chore: Enhance tests for Get-CIPPAlertGlobalAdminAllowList with error handling and additional scenarios

Author: MWG-Logan

Tests/Alerts/Get-CIPPAlertGlobalAdminAllowList.Tests.ps1

@@ -9,6 +9,7 @@ BeforeAll {
     function New-GraphGetRequest { param($uri, $tenantid, $AsApp) }
     function Write-AlertTrace { param($cmdletName, $tenantFilter, $data) }
     function Write-AlertMessage { param($tenant, $message) }
+    function Get-NormalizedError { param($message) $message }
 
     . $AlertPath
 }
@@ -17,6 +18,7 @@ Describe 'Get-CIPPAlertGlobalAdminAllowList' {
     BeforeEach {
         $script:CapturedData = $null
         $script:CapturedTenant = $null
+        $script:CapturedErrorMessage = $null
 
         Mock -CommandName New-GraphGetRequest -MockWith {
             @(
@@ -41,7 +43,10 @@ Describe 'Get-CIPPAlertGlobalAdminAllowList' {
             $script:CapturedTenant = $tenantFilter
         }
 
-        Mock -CommandName Write-AlertMessage {}
+        Mock -CommandName Write-AlertMessage -MockWith {
+            param($tenant, $message)
+            $script:CapturedErrorMessage = $message
+        }
     }
 
     It 'emits per-admin alerts when AlertEachAdmin is true' {
@@ -64,6 +69,17 @@ Describe 'Get-CIPPAlertGlobalAdminAllowList' {
         $CapturedData[0].NonCompliantUsers | Should -Not -Contain '[email protected]'
     }
 
+    It 'emits single aggregated alert when AlertEachAdmin is explicitly false via input object' {
+        $allowInput = @{ ApprovedGlobalAdmins = 'breakglass'; AlertEachAdmin = $false }
+
+        Get-CIPPAlertGlobalAdminAllowList -TenantFilter 'contoso.onmicrosoft.com' -InputValue $allowInput
+
+        $CapturedData | Should -Not -BeNullOrEmpty
+        $CapturedData.Count | Should -Be 1
+        $CapturedData[0].NonCompliantUsers | Should -Contain '[email protected]'
+        $CapturedData[0].NonCompliantUsers | Should -Not -Contain '[email protected]'
+    }
+
     It 'suppresses alert when UPN prefix is approved (comma separated list)' {
         $allowInput = @{ ApprovedGlobalAdmins = 'breakglass,otheradmin'; AlertEachAdmin = $true }
         Get-CIPPAlertGlobalAdminAllowList -TenantFilter 'contoso.onmicrosoft.com' -InputValue $allowInput
@@ -77,4 +93,14 @@ Describe 'Get-CIPPAlertGlobalAdminAllowList' {
 
         $CapturedData | Should -BeNullOrEmpty
     }
+
+    It 'writes alert message when Graph call fails' {
+        Mock -CommandName New-GraphGetRequest -MockWith { throw 'Graph failure' } -Verifiable
+
+        Get-CIPPAlertGlobalAdminAllowList -TenantFilter 'contoso.onmicrosoft.com' -InputValue 'breakglass'
+
+        $CapturedData | Should -BeNullOrEmpty
+        $CapturedErrorMessage | Should -Match 'Failed to check approved Global Admins'
+        $CapturedErrorMessage | Should -Match 'Graph failure'
+    }
 }