Skip to content

Bugfix/ServicePrincipal sql error when running Invoke-ZtAssessment#1189

Open
DickTracyII wants to merge 2 commits into
microsoft:mainfrom
DickTracyII:main
Open

Bugfix/ServicePrincipal sql error when running Invoke-ZtAssessment#1189
DickTracyII wants to merge 2 commits into
microsoft:mainfrom
DickTracyII:main

Conversation

@DickTracyII
Copy link
Copy Markdown

@DickTracyII DickTracyII commented Apr 24, 2026

Fix: Handle uniqueName field in role principal struct for DuckDB view creation

Resolves #1152
Resolves #1151

Problem

Binder Error: Could not find key "userprincipalname" in struct
Candidate Entries: "uniqueName"

Invoke-ZtAssessment fails during the "Creating database" step with:

The SQL in Get-RoleSelectSql (Export-Database.ps1) accessed r.principal.userPrincipalName
directly on the DuckDB struct. A recent Microsoft Graph API change renamed this field to
uniqueName in the principal object on role assignment tables
(RoleAssignmentScheduleInstance, RoleAssignment, RoleEligibilityScheduleInstance).
When the exported JSON contains uniqueName instead of userPrincipalName, DuckDB throws
a binder error and the entire database creation fails.

image ### Fix

Replaced the direct struct field access:

cast(r.principal.userPrincipalName as varchar) as userPrincipalName,

With a coalesce over json_extract_string, falling back between both field names:

coalesce(
    json_extract_string(r.principal::JSON, '$.userPrincipalName'),
    json_extract_string(r.principal::JSON, '$.uniqueName')
) as userPrincipalName,

This makes the query resilient to both the old and new Graph API schema — userPrincipalName
is tried first (returns NULL if absent rather than throwing), and uniqueName is used
as the fallback.

Co-authored-by: Copilot <copilot@github.com>
Copilot AI review requested due to automatic review settings April 24, 2026 20:42
@DickTracyII DickTracyII changed the title fixed ServicePrincipal sql error when running zrassessment fixed ServicePrincipal sql error when running ztassessment Apr 24, 2026
@DickTracyII DickTracyII changed the title fixed ServicePrincipal sql error when running ztassessment fixed ServicePrincipal sql error when running Invoke-ZtAssessment Apr 24, 2026
@DickTracyII DickTracyII changed the title fixed ServicePrincipal sql error when running Invoke-ZtAssessment Bugfix/ServicePrincipal sql error when running Invoke-ZtAssessment Apr 24, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes DuckDB view creation during Invoke-ZtAssessment by making vwRole resilient to Microsoft Graph schema changes where principal.userPrincipalName may now be returned as principal.uniqueName.

Changes:

  • Updated Get-RoleSelectSql to resolve userPrincipalName via JSON extraction with a fallback to uniqueName when userPrincipalName is absent.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/powershell/private/export/Export-Database.ps1 Outdated
this works and tested

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 26, 2026 15:27
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/powershell/private/export/Export-Database.ps1
@DickTracyII
Copy link
Copy Markdown
Author

@copilot apply changes based on the comments in this thread

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants