Workload-identity Conditional Access policy toolkit
===================================================

The portal has already assessed your tenant, including which workload identities should be
pinned. This is the single script that turns that finding into report-only CA policies.

Steps:
  1. In the report, click Export -> JSON (this is your assessment data; it already contains
     the workload-identity findings).
  2. Preview first — this touches nothing in the tenant:

       ./New-WliCaPolicy.ps1 -InputFile <assessment>.json -OutFile wli-policies.json -DryRun

     It selects the candidate service principals and writes the JSON of what it WOULD
     create: the trusted named locations (deduplicating shared egress IPs) and the
     report-only policies.
  3. Then run it for real (needs the Microsoft.Graph.Authentication module, your own admin
     sign-in, and Policy.ReadWrite.ConditionalAccess):

       ./New-WliCaPolicy.ps1 -InputFile <assessment>.json -OutFile wli-policies.json

     It DEPLOYS to the tenant, asking before each change: it prompts to create each trusted
     named location (stamping the real GUIDs into the policies), then prompts to create each
     Conditional Access policy in report-only. -OutFile is written as a JSON record of the
     policy set. Add -Force to skip every prompt — required for a non-interactive run, where
     there is no console to prompt on and every create is otherwise declined.

Do NOT also import -OutFile (e.g. Import-DCConditionalAccessPolicyDesign) after a real run:
the policies are already in the tenant, so importing would create DUPLICATES. Import it only
if you produced it with -DryRun.

The policies arrive in report-only (enabledForReportingButNotEnforced). Review the
Report-only insights in Entra before enabling. Creating/enforcing workload-identity
policies requires a Microsoft Entra Workload Identities Premium license.
