Add code to AAD provider and Rego for 7.6 through 7.9 to support PIM for Groups

[tkol2022]

💡 Summary

Based on the prototyping performed for #792 we need to augment the existing AAD provider to extract the PIM for Groups configuration settings to support policies 7.6 through 7.9. Augment the Rego code to include the PIM for Groups configuration data in the policy evaluations.

Implementation notes

Add code to the AAD provider Get-PrivilegedRole function:

• Whenever a group is found in the loop that iterates all the Active role assignments, check if that group is enrolled in PIM for Groups
• If the group is enrolled, then grab its configuration settings from PIM for Groups (get the "Member" config settings not the Owner)
• Leave the current code that grabs the configuration settings for the roles as-is. We still need to get the config data for the roles.
• Add code to load the PIM for Groups configurations into the JSON that is sent to the Rego. Each role can have one or more group configurations.

Add code to the AAD Rego for policies 7.6 through 7.9:

• In addition to checking the configurations for each role, the policies need to examine the configurations at the group level. For a policy to be compliant (Pass), the role configurations AND the group configurations must be compliant with the baseline policy.

*Note that in this new JSON structure that includes the PIM for Groups configurations, each role can have one more more group configurations associated with it.