fix: use the connected environment's Graph endpoint in Test-MtConditionalAccessWhatIf

[SebastianClaesson]

📑 Description

Closes #2076

Test-MtConditionalAccessWhatIf posted to https://graph.microsoft.com/beta/identity/conditionalAccess/evaluate regardless of which cloud the session was connected to. In a sovereign tenant the evaluation request goes to the Global host, so the CA What If tests (MT.1033, MT.1034) cannot pass there even when Connect-MgGraph was given the correct environment.

This was found running Maester against a China tenant, where the session connects to https://microsoftgraph.chinacloudapi.cn but this one call still went to graph.microsoft.com.

The fix derives the base URI from the connected environment, matching how Invoke-MtGraphRequest already resolves it:

$graphBaseUri = ([string](Get-MgEnvironment -Name (Get-MgContext).Environment).GraphEndpoint).TrimEnd('/')

Get-MgEnvironment resolves this correctly for every environment it knows about, so the call now follows the session:

Environment	Resolved endpoint
Global	https://graph.microsoft.com
China	https://microsoftgraph.chinacloudapi.cn
USGov	https://graph.microsoft.us
USGovDoD	https://dod-graph.microsoft.us
DelosCloud / BleuCloud / GovSGCloud	https://graph.svc.sovcloud.{de,fr,sg}

Behaviour in the Global cloud is unchanged.

✅ Checks

• My pull request adheres to the code style of this project.
• My code requires changes to the documentation.
• I have updated the documentation as required.
• The build and unit tests pass after running /powershell/tests/pester.ps1 locally.

ℹ️ Additional Information

Local test status: the full pester.ps1 suite runs with 10334 tests and 0 failures, and PSScriptAnalyzer reports no findings on the changed file.

Kept deliberately to one function, but as noted in #2076 the same hardcoded-host pattern appears elsewhere and may be worth a follow-up. Happy to cover the remaining call sites in this PR or open separate ones, whichever you prefer:

Location	Impact
Test-MtHighRiskAppPermissions (2 calls)	Same class of bug — a test that cannot pass outside the Global cloud
Get-MtTotalEntraIdUserCount	Internal helper, affects user counts in sovereign tenants
Send-MtMail (2 calls)	Mail notifications would target the wrong host
Send-MtTeamsMessage	Teams notifications would target the wrong host
GetOrganizationLogos	Report branding logo fetch

Invoke-MtAzureRequest also references the Global host, but as an explicit if (-not $baseUri) fallback default, so that one looks intentional and is left alone.

For the record, Test-EIDSCA.Generated.Tests.ps1 contains 44 occurrences of https://graph.microsoft.com, but all of them are literal text inside test descriptions (Check if "https://graph.microsoft.com/beta/...") rather than API calls, so nothing to change there.

Summary by CodeRabbit

• Bug Fixes
  • Conditional Access What If now uses the connected Microsoft Graph environment, improving compatibility across supported cloud environments.
  • Missing environments default to the Global cloud, and trailing slashes are handled automatically.
  • Clear errors are now shown when no Graph endpoint can be resolved.
  • Existing filtering, results, and error-handling behavior remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ce7fa939-a652-4f9b-a867-cd4979c6f2b3

📥 Commits

Reviewing files that changed from the base of the PR and between 93dd301 and 4841406.

📒 Files selected for processing (1)

• powershell/public/maester/entra/Test-MtConditionalAccessWhatIf.ps1

🚧 Files skipped from review as they are similar to previous changes (1)

• powershell/public/maester/entra/Test-MtConditionalAccessWhatIf.ps1

---

📝 Walkthrough

Walkthrough

The Conditional Access What If request now derives its Microsoft Graph beta endpoint from the connected environment. A missing environment defaults to Global, and unresolved endpoints produce an explicit error. Existing request and result handling remain unchanged.

Changes

Conditional Access What If

Layer / File(s)	Summary
Environment-specific Graph endpoint powershell/public/maester/entra/Test-MtConditionalAccessWhatIf.ps1	The request URI uses the connected environment’s trimmed Graph endpoint. A missing environment defaults to Global, and an empty endpoint raises an explicit error.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: using the connected environment's Graph endpoint.
Description check	✅ Passed	The description explains the bug, implementation, affected environments, testing, and related follow-up scope.
Linked Issues check	✅ Passed	The change satisfies issue #2076 by deriving the Graph endpoint from the active environment while preserving Global behavior.
Out of Scope Changes check	✅ Passed	The changes are limited to Test-MtConditionalAccessWhatIf and do not include unrelated call-site updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@powershell/public/maester/entra/Test-MtConditionalAccessWhatIf.ps1`:
- Around line 214-219: Move the Get-MgContext/Get-MgEnvironment
endpoint-resolution logic into the existing try block so lookup failures reach
its catch handler. Add -ErrorAction Stop, validate that the Graph context and
environment are available, then construct $graphBaseUri from the environment’s
GraphEndpoint using Get-MgEnvironment -Name before invoking the request.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d96ebf02-da4a-4c2f-8b2a-2be316e8bb4c

📥 Commits

Reviewing files that changed from the base of the PR and between 5e15463 and 93dd301.

📒 Files selected for processing (1)

• powershell/public/maester/entra/Test-MtConditionalAccessWhatIf.ps1

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}