From 2ca6e0b96c6778ae705f10ab9203c9c044913f92 Mon Sep 17 00:00:00 2001 From: Thomas Detzner Date: Thu, 13 Aug 2026 13:26:56 +0200 Subject: [PATCH 1/2] Fix false 'not enabled' error when multiple forwarding profiles exist GET /beta/networkAccess/forwardingProfiles returns more than one profile per trafficForwardingType for tenants in the multiple-forwarding-profiles private preview. The feature-enablement checks assumed a single profile, so $paProfile.state enumerated to an array and the -ne 'enabled' array filter made the guard truthy, throwing even when the feature was enabled. Treat the result as a collection and pass when at least one profile of that traffic type is enabled. Applied to the Private Access config export, the Private Access app discovery export, and the Internet Access config export (all three had the same latent bug). --- .../GSA/Export-EntraInternetAccessConfig.ps1 | 14 ++++++++++---- .../GSA/Export-EntraPrivateAccessAppDiscovery.ps1 | 14 ++++++++++---- .../GSA/Export-EntraPrivateAccessConfig.ps1 | 14 ++++++++++---- .../Get-IntNetworkAccessForwardingProfile.ps1 | 4 +++- 4 files changed, 33 insertions(+), 13 deletions(-) diff --git a/Migrate2GSA/functions/GSA/Export-EntraInternetAccessConfig.ps1 b/Migrate2GSA/functions/GSA/Export-EntraInternetAccessConfig.ps1 index c2620f3..3a511a0 100644 --- a/Migrate2GSA/functions/GSA/Export-EntraInternetAccessConfig.ps1 +++ b/Migrate2GSA/functions/GSA/Export-EntraInternetAccessConfig.ps1 @@ -144,15 +144,21 @@ function Export-EntraInternetAccessConfig { Write-LogMessage "Global Secure Access tenant status validated: $($tenantStatus.onboardingStatus)" -Level SUCCESS -Component "Validation" # Validate Internet Access feature is enabled + # A tenant can have multiple Internet Access forwarding profiles; the feature counts as + # enabled when at least one of them is enabled. Write-LogMessage "Validating Internet Access feature is enabled..." -Level INFO -Component "Validation" - $iaProfile = Get-IntNetworkAccessForwardingProfile -ProfileType 'internet' + $iaProfiles = @(Get-IntNetworkAccessForwardingProfile -ProfileType 'internet') $graphApiCalls++ - if (-not $iaProfile -or $iaProfile.state -ne 'enabled') { - $currentState = if ($iaProfile) { $iaProfile.state } else { 'not found' } + $enabledIaProfiles = @($iaProfiles | Where-Object { $_.state -eq 'enabled' }) + if ($enabledIaProfiles.Count -eq 0) { + $currentState = if ($iaProfiles.Count -gt 0) { + ($iaProfiles | ForEach-Object { "$($_.name): $($_.state)" }) -join '; ' + } + else { 'not found' } Write-LogMessage "Internet Access is not enabled on this tenant. Current state: $currentState" -Level ERROR -Component "Validation" throw "Internet Access feature validation failed. Please enable Internet Access before exporting." } - Write-LogMessage "Internet Access feature validated: enabled" -Level SUCCESS -Component "Validation" + Write-LogMessage "Internet Access feature validated: enabled ($($enabledIaProfiles.Count) of $($iaProfiles.Count) forwarding profile(s) enabled)" -Level SUCCESS -Component "Validation" #endregion #region Export Web Content Filtering Policies diff --git a/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessAppDiscovery.ps1 b/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessAppDiscovery.ps1 index 230771b..efaf2c9 100644 --- a/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessAppDiscovery.ps1 +++ b/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessAppDiscovery.ps1 @@ -164,14 +164,20 @@ function Export-EntraPrivateAccessAppDiscovery { Write-LogMessage "Global Secure Access tenant status validated: $($tenantStatus.onboardingStatus)" -Level SUCCESS -Component "Validation" # Validate Private Access feature is enabled + # A tenant can have multiple Private Access forwarding profiles; the feature counts as + # enabled when at least one of them is enabled. Write-LogMessage "Validating Private Access feature is enabled..." -Level INFO -Component "Validation" - $paProfile = Get-IntNetworkAccessForwardingProfile -ProfileType 'private' - if (-not $paProfile -or $paProfile.state -ne 'enabled') { - $currentState = if ($paProfile) { $paProfile.state } else { 'not found' } + $paProfiles = @(Get-IntNetworkAccessForwardingProfile -ProfileType 'private') + $enabledPaProfiles = @($paProfiles | Where-Object { $_.state -eq 'enabled' }) + if ($enabledPaProfiles.Count -eq 0) { + $currentState = if ($paProfiles.Count -gt 0) { + ($paProfiles | ForEach-Object { "$($_.name): $($_.state)" }) -join '; ' + } + else { 'not found' } Write-LogMessage "Private Access is not enabled on this tenant. Current state: $currentState" -Level ERROR -Component "Validation" throw "Private Access feature validation failed. Please enable Private Access before exporting." } - Write-LogMessage "Private Access feature validated: enabled" -Level SUCCESS -Component "Validation" + Write-LogMessage "Private Access feature validated: enabled ($($enabledPaProfiles.Count) of $($paProfiles.Count) forwarding profile(s) enabled)" -Level SUCCESS -Component "Validation" #endregion #region Compute Date Range diff --git a/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessConfig.ps1 b/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessConfig.ps1 index 324bbe9..dd5c23c 100644 --- a/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessConfig.ps1 +++ b/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessConfig.ps1 @@ -115,15 +115,21 @@ function Export-EntraPrivateAccessConfig { Write-LogMessage "Global Secure Access tenant status validated: $($tenantStatus.onboardingStatus)" -Level SUCCESS -Component "Validation" # Validate Private Access feature is enabled + # A tenant can have multiple Private Access forwarding profiles; the feature counts as + # enabled when at least one of them is enabled. Write-LogMessage "Validating Private Access feature is enabled..." -Level INFO -Component "Validation" - $paProfile = Get-IntNetworkAccessForwardingProfile -ProfileType 'private' + $paProfiles = @(Get-IntNetworkAccessForwardingProfile -ProfileType 'private') $graphApiCalls++ - if (-not $paProfile -or $paProfile.state -ne 'enabled') { - $currentState = if ($paProfile) { $paProfile.state } else { 'not found' } + $enabledPaProfiles = @($paProfiles | Where-Object { $_.state -eq 'enabled' }) + if ($enabledPaProfiles.Count -eq 0) { + $currentState = if ($paProfiles.Count -gt 0) { + ($paProfiles | ForEach-Object { "$($_.name): $($_.state)" }) -join '; ' + } + else { 'not found' } Write-LogMessage "Private Access is not enabled on this tenant. Current state: $currentState" -Level ERROR -Component "Validation" throw "Private Access feature validation failed. Please enable Private Access before exporting." } - Write-LogMessage "Private Access feature validated: enabled" -Level SUCCESS -Component "Validation" + Write-LogMessage "Private Access feature validated: enabled ($($enabledPaProfiles.Count) of $($paProfiles.Count) forwarding profile(s) enabled)" -Level SUCCESS -Component "Validation" # Check connector groups availability and build cache Write-LogMessage "Checking connector groups availability..." -Level INFO -Component "Validation" diff --git a/Migrate2GSA/internal/functions/Get-IntNetworkAccessForwardingProfile.ps1 b/Migrate2GSA/internal/functions/Get-IntNetworkAccessForwardingProfile.ps1 index a46dba5..89a1de6 100644 --- a/Migrate2GSA/internal/functions/Get-IntNetworkAccessForwardingProfile.ps1 +++ b/Migrate2GSA/internal/functions/Get-IntNetworkAccessForwardingProfile.ps1 @@ -14,6 +14,8 @@ function Get-IntNetworkAccessForwardingProfile { .OUTPUTS Returns the forwarding profile object(s) matching the specified criteria. + A tenant can have more than one profile per traffic forwarding type, so callers + must wrap the result in @() and evaluate every returned profile. .EXAMPLE Get-IntNetworkAccessForwardingProfile @@ -21,7 +23,7 @@ function Get-IntNetworkAccessForwardingProfile { .EXAMPLE Get-IntNetworkAccessForwardingProfile -ProfileType 'private' - Retrieves the Private Access forwarding profile. + Retrieves the Private Access forwarding profile(s). #> [CmdletBinding()] param ( From b12c42afd0731c88d91f5ae56dd37507a45bfd02 Mon Sep 17 00:00:00 2001 From: Thomas Detzner Date: Thu, 13 Aug 2026 13:38:52 +0200 Subject: [PATCH 2/2] Bump ModuleVersion to 2026.8.13.1 --- Migrate2GSA/Migrate2GSA.psd1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Migrate2GSA/Migrate2GSA.psd1 b/Migrate2GSA/Migrate2GSA.psd1 index 2809766..a519d41 100644 --- a/Migrate2GSA/Migrate2GSA.psd1 +++ b/Migrate2GSA/Migrate2GSA.psd1 @@ -12,7 +12,7 @@ RootModule = 'Migrate2GSA.psm1' # Version number of this module. -ModuleVersion = '2026.6.18.1' +ModuleVersion = '2026.8.13.1' # Supported PSEditions CompatiblePSEditions = 'Core'