Enable public Azure Files roaming deployment

scripts/Enable-SguAzureUserRoaming.ps1

@@ -21,6 +21,8 @@ param(
     [string]$AdministrativeGroupName = 'SGU-Administrativos',
     [string]$StudentGpoName = 'SGU - AL redirected folders',
     [string]$StaffGpoName = 'SGU - AD-DO FSLogix profiles',
+    [ValidateSet('Private', 'Public')]
+    [string]$EndpointAccess = 'Private',
     [ValidateRange(1024, 1048576)]
     [int]$FsLogixProfileSizeMiB = 30000,
     [string]$AzFilesHybridModulePath,
@@ -76,13 +78,13 @@ function Import-SguAzFilesHybrid {
 function Get-SguStorageSamAccountName {
     param([Parameter(Mandatory)][string]$StorageName)
 
-    if ($StorageName.Length -le 20) {
+    if ($StorageName.Length -le 15) {
         return $StorageName
     }
     $sha256 = [Security.Cryptography.SHA256]::Create()
     try {
         $hash = $sha256.ComputeHash([Text.Encoding]::UTF8.GetBytes($StorageName))
-        $suffix = ([BitConverter]::ToString($hash) -replace '-', '').Substring(0, 15).ToLowerInvariant()
+        $suffix = ([BitConverter]::ToString($hash) -replace '-', '').Substring(0, 10).ToLowerInvariant()
         return "sgufs$suffix"
     }
     finally {
@@ -322,15 +324,19 @@ if ($PSCmdlet.ShouldProcess($StorageAccountName, 'Grant authenticated AD identit
         -DefaultSharePermission StorageFileDataSmbShareContributor
 }
 
-$privateAddresses = @(Resolve-DnsName -Name $fileEndpointHost -Type A -ErrorAction Stop |
+$endpointAddresses = @(Resolve-DnsName -Name $fileEndpointHost -Type A -ErrorAction Stop |
     Where-Object IPAddress | Select-Object -ExpandProperty IPAddress)
-if ($privateAddresses.Count -eq 0 -or @($privateAddresses | Where-Object {
-            $_ -match '^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)'
-        }).Count -eq 0) {
+if ($endpointAddresses.Count -eq 0) {
+    throw "$fileEndpointHost did not resolve to an IPv4 address."
+}
+$privateAddresses = @($endpointAddresses | Where-Object {
+        $_ -match '^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)'
+    })
+if ($EndpointAccess -eq 'Private' -and $privateAddresses.Count -eq 0) {
     throw "$fileEndpointHost did not resolve to a private endpoint. Verify the privatelink.file.core.windows.net VNet link and the DC Azure DNS forwarder."
 }
 if (-not (Test-NetConnection -ComputerName $fileEndpointHost -Port 445 -InformationLevel Quiet)) {
-    throw "The domain controller cannot reach $fileEndpointHost on TCP 445 through the private endpoint."
+    throw "The domain controller cannot reach $fileEndpointHost on TCP 445 using the selected $EndpointAccess endpoint."
 }
 
 $storageKey = @(Get-AzStorageAccountKey -ResourceGroupName $ResourceGroupName `
@@ -344,23 +350,24 @@ $storageCredential = [PSCredential]::new(
     (ConvertTo-SecureString -String $storageKey -AsPlainText -Force))
 $profilesSharePath = "\\$fileEndpointHost\$FsLogixProfilesShareName"
 $redirectedFoldersSharePath = "\\$fileEndpointHost\$RedirectedFoldersShareName"
+$perUserRootRights = [Security.AccessControl.FileSystemRights]::CreateDirectories -bor
+    [Security.AccessControl.FileSystemRights]::ListDirectory -bor
+    [Security.AccessControl.FileSystemRights]::ReadAttributes -bor
+    [Security.AccessControl.FileSystemRights]::ReadExtendedAttributes -bor
+    [Security.AccessControl.FileSystemRights]::ReadPermissions -bor
+    [Security.AccessControl.FileSystemRights]::Traverse -bor
+    [Security.AccessControl.FileSystemRights]::Synchronize
 try {
     if ($PSCmdlet.ShouldProcess($profilesSharePath, 'Apply isolated FSLogix root ACLs')) {
         Set-SguAzureFileRootAcl -UncPath $profilesSharePath -Credential $storageCredential `
             -DomainAdminsSid $domainAdminsSid `
-            -ContributorSids @($professorGroup.SID, $administrativeGroup.SID)
+            -ContributorSids @($professorGroup.SID, $administrativeGroup.SID) `
+            -ContributorRights $perUserRootRights
     }
     if ($PSCmdlet.ShouldProcess($redirectedFoldersSharePath, 'Apply isolated student-folder root ACLs')) {
-        $studentRootRights = [Security.AccessControl.FileSystemRights]::CreateDirectories -bor
-            [Security.AccessControl.FileSystemRights]::ListDirectory -bor
-            [Security.AccessControl.FileSystemRights]::ReadAttributes -bor
-            [Security.AccessControl.FileSystemRights]::ReadExtendedAttributes -bor
-            [Security.AccessControl.FileSystemRights]::ReadPermissions -bor
-            [Security.AccessControl.FileSystemRights]::Traverse -bor
-            [Security.AccessControl.FileSystemRights]::Synchronize
         Set-SguAzureFileRootAcl -UncPath $redirectedFoldersSharePath -Credential $storageCredential `
             -DomainAdminsSid $domainAdminsSid -ContributorSids @($studentGroup.SID) `
-            -ContributorRights $studentRootRights
+            -ContributorRights $perUserRootRights
     }
 }
 finally {
@@ -415,6 +422,8 @@ foreach ($staffGroup in @($professorGroup, $administrativeGroup)) {
 [pscustomobject]@{
     StorageAccountName = $StorageAccountName
     FileEndpoint = $fileEndpointHost
+    EndpointAccess = $EndpointAccess
+    EndpointAddresses = $endpointAddresses
     PrivateEndpointAddresses = $privateAddresses
     DirectoryService = $directoryService
     KerberosEncryption = 'AES256'