Made changes as per Alek's suggestions

Author: aahmed-spec

src/powershell/private/tests-shared/Get-ZtEmergencyAccessAccounts.ps1

@@ -75,7 +75,12 @@ function Get-ZtEmergencyAccessAccounts {
                 $sql = "SELECT id, userPrincipalName, displayName FROM User WHERE LOWER(userPrincipalName) = '$escapedUpn'"
             }
             elseif ($id) {
-                $escapedId = $id -replace "'", "''"
+                $guidRef = [System.Guid]::Empty
+                if (-not [System.Guid]::TryParse($id, [ref]$guidRef)) {
+                    Write-PSFMessage "Skipping invalid user entry: Id '$id' is not a valid GUID" -Level Warning
+                    continue
+                }
+                $escapedId = $guidRef.ToString()
                 $sql = "SELECT id, userPrincipalName, displayName FROM User WHERE id = '$escapedId'"
             }
             else {
@@ -104,27 +109,45 @@ function Get-ZtEmergencyAccessAccounts {
                 continue
             }
 
+            $guidRef = [System.Guid]::Empty
+            if (-not [System.Guid]::TryParse($id, [ref]$guidRef)) {
+                Write-PSFMessage "Skipping invalid group entry: Id '$id' is not a valid GUID" -Level Warning
+                continue
+            }
+
             # Resolve group members via Microsoft Graph API (GroupMember table not available in DB)
             try {
                 Write-PSFMessage "Resolving emergency access group members via Graph API: Id=$id" -Level Verbose
-                $membersResponse = Get-ZtGroupMember -GroupId $id -ErrorAction Stop
+                $membersResponse = Get-ZtGroupMember -GroupId $id -Recurse -ErrorAction Stop
                 $members = @($membersResponse | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.user' })
 
                 if ($members.Count -gt 0) {
-                    # Batch all member ids into a single SQL lookup to avoid N+1 queries
-                    $escapedIds = $members | ForEach-Object { "'" + (($_.id) -replace "'", "''") + "'" }
-                    $idList = $escapedIds -join ','
-                    $memberSql = "SELECT id, userPrincipalName, displayName FROM User WHERE id IN ($idList)"
-                    $userDetailsList = @(Invoke-DatabaseQuery -Database $Database -Sql $memberSql)
-
-                    foreach ($userDetails in $userDetailsList) {
-                        $emergencyAccessAccounts += [PSCustomObject]@{
-                            Id                = $userDetails.id
-                            UserPrincipalName = $userDetails.userPrincipalName
-                            DisplayName       = $userDetails.displayName
-                            Type              = 'GroupMember'
+                    # Batch all member IDs into a single SQL lookup to avoid N+1 queries;
+                    # member IDs come from Graph API responses which are always valid GUIDs.
+                    $escapedIds = $members | ForEach-Object {
+                        $memberGuid = [System.Guid]::Empty
+                        if ([System.Guid]::TryParse($_.id, [ref]$memberGuid)) {
+                            "'" + $memberGuid.ToString() + "'"
+                        }
+                    } | Where-Object { $_ }
+
+                    if (-not $escapedIds) {
+                        Write-PSFMessage "Emergency access group members had no valid GUIDs: Id=$id" -Level Warning
+                    }
+                    else {
+                        $idList = $escapedIds -join ','
+                        $memberSql = "SELECT id, userPrincipalName, displayName FROM User WHERE id IN ($idList)"
+                        $userDetailsList = @(Invoke-DatabaseQuery -Database $Database -Sql $memberSql)
+
+                        foreach ($userDetails in $userDetailsList) {
+                            $emergencyAccessAccounts += [PSCustomObject]@{
+                                Id                = $userDetails.id
+                                UserPrincipalName = $userDetails.userPrincipalName
+                                DisplayName       = $userDetails.displayName
+                                Type              = 'GroupMember'
+                            }
+                            Write-PSFMessage "Emergency access group member found: $($userDetails.userPrincipalName)" -Level Verbose
                         }
-                        Write-PSFMessage "Emergency access group member found: $($userDetails.userPrincipalName)" -Level Verbose
                     }
                 }
                 else {

src/powershell/tests/Test-Assessment.21815.ps1

@@ -46,8 +46,8 @@ from vwRole
     $emergencyAccountIds = @($emergencyAccounts | Select-Object -ExpandProperty Id)
 
     # Filter out emergency access accounts from the results
-    $results = @($permanentPrivileged | Where-Object { $emergencyAccountIds -notcontains $_.principalId })
-    $excludedEmergencyAccounts = @($permanentPrivileged | Where-Object { $emergencyAccountIds -contains $_.principalId })
+    $results = @($permanentPrivileged | Where-Object { $_.principalId -notin $emergencyAccountIds })
+    $excludedEmergencyAccounts = @($permanentPrivileged | Where-Object { $_.principalId -in $emergencyAccountIds })
 
     # Count of *distinct* excluded emergency accounts (one user can have multiple permanent role assignments)
     $excludedAccountCount = @($excludedEmergencyAccounts | Select-Object -ExpandProperty principalId -Unique).Count
@@ -113,7 +113,7 @@ The following emergency access accounts were excluded from this check as they ar
 '@
         foreach ($emergency in $excludedEmergencyAccounts) {
             $portalLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AdministrativeRole/userId/{0}/hidePreviewBanner~/true' -f $emergency.principalId
-            $emergencySection += "| [$(Get-SafeMarkdown($emergency.principalDisplayName))]($portalLink) | $(Get-SafeMarkdown($emergency.userPrincipalName)) | $(Get-SafeMarkdown($emergency.roleDisplayName)) |`n"
+            $emergencySection += "| [$(Get-SafeMarkdown($emergency.principalDisplayName))]($portalLink) | $($emergency.userPrincipalName) | $($emergency.roleDisplayName) |`n"
         }
     }