M365Documentation

3.1.2

Internal/Collector/AzureAD/Get-AADPolicy.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
                                Function Get-AADPolicy(){

    <#

    .SYNOPSIS

    This function is used to get multiple policies from the Graph API REST interface

    .DESCRIPTION

    The function connects to the Graph API Interface and gets multiple policies from Azure AD

    .EXAMPLE

    Get-AADPolicy

    Returns the policies defined in Azure AD.

    .NOTES

    NAME: Get-AADPolicy

    #>

    [OutputType('DocSection')]

    [cmdletbinding()]

    param()

    $DocSec = New-Object DocSection

    $DocSec.Title = "AAD Policies"

    $DocSec.Text = ""

    $DocSec.Transpose = $false

    $DocSec.SubSections = @()

    # Authentication Flow Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Authentication Flow Policy"

    $DocSecSingle.Text = "Represents the policy configuration of self-service sign-up experience at a tenant level that lets external users request to sign up for approval. It contains information, such as the identifier, display name, and description, and indicates whether self-service sign-up is enabled for the policy."

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/policies/authenticationFlowsPolicy").value

    } catch {

        Write-Verbose "Failed to get Auth Flow Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    # Mobility Management Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Mobility Management Policy"

    $DocSecSingle.Text = "In Azure AD, a mobility management policy represents an auto-enrollment configuration for a mobility management (MDM or MAM) application. These policies are only applicable to devices based on Windows 10 OS and its derivatives (Surface Hub, Hololens etc.). Auto-enrollment enables organizations to automatically enroll devices into their chosen mobility management application as part of Azure AD join or Azure AD register process on Windows 10 devices."

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/policies/mobileDeviceManagementPolicies" -Beta).value

    } catch {

        Write-Verbose "Failed to get MDM Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    # Permission Grant Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Permission Grant Policy"

    $DocSecSingle.Text = "A permission grant policy is used to specify the conditions under which consent can be granted. A permission grant policy consists of a list of includes condition sets, and a list of excludes condition sets. For an event to match a permission grant policy, it must match at least one of the includes conditions sets, and none of the excludes condition sets."

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/policies/permissionGrantPolicies" -Beta).value

    } catch {

        Write-Verbose "Failed to get Permission Grant Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    # Home Realm Discovery Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Home Realm Discovery Policy"

    $DocSecSingle.Text = "Represents a policy to control Azure Active Directory authentication behavior for federated users, in particular for auto-acceleration and user authentication restrictions in federated domains. You can set homeRealmDiscoveryPolicy for all service principals in your organization, or for specific service principals in your organization. For more scenario and policy details see Configure Azure AD sign in behavior for an application by using a Home Realm Discovery policy as well as Sign-in to Azure Active Directory using email as an alternate login ID."

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/policies/homeRealmDiscoveryPolicies" -Beta).value

    } catch {

        Write-Verbose "Failed to get Home Realm Discovery Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    # Activity Based Timeout Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Activity Based Timeout Policy"

    $DocSecSingle.Text = "Represents a policy that can control the idle timeout for web sessions for applications that support activity-based timeout functionality. Applications enforce automatic signout after a period of inactivity. This type of policy can only be applied at the organization level (by setting the isOrganizationDefault property to true)."

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/policies/activityBasedTimeoutPolicies" -Beta).value

    } catch {

        Write-Verbose "Failed to get Activity Based Timeout Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    # Token Issuance Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Token Issuance Policy"

    $DocSecSingle.Text = "Represents the policy to specify the characteristics of SAML tokens issued by Azure AD. You can use token-issuance policies to:

    Set signing options

    Set signing algorithm

    Set SAML token version"

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/policies/tokenIssuancePolicies" -Beta).value

    } catch {

        Write-Verbose "Failed to get Toke Issuance Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    # Token Lifetime Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Token Lifetime Policy"

    $DocSecSingle.Text = "Represents a policy that can control the lifetime of a JWT access token, an ID token or a SAML 1.1/2.0 token issued by Azure Active Directory (Azure AD). You can set token lifetimes for all apps in your organization, for a multi-tenant (multi-organization) application, or for a specific service principal in your organization. For more scenario details see Configurable token lifetimes in Azure Active Directory.

    Note: Configuring this policy for Refresh Tokens and Session Tokens is not supported."

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/policies/tokenLifetimePolicies" -Beta).value

    } catch {

        Write-Verbose "Failed to get Token Lifetime Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    # Security Defaults Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Security Defaults Policy"

    $DocSecSingle.Text = "Represents the Azure Active Directory security defaults policy. Security defaults contain preconfigured security settings that protect against common attacks."

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/policies/identitySecurityDefaultsEnforcementPolicy" -Beta)

    } catch {

        Write-Verbose "Failed to get Security Defaults Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    # Continuous Access Evaluation Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Continuous Access Evaluation Policy"

    $DocSecSingle.Text = "Continuous Access Evaluation (CAE) manages authentication sessions in real time. CAE allows customers to handle access to resources by supporting instant revocation events."

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/identity/continuousAccessEvaluationPolicy" -Beta)

    } catch {

        Write-Verbose "Failed to get Continuous Access Evaluation (CAE) Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    # Authorization Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Authorization Policy"

    $DocSecSingle.Text = "Represents a policy that can control Azure Active Directory authorization settings. It's a singleton that inherits from base policy type, and always exists for the tenant."

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/policies/authorizationPolicy/authorizationPolicy" -Beta)

    } catch {

        Write-Verbose "Failed to get Authorization Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    # Feature Rollout Policy

    $DocSecSingle = New-Object DocSection

    $DocSecSingle.Title = "Feature rollout policy"

    $DocSecSingle.Text = "Creating a feature rollout policy helps tenant administrators to pilot features of Azure AD with a specific group before enabling features for entire organization. This minimizes the impact and helps administrators to test and rollout authentication related features gradually."

    $DocSecSingle.SubSections = @()

    try{

        $DocSecSingle.Objects = (Invoke-DocGraph -Path "/policies/featureRolloutPolicies" -Beta)

    } catch {

        Write-Verbose "Failed to get Feature rollout Policy Configuration. This may be because it is not configured in your tenant."

    }

    $DocSecSingle.Transpose = $true

    $DocSec.SubSections += $DocSecSingle

    if($null -eq $DocSec.SubSections){

        return $null

    } else {

        return $DocSec

    }

}

# SIG # Begin signature block

# MIIbhQYJKoZIhvcNAQcCoIIbdjCCG3ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB

# gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR

# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUdOSfGnmR70nSMmhJk3FFoWiv

# rWugghahMIIE/jCCA+agAwIBAgIQDUJK4L46iP9gQCHOFADw3TANBgkqhkiG9w0B

# AQsFADByMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYD

# VQQLExB3d3cuZGlnaWNlcnQuY29tMTEwLwYDVQQDEyhEaWdpQ2VydCBTSEEyIEFz

# c3VyZWQgSUQgVGltZXN0YW1waW5nIENBMB4XDTIxMDEwMTAwMDAwMFoXDTMxMDEw

# NjAwMDAwMFowSDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMu

# MSAwHgYDVQQDExdEaWdpQ2VydCBUaW1lc3RhbXAgMjAyMTCCASIwDQYJKoZIhvcN

# AQEBBQADggEPADCCAQoCggEBAMLmYYRnxYr1DQikRcpja1HXOhFCvQp1dU2UtAxQ

# tSYQ/h3Ib5FrDJbnGlxI70Tlv5thzRWRYlq4/2cLnGP9NmqB+in43Stwhd4CGPN4

# bbx9+cdtCT2+anaH6Yq9+IRdHnbJ5MZ2djpT0dHTWjaPxqPhLxs6t2HWc+xObTOK

# fF1FLUuxUOZBOjdWhtyTI433UCXoZObd048vV7WHIOsOjizVI9r0TXhG4wODMSlK

# XAwxikqMiMX3MFr5FK8VX2xDSQn9JiNT9o1j6BqrW7EdMMKbaYK02/xWVLwfoYer

# vnpbCiAvSwnJlaeNsvrWY4tOpXIc7p96AXP4Gdb+DUmEvQECAwEAAaOCAbgwggG0

# MA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMBYGA1UdJQEB/wQMMAoGCCsG

# AQUFBwMIMEEGA1UdIAQ6MDgwNgYJYIZIAYb9bAcBMCkwJwYIKwYBBQUHAgEWG2h0

# dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAfBgNVHSMEGDAWgBT0tuEgHf4prtLk

# YaWyoiWyyBc1bjAdBgNVHQ4EFgQUNkSGjqS6sGa+vCgtHUQ23eNqerwwcQYDVR0f

# BGowaDAyoDCgLoYsaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL3NoYTItYXNzdXJl

# ZC10cy5jcmwwMqAwoC6GLGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zaGEyLWFz

# c3VyZWQtdHMuY3JsMIGFBggrBgEFBQcBAQR5MHcwJAYIKwYBBQUHMAGGGGh0dHA6

# Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBPBggrBgEFBQcwAoZDaHR0cDovL2NhY2VydHMu

# ZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJRFRpbWVzdGFtcGluZ0NB

# LmNydDANBgkqhkiG9w0BAQsFAAOCAQEASBzctemaI7znGucgDo5nRv1CclF0CiNH

# o6uS0iXEcFm+FKDlJ4GlTRQVGQd58NEEw4bZO73+RAJmTe1ppA/2uHDPYuj1UUp4

# eTZ6J7fz51Kfk6ftQ55757TdQSKJ+4eiRgNO/PT+t2R3Y18jUmmDgvoaU+2QzI2h

# F3MN9PNlOXBL85zWenvaDLw9MtAby/Vh/HUIAHa8gQ74wOFcz8QRcucbZEnYIpp1

# FUL1LTI4gdr0YKK6tFL7XOBhJCVPst/JKahzQ1HavWPWH1ub9y4bTxMd90oNcX6X

# t/Q/hOvB46NJofrOp79Wz7pZdmGJX36ntI5nePk2mOHLKNpbh6aKLzCCBTEwggQZ

# oAMCAQICEAqhJdbWMht+QeQF2jaXwhUwDQYJKoZIhvcNAQELBQAwZTELMAkGA1UE

# BhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj

# ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4X

# DTE2MDEwNzEyMDAwMFoXDTMxMDEwNzEyMDAwMFowcjELMAkGA1UEBhMCVVMxFTAT

# BgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEx

# MC8GA1UEAxMoRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIFRpbWVzdGFtcGluZyBD

# QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL3QMu5LzY9/3am6gpnF

# OVQoV7YjSsQOB0UzURB90Pl9TWh+57ag9I2ziOSXv2MhkJi/E7xX08PhfgjWahQA

# OPcuHjvuzKb2Mln+X2U/4Jvr40ZHBhpVfgsnfsCi9aDg3iI/Dv9+lfvzo7oiPhis

# EeTwmQNtO4V8CdPuXciaC1TjqAlxa+DPIhAPdc9xck4Krd9AOly3UeGheRTGTSQj

# MF287DxgaqwvB8z98OpH2YhQXv1mblZhJymJhFHmgudGUP2UKiyn5HU+upgPhH+f

# MRTWrdXyZMt7HgXQhBlyF/EXBu89zdZN7wZC/aJTKk+FHcQdPK/P2qwQ9d2srOlW

# /5MCAwEAAaOCAc4wggHKMB0GA1UdDgQWBBT0tuEgHf4prtLkYaWyoiWyyBc1bjAf

# BgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzASBgNVHRMBAf8ECDAGAQH/

# AgEAMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDCDB5BggrBgEF

# BQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBD

# BggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0

# QXNzdXJlZElEUm9vdENBLmNydDCBgQYDVR0fBHoweDA6oDigNoY0aHR0cDovL2Ny

# bDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENBLmNybDA6oDig

# NoY0aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9v

# dENBLmNybDBQBgNVHSAESTBHMDgGCmCGSAGG/WwAAgQwKjAoBggrBgEFBQcCARYc

# aHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzALBglghkgBhv1sBwEwDQYJKoZI

# hvcNAQELBQADggEBAHGVEulRh1Zpze/d2nyqY3qzeM8GN0CE70uEv8rPAwL9xafD

# DiBCLK938ysfDCFaKrcFNB1qrpn4J6JmvwmqYN92pDqTD/iy0dh8GWLoXoIlHsS6

# HHssIeLWWywUNUMEaLLbdQLgcseY1jxk5R9IEBhfiThhTWJGJIdjjJFSLK8pieV4

# H9YLFKWA1xJHcLN11ZOFk362kmf7U2GJqPVrlsD0WGkNfMgBsbkodbeZY4UijGHK

# eZR+WfyMD+NvtQEmtmyl7odRIeRYYJu6DC0rbaLEfrvEJStHAgh8Sa4TtuF8QkIo

# xhhWz0E0tmZdtnR79VYzIi8iNrJLokqV2PWmjlIwggWtMIIElaADAgECAhAEP0tn

# 9l4Sf9gdog2gb/SWMA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYTAlVTMRUwEwYD

# VQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi

# BgNVBAMTG0RpZ2lDZXJ0IEVWIENvZGUgU2lnbmluZyBDQTAeFw0yMDAzMDYwMDAw

# MDBaFw0yMzAzMTUxMjAwMDBaMIHOMRMwEQYLKwYBBAGCNzwCAQMTAkNIMRowGAYL

# KwYBBAGCNzwCAQITCVNvbG90aHVybjEdMBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6

# YXRpb24xGDAWBgNVBAUTD0NIRS0zMTQuNjM5LjUyMzELMAkGA1UEBhMCQ0gxEjAQ

# BgNVBAgTCVNvbG90aHVybjERMA8GA1UEBwwIRMOkbmlrZW4xFjAUBgNVBAoTDWJh

# c2VWSVNJT04gQUcxFjAUBgNVBAMTDWJhc2VWSVNJT04gQUcwggEiMA0GCSqGSIb3

# DQEBAQUAA4IBDwAwggEKAoIBAQCn0xZCT8yT681HZVY8gtUlURKywy8Nfq8uiv/j

# JJU+/Tf4HHXXJzHo96ZFo/WOWMD3WMWRYRnpj95PZbfLaF+ki/PURRhp9/oT/p5O

# 3zTv4Jqnig7AOeIL5dt9W5Uij9rDOEZhmFpVT08KCKhMNMMu7MhBs+uHBlyQ70j5

# H2IjBjePtEDYcakbv1RNDK5hU+k2UqKZEQSaqt2+riewxS2R4RUvZJ5nRraf4pNY

# qDdem2H0vJ17zHsG+ZB0YFLk/P3i6r4tJEAksYAUkuJsFDt0Yz9xM2qmG2Rr4iw7

# AUTfE5Gx0NNWD/fMWFP/2sD3VkHA8Mz8PAokDfFz21OqYrXPAgMBAAGjggHtMIIB

# 6TAfBgNVHSMEGDAWgBStaQZw/IAbFrOpGJRrlAKGXvcnjDAdBgNVHQ4EFgQURdlk

# /2RkqKDvZs8sol0UhzmJTCowNwYDVR0RBDAwLqAsBggrBgEFBQcIA6AgMB4MHENI

# LVNPTE9USFVSTi1DSEUtMzE0LjYzOS41MjMwDgYDVR0PAQH/BAQDAgeAMBMGA1Ud

# JQQMMAoGCCsGAQUFBwMDMHMGA1UdHwRsMGowM6AxoC+GLWh0dHA6Ly9jcmwzLmRp

# Z2ljZXJ0LmNvbS9FVkNvZGVTaWduaW5nLWcxLmNybDAzoDGgL4YtaHR0cDovL2Ny

# bDQuZGlnaWNlcnQuY29tL0VWQ29kZVNpZ25pbmctZzEuY3JsMEsGA1UdIAREMEIw

# NwYJYIZIAYb9bAMCMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0

# LmNvbS9DUFMwBwYFZ4EMAQMweQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhho

# dHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYWNl

# cnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEVWQ29kZVNpZ25pbmdDQS5jcnQwDAYD

# VR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAGYerL9YA8gW4cx7nWEaDFpN2

# XnaY4+90Nl8gaj6aeQj6kwIfjWLWAzByDdVNvxSkrwXdfo3dkG5DNNI3wPR2SE2i

# yImDF6zXTThccBqkwE1x1Tb5qfhaA48jf18f8JbvVgvtbZWXph1b+ALyD2911b34

# Qt6cYmolg19vkmWXZUADRjA11S3VHhhH4GLKeHoE23jSSs69tQPNC1jdS+Rx6yO/

# Ya14UrDwOrJo1qSn2xTilf9s77mSxRJCpL8Cd1PUHPvugUFHLw9nqOQAMUb7cHdD

# UREs7Brvfcyo0qRx7lyKjIM1d0wGtiBz+8kQJcSCdK9S8HGSD3y4R1N++Y8gYTCC

# BrUwggWdoAMCAQICEA3Q4zdKyVvb+mtDSypI7AYwDQYJKoZIhvcNAQEFBQAwbDEL

# MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3

# LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug

# RVYgUm9vdCBDQTAeFw0xMjA0MTgxMjAwMDBaFw0yNzA0MTgxMjAwMDBaMGUxCzAJ

# BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5k

# aWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEVWIENvZGUgU2lnbmluZyBD

# QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALkGdBxdtCCqqSGoKkJG

# qyUgFyXLIo+QoqAxa4MFda+yDnwSSXtqhmSED4PcZLmxbhYFPhyVuefniG24YoGQ

# edTd9eKW+cO1iCNXShrPcSnpCACPtZjjpzL9rC649JNT9Ao5Q5Gv1Wvo1J9GvY49

# q+L5K9TqAEBmJLfof7REdY14mq4xwTfPTh9b+EVK1z/CyZIGZL7eBoqv0OiKsfAs

# iABvC9yFp0zLBr/WLioybilxr44i8w/Q2JhILagIy7aLI8Jj4LZz6299Jk+L9zQ9

# N4YMt3gn9MKG20NrWvg9PfTosGJWxufteKH7/XpyTzJlxHzDxHegBDIy7Y8/r4bd

# ftECAwEAAaOCA1gwggNUMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQD

# AgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMDMH8GCCsGAQUFBwEBBHMwcTAkBggrBgEF

# BQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEkGCCsGAQUFBzAChj1odHRw

# Oi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZS

# b290Q0EuY3J0MIGPBgNVHR8EgYcwgYQwQKA+oDyGOmh0dHA6Ly9jcmwzLmRpZ2lj

# ZXJ0LmNvbS9EaWdpQ2VydEhpZ2hBc3N1cmFuY2VFVlJvb3RDQS5jcmwwQKA+oDyG

# Omh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEhpZ2hBc3N1cmFuY2VF

# VlJvb3RDQS5jcmwwggHEBgNVHSAEggG7MIIBtzCCAbMGCWCGSAGG/WwDAjCCAaQw

# OgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cuZGlnaWNlcnQuY29tL3NzbC1jcHMtcmVw

# b3NpdG9yeS5odG0wggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUA

# IABvAGYAIAB0AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4A

# cwB0AGkAdAB1AHQAZQBzACAAYQBjAGMAZQBwAHQAYQBuAGMAZQAgAG8AZgAgAHQA

# aABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQAC8AQwBQAFMAIABhAG4AZAAgAHQA

# aABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUAZQBtAGUA

# bgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkA

# IABhAG4AZAAgAGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUA

# cgBlAGkAbgAgAGIAeQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wHQYDVR0OBBYEFK1p

# BnD8gBsWs6kYlGuUAoZe9yeMMB8GA1UdIwQYMBaAFLE+w2kD+L9HAdSYJhoIAu9j

# ZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQCeW5Y6LhKIrKsBbaSfdeQBh6OlMte8uql+

# o9YUF/fCE2t8c48rauUPJllosI4lm2zv+myTkgjBTc9FnpxG1h50oZsUo/oBL0qx

# AeFyQEgRE2i5Np2RS9fCORIQwcTcu2IUFCphXU84fGYfxhv/rb5Pf5Rbc0MAD01z

# t1HPDvZ3wFvNNIzZYxOqDmER1vKOJ/y0e7i5ESCRhnjqDtQo/yrVJDjoN7Lslruf

# vEoWUOFev1F9I6Ayx8GUnnrJwCaizCWHoBJ+dJ8tjbHI54S+udHp3rtqTohzceEi

# OMskh+lzflGy/5jrTn4v4MoO+rNe0boFQqhIn4P2P8TKqN9ooFBhMYIETjCCBEoC

# AQEweTBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYD

# VQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBFViBDb2Rl

# IFNpZ25pbmcgQ0ECEAQ/S2f2XhJ/2B2iDaBv9JYwCQYFKw4DAhoFAKB4MBgGCisG

# AQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQw

# HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwIwYJKoZIhvcNAQkEMRYEFEOV

# DTkrMMVGKZhkaXoCQyETqLBuMA0GCSqGSIb3DQEBAQUABIIBAF9RYPkkUzKfMxZ9

# PujcCRXGmjo3tVoT50XwZgRDqEpeDf1oHEnb4h2WSzhNpED//QqditWZ0HctrTOP

# V2nvCvWCiktOW4JtyNSpTURdmT+22GwCFAJj2pj7/RKZijP83jPx/InxUX93PhJv

# MKwdd6NblptBpotiUjFT1tIOKBZ2bPYidcTBJxK9qBRzx9beiMHZbc9335RgNzxs

# 8GqU+pPqh9vmkZwl7P3Qor33HPkCoe4TKbhZ5oY0Qizy09R/K/laUDWeZWo4eqB7

# rk7OuCisxPUF9PURFUShUrTCbGvvWZ7VgH2DtrMPziMia4YoHA/jG3N1UdKaePqD

# v2Ab5umhggIwMIICLAYJKoZIhvcNAQkGMYICHTCCAhkCAQEwgYYwcjELMAkGA1UE

# BhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj

# ZXJ0LmNvbTExMC8GA1UEAxMoRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIFRpbWVz

# dGFtcGluZyBDQQIQDUJK4L46iP9gQCHOFADw3TANBglghkgBZQMEAgEFAKBpMBgG

# CSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIxMTAyNjA2

# MjMyMVowLwYJKoZIhvcNAQkEMSIEIKYDcXJFkIK43ysPhjbxanz0Cz2a1hhVoJNE

# QREqnQJMMA0GCSqGSIb3DQEBAQUABIIBAK02bFRL2sW2yeCtCqMMSGx7330zC+X6

# c788wY8n+1ich1MNwGom/CXryNMOmUk3wsywBYhavOEHBMmnzcKYmFyPkwCs73ND

# hr2LxjXsyQ+x49Svx0s/QYZYRnUFUu8Li8CKNuuWw5l3rqy7aKhwFGHIR/R+ssiI

# vxgh/Uul+JB2Q/BTT2NMClZCSoeMY/o2dlZnzoz3uNRjyCYcW34ZlHJfh7C/HvkO

# D/NSB+tSDosAKCS7r+n7qiaxIiYbWb7QA3gRloQRFYimzGpyqAx0HLicWqxsjj4C

# JKOcU+iVqNS/k3kxNBpGPI9sBaRPesvPQrYMNpAfDhl+i8qLNLTLX5g=

# SIG # End signature block