Scripts/Helpers/Get-AzPolicyResources.ps1

function Get-AzPolicyResources {
    [CmdletBinding()]
    param (
        [hashtable] $PacEnvironment,
        [hashtable] $ScopeTable,

        [switch] $SkipRoleAssignments,
        [switch] $SkipExemptions,
        [switch] $CollectAllPolicies
    )

    $deploymentRootScope = $PacEnvironment.deploymentRootScope
    Write-Information ""
    Write-Information "==================================================================================================="
    Write-Information "Get Policy Resources for EPAC environment '$($PacEnvironment.pacSelector)' at root scope $($deploymentRootScope -replace '/providers/Microsoft.Management','')"
    Write-Information "==================================================================================================="

    $skipExemptionsLocal = $SkipExemptions.IsPresent
    $skipRoleAssignmentsLocal = $SkipRoleAssignments.IsPresent
    $collectAllPoliciesLocal = $CollectAllPolicies.IsPresent

    $deployedPolicyResources = @{
        policydefinitions            = @{
            all      = @{}
            readOnly = @{}
            managed  = @{}
            counters = @{
                builtIn         = 0
                inherited       = 0
                managedBy       = @{
                    thisPaC  = 0
                    otherPaC = 0
                    unknown  = 0
                }
                excluded        = 0
                unmanagedScopes = 0
            }
        }
        policysetdefinitions         = @{
            all      = @{}
            readOnly = @{}
            managed  = @{}
            counters = @{
                builtIn         = 0
                inherited       = 0
                managedBy       = @{
                    thisPaC  = 0
                    otherPaC = 0
                    unknown  = 0
                }
                excluded        = 0
                unmanagedScopes = 0
            }
        }
        policyassignments            = @{
            managed  = @{}
            counters = @{
                managedBy       = @{
                    thisPaC             = 0
                    otherPaC            = 0
                    dfcSecurityPolicies = 0
                    dfcDefenderPlans    = 0
                    unknown             = 0
                }
                excluded        = 0
                unmanagedScopes = 0
                withIdentity    = 0
            }
        }
        policyexemptions             = @{
            managed  = @{}
            counters = @{
                managedBy       = @{
                    thisPaC  = 0
                    otherPaC = 0
                    unknown  = 0
                }
                orphaned        = 0
                expired         = 0
                excluded        = 0
                unmanagedScopes = 0
            }
        }
        roleAssignmentsByPrincipalId = @{}
        numberOfRoleAssignments      = 0
        numberOfPrincipleIds         = 0
        remoteAssignmentsCount       = 0
        roleDefinitions              = @{}
        roleAssignmentsNotRetrieved  = $false
        excludedScopes               = $excludedScopes
    }

    $collectionList = [System.Collections.ArrayList]::new()
    if ($skipExemptionsLocal) {
        $collectionList.AddRange(@( `
                    "policyDefinitions", `
                    "policySetDefinitions", `
                    "policyAssignments"))
    }
    else {
        $collectionList.AddRange(@( `
                    "policyDefinitions", `
                    "policySetDefinitions", `
                    "policyAssignments", `
                    "policyExemptions"))
    }

    foreach ($collectionItem in $collectionList) {
        switch ($collectionItem) {
            policyDefinitions {
                Get-AzPolicyOrSetDefinitions `
                    -DefinitionType "policyDefinitions" `
                    -PolicyResourcesTable $deployedPolicyResources.policydefinitions `
                    -PacEnvironment $PacEnvironment `
                    -ScopeTable $ScopeTable `
                    -CollectAllPolicies $collectAllPoliciesLocal
                break
            }
            policySetDefinitions {
                Get-AzPolicyOrSetDefinitions `
                    -DefinitionType "policySetDefinitions" `
                    -PolicyResourcesTable $deployedPolicyResources.policysetdefinitions `
                    -PacEnvironment $PacEnvironment `
                    -ScopeTable $ScopeTable `
                    -CollectAllPolicies $collectAllPoliciesLocal
                break
            }
            policyAssignments {
                Get-AzPolicyAssignments `
                    -DeployedPolicyResources $deployedPolicyResources `
                    -PacEnvironment $PacEnvironment `
                    -ScopeTable $ScopeTable `
                    -SkipRoleAssignments $skipRoleAssignmentsLocal
                break
            }
            policyExemptions {
                Get-AzPolicyExemptions `
                    -DeployedPolicyResources $deployedPolicyResources `
                    -PacEnvironment $PacEnvironment `
                    -ScopeTable $ScopeTable
                break
            }
        }
    }

    Write-Information ""
    Write-Information "==================================================================================================="
    Write-Information "Policy Resources found for EPAC environment '$($PacEnvironment.pacSelector)' at root scope $($deploymentRootScope -replace '/providers/Microsoft.Management', '')"
    Write-Information "==================================================================================================="

    foreach ($kind in @("policydefinitions", "policysetdefinitions")) {
        $deployedPolicyTable = $deployedPolicyResources.$kind
        $counters = $deployedPolicyTable.counters
        $managedBy = $counters.managedBy
        $managedByAny = $managedBy.thisPaC + $managedBy.otherPaC + $managedBy.unknown
        Write-Information ""
        if ($kind -eq "policydefinitions") {
            Write-Information "Policy counts:"
        }
        else {
            Write-Information "Policy Set counts:"
        }
        Write-Information "    BuiltIn        = $($counters.builtIn)"
        Write-Information "    Managed ($($managedByAny)) by:"
        Write-Information "        This PaC   = $($managedBy.thisPaC)"
        Write-Information "        Other PaC  = $($managedBy.otherPaC)"
        Write-Information "        Unknown    = $($managedBy.unknown)"
        Write-Information "    Inherited      = $($counters.inherited)"
        Write-Information "    Excluded       = $($counters.excluded)"
        Write-Verbose "    Not our scopes = $($counters.unmanagedScopes)"
    }

    $counters = $deployedPolicyResources.policyassignments.counters
    $managedBy = $counters.managedBy
    $managedByAny = $managedBy.thisPaC + $managedBy.otherPaC + $managedBy.unknown + $managedBy.dfcSecurityPolicies + $managedBy.dfcDefenderPlans
    Write-Information ""
    Write-Information "Policy Assignment counts:"
    Write-Information "    Managed ($($managedByAny)) by:"
    Write-Information "        This PaC              = $($managedBy.thisPaC)"
    Write-Information "        Other PaC             = $($managedBy.otherPaC)"
    Write-Information "        Unknown               = $($managedBy.unknown)"
    Write-Information "        DfC Security Policies = $($managedBy.dfcSecurityPolicies)"
    Write-Information "        DfC Defender Plans    = $($managedBy.dfcDefenderPlans)"
    Write-Information "    With identity             = $($counters.withIdentity)"
    Write-Information "    Excluded                  = $($counters.excluded)"
    Write-Verbose "    Not our scopes = $($counters.unmanagedScopes)"

    if (!$skipExemptionsLocal) {
        $counters = $deployedPolicyResources.policyexemptions.counters
        $managedBy = $counters.managedBy
        $managedByAny = $managedBy.thisPaC + $managedBy.otherPaC + $managedBy.unknown
        Write-Information ""
        Write-Information "Policy Exemptions:"
        Write-Information "    Managed ($($managedByAny)) by:"
        Write-Information "        This PaC  = $($managedBy.thisPaC)"
        Write-Information "        Other PaC = $($managedBy.otherPaC)"
        Write-Information "        Unknown   = $($managedBy.unknown)"
        Write-Information "    Expired       = $($counters.expired)"
        Write-Information "    Excluded      = $($counters.excluded)"
    }

    if (!$SkipRoleAssignments) {
        $managedRoleAssignmentsByPrincipalId = $deployedPolicyResources.roleAssignmentsByPrincipalId
        Write-Information ""
        $numberPrincipalIds = $deployedPolicyResources.numberOfPrincipleIds
        $numberPrincipalIdsWithRoleAssignments = $managedRoleAssignmentsByPrincipalId.Count
        if ($numberPrincipalIds -ne $numberPrincipalIdsWithRoleAssignments) {
            Write-Warning "Role assignment not retrieved for every principal Id ($($numberPrincipalIds) in assignments, $($numberPrincipalIdsWithRoleAssignments) retrieved).`n    This is likely due to a missing permission for the SPN running the pipeline. Please read the pipeline documentation in EPAC.`n    In rare cases, this can happen when a previous role assignment failed." -WarningAction Continue
            $deployedPolicyResources.roleAssignmentsNotRetrieved = $numberPrincipalIdsWithRoleAssignments -eq 0
        }
        Write-Information "Role Assignments:"
        Write-Information "    Principal Ids         = $($numberPrincipalIds)"
        Write-Information "    With Role Assignments = $($numberPrincipalIdsWithRoleAssignments)"
        Write-Information "    Role Assignments      = $($deployedPolicyResources.numberOfRoleAssignments)"
        if ($PacEnvironment.managingTenantId) {
            Write-Information "    Remote Role Assignments = $($deployedPolicyResources.remoteAssignmentsCount)"
        }
    }
    Write-Information ""

    return $deployedPolicyResources
}