.Contains("Request_ResourceNotFound")) {
                        Write-Debug "Error retrieving user data for user with ID: $($PIMEligibleUserId)"
                    }
                    else {
                        throw $_
                    }
                }