fix: correct field references in identity and device tests

Zacgoose · Zacgoose · commit 98f0778d88a0 · 2026-07-16T00:15:13.000+08:00
Fix multiple bugs in CIPP test functions where incorrect field names or IDs were used when querying role data and policies:

- Replace `$GA.id` with `$GA.roleTemplateId` when matching PIM role assignments (CIS_1_1_2, CIS_1_1_3)
- Replace `$Role.templateId` with `$Role.roleTemplateId` when filtering roles and policies (ZTNA21813, 21816, 21818, 21820)
- Fix app protection policy tests to read from correct data type and distinguish between missing data vs. missing platform-specific policy (ZTNA24548, ZTNA24549)
- Replace `IsPermanent` for permanent GA detection instead of `AssignmentType -eq 'Permanent'` (ZTNA21835)
- Use correct field names from Get-CippDbRoleMembers: `id` instead of `principalId`, `displayName` instead of `principalDisplayName` (ZTNA21835, ZTNA21836)
- Fix role management policy lookup to use `roleDefinitionId` instead of nonexistent `effectiveRules.target.targetObjects.id` (ZTNA21819, ZTNA21820)
- Clean up Entra URL construction (ZTNA21836)

These changes fix tests that were silently returning false negatives due to incorrect field references.
diff --git a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1 b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1
@@ -33,8 +33,11 @@ function Invoke-CippTestCIS_1_1_2 {
             }
         }
 
+        # roleDefinitionId carries the role's TEMPLATE id, not the directoryRole instance id, so
+        # comparing it to $GA.id never matched and no PIM-assigned admin was ever counted here —
+        # only the direct members above.
         foreach ($Assignment in @($RoleAssignmentScheduleInstances)) {
-            if ($Assignment.roleDefinitionId -eq $GA.id -and $Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime -and $Assignment.principalId) {
+            if ($Assignment.roleDefinitionId -eq $GA.roleTemplateId -and $Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime -and $Assignment.principalId) {
                 [void]$GAUserIds.Add([string]$Assignment.principalId)
             }
         }
diff --git a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_3.ps1 b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_3.ps1
@@ -28,8 +28,11 @@ function Invoke-CippTestCIS_1_1_3 {
             }
         }
 
+        # roleDefinitionId carries the role's TEMPLATE id, not the directoryRole instance id, so
+        # comparing it to $GA.id never matched and no PIM-assigned admin was ever counted here —
+        # only the direct members above.
         foreach ($Assignment in @($RoleAssignmentScheduleInstances)) {
-            if ($Assignment.roleDefinitionId -eq $GA.id -and $Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime -and $Assignment.principalId) {
+            if ($Assignment.roleDefinitionId -eq $GA.roleTemplateId -and $Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime -and $Assignment.principalId) {
                 [void]$GAMembers.Add([string]$Assignment.principalId)
             }
         }
diff --git a/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.ps1 b/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.ps1
@@ -9,20 +9,33 @@ function Invoke-CippTestZTNA24548 {
     #Tested - Device
 
     try {
-        $IosPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'IntuneIosAppProtectionPolicies'
+        # App protection policies for every platform live under one type; URLName carries the
+        # Graph resource they came from and is the platform discriminator. This previously read
+        # 'IntuneIosAppProtectionPolicies', a type no collector writes, so the test always skipped.
+        $AllPolicies = @(Get-CIPPTestData -TenantFilter $Tenant -Type 'IntuneAppProtectionManagedAppPolicies')
 
-        if (-not $IosPolicies) {
+        # Only skip when the type itself is absent (no Intune licence, or collection has not run).
+        if ($AllPolicies.Count -eq 0) {
             Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Data on iOS/iPadOS is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
             return
         }
 
+        $IosPolicies = @($AllPolicies | Where-Object { $_.URLName -eq 'iosManagedAppProtection' })
+
+        # Data exists but no iOS policy at all — that is a genuine failure of this control, not a
+        # missing-data skip.
+        if ($IosPolicies.Count -eq 0) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "❌ No iOS/iPadOS app protection policy exists in this tenant.`n`nApp protection policies were found for other platforms, so Intune data is being collected — there is simply no iOS policy." -Risk 'High' -Name 'Data on iOS/iPadOS is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
         $AssignedPolicies = @($IosPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
         $Passed = $AssignedPolicies.Count -gt 0
 
         if ($Passed) {
             $ResultMarkdown = [System.Text.StringBuilder]::new("✅ At least one iOS app protection policy exists and is assigned.`n`n")
         } else {
-            $ResultMarkdown = [System.Text.StringBuilder]::new("❌ No iOS app protection policy exists or none are assigned.`n`n")
+            $ResultMarkdown = [System.Text.StringBuilder]::new("❌ iOS app protection policies exist but none are assigned.`n`n")
         }
 
         $null = $ResultMarkdown.Append("## iOS App Protection Policies`n`n")
diff --git a/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.ps1 b/Modules/CIPPTests/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.ps1
@@ -9,20 +9,33 @@ function Invoke-CippTestZTNA24549 {
     #Tested - Device
 
     try {
-        $AndroidPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'IntuneAndroidAppProtectionPolicies'
+        # App protection policies for every platform live under one type; URLName carries the
+        # Graph resource they came from and is the platform discriminator. This previously read
+        # 'IntuneAndroidAppProtectionPolicies', a type no collector writes, so the test always skipped.
+        $AllPolicies = @(Get-CIPPTestData -TenantFilter $Tenant -Type 'IntuneAppProtectionManagedAppPolicies')
 
-        if (-not $AndroidPolicies) {
+        # Only skip when the type itself is absent (no Intune licence, or collection has not run).
+        if ($AllPolicies.Count -eq 0) {
             Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Data on Android is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
             return
         }
 
+        $AndroidPolicies = @($AllPolicies | Where-Object { $_.URLName -eq 'androidManagedAppProtection' })
+
+        # Data exists but no Android policy at all — that is a genuine failure of this control, not
+        # a missing-data skip.
+        if ($AndroidPolicies.Count -eq 0) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "❌ No Android app protection policy exists in this tenant.`n`nApp protection policies were found for other platforms, so Intune data is being collected — there is simply no Android policy." -Risk 'High' -Name 'Data on Android is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
         $AssignedPolicies = @($AndroidPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
         $Passed = $AssignedPolicies.Count -gt 0
 
         if ($Passed) {
             $ResultMarkdown = [System.Text.StringBuilder]::new("✅ At least one Android app protection policy exists and is assigned.`n`n")
         } else {
-            $ResultMarkdown = [System.Text.StringBuilder]::new("❌ No Android app protection policy exists or none are assigned.`n`n")
+            $ResultMarkdown = [System.Text.StringBuilder]::new("❌ Android app protection policies exist but none are assigned.`n`n")
         }
 
         $null = $ResultMarkdown.Append("## Android App Protection Policies`n`n")
diff --git a/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.ps1 b/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.ps1
@@ -24,11 +24,14 @@ function Invoke-CippTestZTNA21813 {
         $UserRoleMap = @{}
 
         foreach ($Role in $PrivilegedRoles) {
+            # 'roleTemplateId', not 'templateId' — the Roles cache has no templateId field at all
+            # (description, displayName, id, memberCount, members, roleTemplateId), so both filters
+            # below compared against $null and matched nothing.
             $ActiveAssignments = $RoleAssignmentScheduleInstances | Where-Object {
-                $_.roleDefinitionId -eq $Role.templateId -and $_.assignmentType -eq 'Assigned'
+                $_.roleDefinitionId -eq $Role.roleTemplateId -and $_.assignmentType -eq 'Assigned'
             }
             $EligibleAssignments = $RoleEligibilitySchedules | Where-Object {
-                $_.roleDefinitionId -eq $Role.templateId
+                $_.roleDefinitionId -eq $Role.roleTemplateId
             }
 
             $AllAssignments = @($ActiveAssignments) + @($EligibleAssignments)
@@ -38,7 +41,9 @@ function Invoke-CippTestZTNA21813 {
                 if (-not $User) { continue }
 
                 $UserId = $User.id
-                $IsGARole = $Role.templateId -eq $GlobalAdminRoleId
+                # roleTemplateId — $Role.templateId does not exist, so this was always false and
+                # no user was ever classed as a Global Administrator.
+                $IsGARole = $Role.roleTemplateId -eq $GlobalAdminRoleId
 
                 if ($IsGARole) {
                     $AllGAUsers[$UserId] = $User
diff --git a/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.ps1 b/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.ps1
@@ -55,7 +55,9 @@ function Invoke-CippTestZTNA21816 {
         }
 
         foreach ($Role in $PrivilegedRoles) {
-            if ($Role.templateId -eq $GlobalAdminRoleId) { continue }
+            # roleTemplateId — $Role.templateId does not exist, so this guard never fired and the
+            # Global Administrator role was processed here despite being handled separately below.
+            if ($Role.roleTemplateId -eq $GlobalAdminRoleId) { continue }
 
             $RoleMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId $Role.RoletemplateId
 
diff --git a/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.ps1 b/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.ps1
@@ -68,8 +68,10 @@ function Invoke-CippTestZTNA21818 {
         $ExitLoop = $false
 
         foreach ($Role in $PrivilegedRoles) {
+            # roleDefinitionId carries the role's TEMPLATE id — matching it against $Role.id (the
+            # directoryRole instance id) never succeeded.
             $Policy = $RoleManagementPolicies | Where-Object {
-                $_.scopeId -eq '/' -and $_.scopeType -eq 'DirectoryRole' -and $_.roleDefinitionId -eq $Role.id
+                $_.scopeId -eq '/' -and $_.scopeType -eq 'DirectoryRole' -and $_.roleDefinitionId -eq $Role.roleTemplateId
             } | Select-Object -First 1
 
             if (-not $Policy) { continue }
diff --git a/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.ps1 b/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.ps1
@@ -17,11 +17,15 @@ function Invoke-CippTestZTNA21819 {
             return
         }
 
-        # Get role management policy for Global Admin
+        # Get role management policy for Global Admin.
+        # This previously matched on effectiveRules.target.targetObjects.id — a property that does
+        # not exist on this response (target is {caller, operations, level, inheritableSettings,
+        # enforcedSettings}), so the policy was never found. roleDefinitionId carries the role's
+        # TEMPLATE id, which is the correct join.
         $RoleManagementPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'RoleManagementPolicies'
         $GlobalAdminPolicy = $RoleManagementPolicies | Where-Object {
-            $_.scopeId -eq '/' -and $_.scopeType -eq 'DirectoryRole' -and $_.effectiveRules.target.targetObjects.id -contains $GlobalAdminRole.id
-        }
+            $_.scopeId -eq '/' -and $_.scopeType -eq 'DirectoryRole' -and $_.roleDefinitionId -eq $GlobalAdminRole.roleTemplateId
+        } | Select-Object -First 1
 
         $Passed = 'Failed'
         $IsDefaultRecipientsEnabled = 'N/A'
diff --git a/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.ps1 b/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.ps1
@@ -19,23 +19,24 @@ function Invoke-CippTestZTNA21820 {
         # Get all role management policies
         $RoleManagementPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'RoleManagementPolicies'
 
-        # Build hashtable for quick policy lookup by role ID
+        # Build hashtable for quick policy lookup by role template ID.
+        # This previously keyed on effectiveRules.target.targetObjects.id — a property that does
+        # not exist on this response (target is {caller, operations, level, inheritableSettings,
+        # enforcedSettings}), so the table was always empty and no policy was ever found.
+        # roleDefinitionId carries the role's TEMPLATE id, which is the correct key.
         $PolicyByRoleId = @{}
         foreach ($Policy in $RoleManagementPolicies) {
-            if ($Policy.scopeId -eq '/' -and $Policy.scopeType -eq 'DirectoryRole') {
-                foreach ($RoleId in $Policy.effectiveRules.target.targetObjects.id) {
-                    if ($RoleId) {
-                        $PolicyByRoleId[$RoleId] = $Policy
-                    }
-                }
+            if ($Policy.scopeId -eq '/' -and $Policy.scopeType -eq 'DirectoryRole' -and $Policy.roleDefinitionId) {
+                $PolicyByRoleId[$Policy.roleDefinitionId] = $Policy
             }
         }
 
         $RolesWithIssues = [System.Collections.Generic.List[object]]::new()
         $Passed = 'Passed'
 
         foreach ($Role in $PrivilegedRoles) {
-            $Policy = $PolicyByRoleId[$Role.id]
+            # Template id, not the directoryRole instance id — see the note above.
+            $Policy = $PolicyByRoleId[$Role.roleTemplateId]
 
             if (-not $Policy) {
                 $RolesWithIssues.Add(@{
diff --git a/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.ps1 b/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.ps1
@@ -17,9 +17,12 @@ function Invoke-CippTestZTNA21835 {
             return
         }
 
-        # Get permanent Global Administrator members
+        # Get permanent Global Administrator members.
+        # This previously filtered on AssignmentType -eq 'Permanent', a value Get-CippDbRoleMembers
+        # never emits (it returns Active/Eligible/Direct), so the set was always empty and the test
+        # silently reported no permanent GAs on every tenant. Permanence is IsPermanent.
         $PermanentGAMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId '62e90394-69f5-4237-9190-012177145e10' | Where-Object {
-            $_.AssignmentType -eq 'Permanent' -and $_.'@odata.type' -eq '#microsoft.graph.user'
+            $_.IsPermanent -and $_.'@odata.type' -eq '#microsoft.graph.user'
         }
 
         # Get Users data to check sync status
@@ -28,7 +31,8 @@ function Invoke-CippTestZTNA21835 {
         $EmergencyAccountCandidates = [System.Collections.Generic.List[object]]::new()
 
         foreach ($Member in $PermanentGAMembers) {
-            $User = $Users | Where-Object { $_.id -eq $Member.principalId }
+            # Get-CippDbRoleMembers returns the principal object id as 'id', not 'principalId'.
+            $User = $Users | Where-Object { $_.id -eq $Member.id }
 
             # Only process cloud-only accounts
             if ($User -and $User.onPremisesSyncEnabled -ne $true) {
@@ -165,7 +169,9 @@ function Invoke-CippTestZTNA21835 {
 
             $UserSummary = [System.Collections.Generic.List[object]]::new()
             foreach ($Member in $PermanentGAMembers) {
-                $User = $Users | Where-Object { $_.id -eq $Member.principalId }
+                # 'id', not 'principalId' — see the note above; this lookup silently matched
+                # nothing and every row was skipped by the -not $User guard below.
+                $User = $Users | Where-Object { $_.id -eq $Member.id }
                 if (-not $User) { continue }
 
                 $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/$($User.id)"
diff --git a/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.ps1 b/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.ps1
@@ -20,16 +20,21 @@ function Invoke-CippTestZTNA21836 {
         $WorkloadIdentitiesWithPrivilegedRoles = [System.Collections.Generic.List[object]]::new()
 
         foreach ($Role in $PrivilegedRoles) {
-            $RoleMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId $Role.id
+            # Must be the role's TEMPLATE id: PIM's roleDefinitionId carries template ids, so
+            # passing $Role.id (the directoryRole instance id) matched nothing and this test found
+            # no workload identities on any tenant.
+            $RoleMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId $Role.roleTemplateId
 
             foreach ($Member in $RoleMembers) {
                 if ($Member.'@odata.type' -eq '#microsoft.graph.servicePrincipal') {
+                    # Get-CippDbRoleMembers returns id/displayName/appId — not principalId or
+                    # principalDisplayName, which rendered blank here.
                     $WorkloadIdentitiesWithPrivilegedRoles.Add([PSCustomObject]@{
-                            PrincipalId          = $Member.principalId
-                            PrincipalDisplayName = $Member.principalDisplayName
+                            PrincipalId          = $Member.id
+                            PrincipalDisplayName = $Member.displayName
                             AppId                = $Member.appId
                             RoleDisplayName      = $Role.displayName
-                            RoleDefinitionId     = $Role.id
+                            RoleDefinitionId     = $Role.roleTemplateId
                             AssignmentType       = $Member.AssignmentType
                         })
                 }
@@ -48,7 +53,7 @@ function Invoke-CippTestZTNA21836 {
             $SortedAssignments = $WorkloadIdentitiesWithPrivilegedRoles | Sort-Object -Property PrincipalDisplayName
 
             foreach ($Assignment in $SortedAssignments) {
-                $SPLink = "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/$($Assignment.PrincipalId)/appId/$($Assignment.AppId)/preferredSingleSignOnMode~/null/servicePrincipalType/Application/fromNav/"
+                $SPLink = "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/$($Assignment.PrincipalId)/appId/$($Assignment.AppId)"
                 $null = $ResultMarkdown.Append("| [$($Assignment.PrincipalDisplayName)]($SPLink) | $($Assignment.RoleDisplayName) | $($Assignment.AssignmentType) |`n")
             }
             $null = $ResultMarkdown.Append("`n")
diff --git a/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21899.ps1 b/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21899.ps1
@@ -25,7 +25,9 @@ function Invoke-CippTestZTNA21899 {
             foreach ($R in $NotifRules) {
                 if (-not $R.notificationRecipients -or $R.notificationRecipients.Count -eq 0) {
                     $MissingRecipients.Add([PSCustomObject]@{
-                            PolicyId           = $Policy.id
+                            # 'policyId' — this type is sourced from roleManagementPolicyAssignments
+                            # and carries the policy's id as policyId, not id.
+                            PolicyId           = $Policy.policyId
                             ScopeId            = $Policy.scopeId
                             ScopeType          = $Policy.scopeType
                             RuleId             = $R.id

Original file line number	Diff line number	Diff line change
`@@ -33,8 +33,11 @@ function Invoke-CippTestCIS_1_1_2 {`
`33`	`33`	`}`
`34`	`34`	`}`
`35`	`35`
	`36`	`+ # roleDefinitionId carries the role's TEMPLATE id, not the directoryRole instance id, so`
	`37`	`+ # comparing it to $GA.id never matched and no PIM-assigned admin was ever counted here —`
	`38`	`+ # only the direct members above.`
`36`	`39`	`foreach ($Assignment in @($RoleAssignmentScheduleInstances)) {`
`37`		`- if ($Assignment.roleDefinitionId -eq $GA.id -and $Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime -and $Assignment.principalId) {`
	`40`	`+ if ($Assignment.roleDefinitionId -eq $GA.roleTemplateId -and $Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime -and $Assignment.principalId) {`
`38`	`41`	`[void]$GAUserIds.Add([string]$Assignment.principalId)`
`39`	`42`	`}`
`40`	`43`	`}`
Original file line number	Diff line number	Diff line change
`@@ -28,8 +28,11 @@ function Invoke-CippTestCIS_1_1_3 {`
`28`	`28`	`}`
`29`	`29`	`}`
`30`	`30`
	`31`	`+ # roleDefinitionId carries the role's TEMPLATE id, not the directoryRole instance id, so`
	`32`	`+ # comparing it to $GA.id never matched and no PIM-assigned admin was ever counted here —`
	`33`	`+ # only the direct members above.`
`31`	`34`	`foreach ($Assignment in @($RoleAssignmentScheduleInstances)) {`
`32`		`- if ($Assignment.roleDefinitionId -eq $GA.id -and $Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime -and $Assignment.principalId) {`
	`35`	`+ if ($Assignment.roleDefinitionId -eq $GA.roleTemplateId -and $Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime -and $Assignment.principalId) {`
`33`	`36`	`[void]$GAMembers.Add([string]$Assignment.principalId)`
`34`	`37`	`}`
`35`	`38`	`}`
Original file line number	Diff line number	Diff line change
`@@ -55,7 +55,9 @@ function Invoke-CippTestZTNA21816 {`
`55`	`55`	`}`
`56`	`56`
`57`	`57`	`foreach ($Role in $PrivilegedRoles) {`
`58`		`- if ($Role.templateId -eq $GlobalAdminRoleId) { continue }`
	`58`	`+ # roleTemplateId — $Role.templateId does not exist, so this guard never fired and the`
	`59`	`+ # Global Administrator role was processed here despite being handled separately below.`
	`60`	`+ if ($Role.roleTemplateId -eq $GlobalAdminRoleId) { continue }`
`59`	`61`
`60`	`62`	`$RoleMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId $Role.RoletemplateId`
`61`	`63`