$test1.appName = $arr1 - a null key is not allows in a hash literal

[LukePWilkins]

Hey there Jasper,

I'm running the latest version of the validator, via app registration.
At the point of generating the flow chart, I get a PowerShell error.

Invalid Operation
flow-diagram.ps1:79
Line 79
$test1.appName = $arr1

A null key is not allowed in a hash literal.

This error keeps appearing.

UPDATE: the script has carried on, and is generating the user impact matrix now.
UDPDATE2: The html report isn't generated
UPDATE3: I think I have narrowed it down to appID - "372140e0-b3b7-4226-8ef9-d57986796201"

If I create a CA policy targeting this particular application, which is strangely named Microsoft Azure Windows Virtual Machine Sign-In and Azure Windows VM Sign-In when selecting the app and exploring its properties for one tenancy.

In another tenancy its simply named Azure Windows VM Sign-in

If you remove the filter Application type == Enterprise Applications it appears.

When running the maester test generation, the App name isn't added under the appName property. Example
"/","/","230a13a5-f193-41dd-82f0-f5b1a57ef606","/","False","test@testdomain.com (random)","mfa for test@testdomain.com (random) on NOTE MISSING APP NAME with browser auth","372140e0-b3b7-4226-8ef9-d57986796201","1a531c37-46e9-4db6-833c-de8a74c5c25b","MFA VM-SignIn","mfa",,"/","/","browser"

thus, when the test is stored in the variable $test1 and line 79-80 from flow-diagram.ps1 is ran the appName is currently $null and the error adding null to hash literal is returned.

[LukePWilkins]

line 112 of the test-generator.ps1 file I have changed from:

$app = Invoke-MgGraphRequest -Method GET ('https://graph.microsoft.com/v1.0/servicePrincipals/' + $appID)

to

$app = Invoke-MgGraphRequest -Method GET ("https://graph.microsoft.com/v1.0/servicePrincipals(appID='$appID')")

the ServicePrincipal API expects the service principal ID not the app ID. Where the script is using AppID, we can still pass this via the servicePrincipal API using a filter.

[jasperbaes]

Hi @LukePWilkins, I was not able to recreate the issue. But I've tried to provide a fix in the branch staging. Can you pull this branch and test if it changed anything?

[LukePWilkins]

Hey there @jasperbaes, I tracked it down to a policy that appeared corrupt. The policy appeared to display remnants of a group being included but this group was no longer present anywhere. There was enough information to retrieve the GroupID but trying to track said group down either portal search or PowerShell returned no results.

Editing the policy and essentially 'removing' any inclusions or exclusions cleared it up and the whole script ran with success.

A ghost group of such!

[salamatvon]

[i] Checking version
[i] Importing settings
[i] Connecting to Microsoft Graph
[+] Connected to the Microsoft Graph with
[i] Fetching Conditional Access policies
[+] 17 Conditional Access policies detected
[i] Filtering enabled Conditional Access policies
[+] 9 enabled Conditional Access policies detected
[i] Generating Maester tests
[+] 2159 tests generated for 'Block M365 Access - External Network'
[+] 35 tests generated for 'block sign-ins from any location except the VON Network (VPN/corporate IPs'
[+] 143 tests generated for 'MEMxxxxxxx Device'
[+] 538 tests generated for 'MEMxxxxxxxd Device - Mobile'
[+] 29 tests generated for 'MFA Administrators'
[+] 80 tests generated for 'Microsoft-managed: Block device code flow'
[+] 0 tests generated for 'Outlook Mobile Sign in frequency'
[+] 754 tests generated for 'Require MFA for all users'
[+] 8 tests generated for 'Require MFA for guest access'
[+] Generated 3746 Maester tests
[i] Translating to the Maester code
[+] Translated to the Maester test layout
[i] Generating flow chart
InvalidOperation: C:\Users\xxxx\Desktop\Conditional-Access-Validator\scripts\flow-diagram.ps1:79
Line |
79 | $test1.appName = $arr1
| ~~~~~~~~~~~~~~
| A null key is not allowed in a hash literal.
InvalidOperation: C:\Users\xxxx\Desktop\Conditional-Access-Validator\scripts\flow-diagram.ps1:79
Line |
79 | $test1.appName = $arr1
| ~~~~~~~~~~~~~~
| A null key is not allowed in a hash literal.
InvalidOperation: C:\Users\xxxx\Desktop\Conditional-Access-Validator\scripts\flow-diagram.ps1:79

GET https://graph.microsoft.com/v1.0/groups/1a9bf57f-e97a-489c-bc76-7bd904cd17eb/transitiveMembers?$select=id
| HTTP/2.0 404 Not Found Cache-Control: no-cache Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000
| request-id: 3b3d260c-0854-47b2-a45d-c7fbfd53de60 client-request-id: 46aaf2a6-bc0f-4541-9b6a-7ca1d0b42533
| x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"East
| US","Slice":"E","Ring":"5","ScaleUnit":"008","RoleInstance":"BL02EPF0005251B"}} x-ms-resource-unit: 4 Date: Fri,
| 10 Oct 2025 12:35:08 GMT Content-Type: application/json
| {"error":{"code":"Request_ResourceNotFound","message":"Resource '1a9bf57f-e97a-489c-bc76-7bd904cd17eb' does not
| exist or one of its queried reference-property objects are not
| present.","innerError":{"date":"2025-10-10T12:35:09","request-id":"3b3d260c-0854-47b2-a45d-c7fbfd53de60","client-request-id":"46aaf2a6-bc0f-4541-9b6a-7ca1d0b42533"}}}

InvalidOperation: The script failed due to call depth overflow.