Skip to content

Commit 03bb77a

Browse files
pull[bot]pull[bot]
authored
Merge pull request #392 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents 4c3753d + e113e57 commit 03bb77a

10 files changed

+446
-8
lines changed

‎ConversionTable.csv‎

Lines changed: 95 additions & 0 deletions
Large diffs are not rendered by default.

‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertNewAppApproval.ps1‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ function Get-CIPPAlertNewAppApproval {
1515
try {
1616
$Approvals = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/identityGovernance/appConsent/appConsentRequests?`$filter=userConsentRequests/any (u:u/status eq 'InProgress')" -tenantid $TenantFilter
1717
if ($Approvals.count -gt 0) {
18+
$TenantGUID = (Get-Tenants -TenantFilter $TenantFilter -SkipDomains).customerId
1819
$AlertData = [System.Collections.Generic.List[PSCustomObject]]::new()
1920
foreach ($App in $Approvals) {
2021
$userConsentRequests = New-GraphGetRequest -Uri "https://graph.microsoft.com/v1.0/identityGovernance/appConsent/appConsentRequests/$($App.id)/userConsentRequests" -tenantid $TenantFilter
@@ -29,13 +30,17 @@ function Get-CIPPAlertNewAppApproval {
2930
}
3031

3132
$Message = [PSCustomObject]@{
33+
RequestId = $_.id
3234
AppName = $App.appDisplayName
3335
RequestUser = $_.createdBy.user.userPrincipalName
3436
Reason = $_.reason
37+
RequestDate = $_.createdDateTime
38+
Status = $_.status # Will allways be InProgress as we filter to only get these but this will reduce confusion when an alert is generated
3539
AppId = $App.appId
3640
Scopes = ($App.pendingScopes.displayName -join ', ')
3741
ConsentURL = $consentUrl
3842
Tenant = $TenantFilter
43+
TenantId = $TenantGUID
3944
}
4045
$AlertData.Add($Message)
4146
}

‎Modules/CIPPCore/Public/ConversionTable.csv‎

Lines changed: 95 additions & 0 deletions
Large diffs are not rendered by default.

‎Modules/CIPPCore/Public/Entrypoints/Invoke-ListLogs.ps1‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,42 @@ function Invoke-ListLogs {
2323
label = $_.PartitionKey
2424
}
2525
}
26+
} elseif ($Request.Query.logentryid) {
27+
# Return single log entry by RowKey
28+
$Filter = "RowKey eq '{0}'" -f $Request.Query.logentryid
29+
$AllowedTenants = Test-CIPPAccess -Request $Request -TenantList
30+
Write-Host "Getting single log entry for RowKey: $($Request.Query.logentryid)"
31+
32+
$Row = Get-AzDataTableEntity @Table -Filter $Filter
33+
34+
if ($Row) {
35+
if ($AllowedTenants -notcontains 'AllTenants') {
36+
$TenantList = Get-Tenants -IncludeErrors | Where-Object { $_.customerId -in $AllowedTenants }
37+
}
38+
39+
if ($AllowedTenants -contains 'AllTenants' -or ($AllowedTenants -notcontains 'AllTenants' -and ($TenantList.defaultDomainName -contains $Row.Tenant -or $Row.Tenant -eq 'CIPP' -or $TenantList.customerId -contains $Row.TenantId)) ) {
40+
$LogData = if ($Row.LogData -and (Test-Json -Json $Row.LogData -ErrorAction SilentlyContinue)) {
41+
$Row.LogData | ConvertFrom-Json
42+
} else { $Row.LogData }
43+
[PSCustomObject]@{
44+
DateTime = $Row.Timestamp
45+
Tenant = $Row.Tenant
46+
API = $Row.API
47+
Message = $Row.Message
48+
User = $Row.Username
49+
Severity = $Row.Severity
50+
LogData = $LogData
51+
TenantID = if ($Row.TenantID -ne $null) {
52+
$Row.TenantID
53+
} else {
54+
'None'
55+
}
56+
AppId = $Row.AppId
57+
IP = $Row.IP
58+
RowKey = $Row.RowKey
59+
}
60+
}
61+
}
2662
} else {
2763
if ($request.Query.Filter -eq 'True') {
2864
$LogLevel = if ($Request.Query.Severity) { ($Request.query.Severity).split(',') } else { 'Info', 'Warn', 'Error', 'Critical', 'Alert' }
@@ -86,6 +122,7 @@ function Invoke-ListLogs {
86122
}
87123
AppId = $Row.AppId
88124
IP = $Row.IP
125+
RowKey = $Row.RowKey
89126
}
90127
}
91128
}

‎Modules/CIPPCore/Public/GraphHelper/New-GraphBulkRequest.ps1‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,20 @@ function New-GraphBulkRequest {
5858
}
5959

6060
} catch {
61-
$Message = ($_.ErrorDetails.Message | ConvertFrom-Json -ErrorAction SilentlyContinue).error.message
62-
if ($null -eq $Message) { $Message = $($_.Exception.Message) }
61+
# Try to parse ErrorDetails.Message as JSON
62+
if ($_.ErrorDetails.Message) {
63+
try {
64+
$ErrorJson = $_.ErrorDetails.Message | ConvertFrom-Json -ErrorAction Stop
65+
$Message = $ErrorJson.error.message
66+
} catch {
67+
$Message = $_.ErrorDetails.Message
68+
}
69+
}
70+
71+
if ([string]::IsNullOrEmpty($Message)) {
72+
$Message = $_.Exception.Message
73+
}
74+
6375
if ($Message -ne 'Request not applicable to target tenant.') {
6476
$Tenant.LastGraphError = $Message ?? ''
6577
$Tenant.GraphErrorCount++

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,12 @@ function Invoke-CIPPStandardAuthMethodsPolicyMigration {
3030
param($Tenant, $Settings)
3131
$CurrentInfo = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy' -tenantid $Tenant
3232

33+
if ($null -eq $CurrentInfo) {
34+
throw "Failed to retrieve current authentication methods policy information"
35+
}
36+
3337
if ($Settings.remediate -eq $true) {
34-
if ($CurrentInfo.policyMigrationState -eq 'migrationComplete') {
38+
if ($CurrentInfo.policyMigrationState -eq 'migrationComplete' -or $null -eq $CurrentInfo.policyMigrationState) {
3539
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Authentication methods policy migration is already complete.' -sev Info
3640
} else {
3741
try {
@@ -44,14 +48,14 @@ function Invoke-CIPPStandardAuthMethodsPolicyMigration {
4448
}
4549

4650
if ($Settings.alert -eq $true) {
47-
if ($CurrentInfo.policyMigrationState -ne 'migrationComplete') {
51+
if ($CurrentInfo.policyMigrationState -ne 'migrationComplete' -and $null -ne $CurrentInfo.policyMigrationState) {
4852
Write-StandardsAlert -message 'Authentication methods policy migration is not complete. Please check if you have legacy SSPR settings or MFA settings set: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-methods-manage' -object $CurrentInfo -tenant $tenant -standardName 'AuthMethodsPolicyMigration' -standardId $Settings.standardId
4953
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Authentication methods policy migration is not complete' -sev Alert
5054
}
5155
}
5256

5357
if ($Settings.report -eq $true) {
54-
$migrationComplete = $CurrentInfo.policyMigrationState -eq 'migrationComplete'
58+
$migrationComplete = $CurrentInfo.policyMigrationState -eq 'migrationComplete' -or $null -eq $CurrentInfo.policyMigrationState
5559
Set-CIPPStandardsCompareField -FieldName 'standards.AuthMethodsPolicyMigration' -FieldValue $migrationComplete -TenantFilter $tenant
5660
Add-CIPPBPAField -FieldName 'AuthMethodsPolicyMigration' -FieldValue $migrationComplete -StoreAs bool -Tenant $tenant
5761
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ function Invoke-CIPPStandardDisableBasicAuthSMTP {
5959
# Disable SMTP Basic Authentication for all users
6060
$SMTPusers | ForEach-Object {
6161
try {
62-
New-ExoRequest -tenantid $Tenant -cmdlet 'Set-CASMailbox' -cmdParams @{ Identity = $_.Identity; SmtpClientAuthenticationDisabled = $null } -UseSystemMailbox $true
62+
New-ExoRequest -tenantid $Tenant -cmdlet 'Set-CASMailbox' -cmdParams @{ Identity = $_.Guid; SmtpClientAuthenticationDisabled = $null } -UseSystemMailbox $true
6363
Write-LogMessage -API 'Standards' -tenant $tenant -message "Disabled SMTP Basic Authentication for $($_.DisplayName), $($_.PrimarySmtpAddress)" -sev Info
6464
} catch {
6565
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ function Invoke-CIPPStandardDisableExchangeOnlinePowerShell {
4444
try {
4545

4646
$AdminUsers = (New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?$expand=principal' -tenantid $Tenant).principal.userPrincipalName
47-
$UsersWithPowerShell = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-User' -Select 'userPrincipalName, identity, remotePowerShellEnabled' | Where-Object { $_.RemotePowerShellEnabled -eq $true -and $_.userPrincipalName -notin $AdminUsers }
47+
$UsersWithPowerShell = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-User' -Select 'userPrincipalName, identity, guid, remotePowerShellEnabled' | Where-Object { $_.RemotePowerShellEnabled -eq $true -and $_.userPrincipalName -notin $AdminUsers }
4848
$PowerShellEnabledCount = ($UsersWithPowerShell | Measure-Object).Count
4949
$StateIsCorrect = $PowerShellEnabledCount -eq 0
5050
} catch {
@@ -61,7 +61,7 @@ function Invoke-CIPPStandardDisableExchangeOnlinePowerShell {
6161
@{
6262
CmdletInput = @{
6363
CmdletName = 'Set-User'
64-
Parameters = @{Identity = $_.Identity; RemotePowerShellEnabled = $false }
64+
Parameters = @{Identity = $_.Guid; RemotePowerShellEnabled = $false }
6565
}
6666
}
6767
}

0 commit comments

Comments
 (0)