Skip to content

Commit 0f815bb

Browse files
KelvinTegelaarKelvinTegelaar
authored
Merge pull request KelvinTegelaar#1756 from kris6673/fix-app-prot
Fix: Fix app protection policies not being listed
2 parents c761bb9 + 59838cd commit 0f815bb

File tree

1 file changed

+39
-41
lines changed

1 file changed

+39
-41
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1‎

Lines changed: 39 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
@{
2626
id = 'ManagedAppPolicies'
2727
method = 'GET'
28-
url = '/deviceAppManagement/managedAppPolicies?$expand=assignments&$orderby=displayName'
28+
url = '/deviceAppManagement/managedAppPolicies?$orderby=displayName'
2929
}
3030
@{
3131
id = 'MobileAppConfigurations'
@@ -41,60 +41,58 @@
4141

4242
$GraphRequest = [System.Collections.Generic.List[object]]::new()
4343

44-
# Process Managed App Policies - these need separate assignment lookups
44+
# Process Managed App Policies - these need separate assignment lookups as the ManagedAppPolicies endpoint does not support $expand
4545
$ManagedAppPolicies = ($BulkResults | Where-Object { $_.id -eq 'ManagedAppPolicies' }).body.value
4646
if ($ManagedAppPolicies) {
47-
# Build bulk requests for assignments of policies that support them
48-
$AssignmentRequests = [System.Collections.Generic.List[object]]::new()
49-
foreach ($Policy in $ManagedAppPolicies) {
50-
# Only certain policy types support assignments endpoint
51-
$odataType = $Policy.'@odata.type'
52-
if ($odataType -match 'androidManagedAppProtection|iosManagedAppProtection|windowsManagedAppProtection|targetedManagedAppConfiguration') {
53-
$urlSegment = switch -Wildcard ($odataType) {
54-
'*androidManagedAppProtection*' { 'androidManagedAppProtections' }
55-
'*iosManagedAppProtection*' { 'iosManagedAppProtections' }
56-
'*windowsManagedAppProtection*' { 'windowsManagedAppProtections' }
57-
'*targetedManagedAppConfiguration*' { 'targetedManagedAppConfigurations' }
58-
}
59-
if ($urlSegment) {
60-
$AssignmentRequests.Add(@{
61-
id = $Policy.id
62-
method = 'GET'
63-
url = "/deviceAppManagement/$urlSegment('$($Policy.id)')/assignments"
64-
})
47+
# Get all @odata.type and deduplicate them
48+
$OdataTypes = ($ManagedAppPolicies | Select-Object -ExpandProperty '@odata.type' -Unique) -replace '#microsoft.graph.', ''
49+
$ManagedAppPoliciesBulkRequests = foreach ($type in $OdataTypes) {
50+
# Translate to URL segments
51+
$urlSegment = switch ($type) {
52+
'androidManagedAppProtection' { 'androidManagedAppProtections' }
53+
'iosManagedAppProtection' { 'iosManagedAppProtections' }
54+
'mdmWindowsInformationProtectionPolicy' { 'mdmWindowsInformationProtectionPolicies' }
55+
'windowsManagedAppProtection' { 'windowsManagedAppProtections' }
56+
'targetedManagedAppConfiguration' { 'targetedManagedAppConfigurations' }
57+
default { $null }
58+
}
59+
Write-Information "Type: $type => URL Segment: $urlSegment"
60+
if ($urlSegment) {
61+
@{
62+
id = $type
63+
method = 'GET'
64+
url = "/deviceAppManagement/${urlSegment}?`$expand=assignments&`$orderby=displayName"
6565
}
6666
}
6767
}
6868

69-
# Fetch assignments in bulk if we have any
70-
$AssignmentResults = @{}
71-
if ($AssignmentRequests.Count -gt 0) {
72-
$AssignmentBulkResults = New-GraphBulkRequest -Requests $AssignmentRequests -tenantid $TenantFilter
73-
foreach ($result in $AssignmentBulkResults) {
74-
if ($result.body.value) {
75-
$AssignmentResults[$result.id] = $result.body.value
76-
}
77-
}
69+
$ManagedAppPoliciesBulkResults = New-GraphBulkRequest -Requests $ManagedAppPoliciesBulkRequests -tenantid $TenantFilter
70+
# Do this horriblenes as a workaround, as the results dont return with a odata.type property
71+
$ManagedAppPolicies = $ManagedAppPoliciesBulkResults | ForEach-Object {
72+
$URLName = $_.id
73+
$_.body.value | Add-Member -NotePropertyName 'URLName' -NotePropertyValue $URLName -Force
74+
$_.body.value
7875
}
7976

77+
78+
8079
foreach ($Policy in $ManagedAppPolicies) {
81-
$policyType = switch -Wildcard ($Policy.'@odata.type') {
82-
'*androidManagedAppProtection*' { 'Android App Protection' }
83-
'*iosManagedAppProtection*' { 'iOS App Protection' }
84-
'*windowsManagedAppProtection*' { 'Windows App Protection' }
85-
'*mdmWindowsInformationProtectionPolicy*' { 'Windows Information Protection (MDM)' }
86-
'*windowsInformationProtectionPolicy*' { 'Windows Information Protection' }
87-
'*targetedManagedAppConfiguration*' { 'App Configuration (MAM)' }
88-
'*defaultManagedAppProtection*' { 'Default App Protection' }
80+
$policyType = switch ($Policy.'URLName') {
81+
'androidManagedAppProtection' { 'Android App Protection'; break }
82+
'iosManagedAppProtection' { 'iOS App Protection'; break }
83+
'windowsManagedAppProtection' { 'Windows App Protection'; break }
84+
'mdmWindowsInformationProtectionPolicy' { 'Windows Information Protection (MDM)'; break }
85+
'windowsInformationProtectionPolicy' { 'Windows Information Protection'; break }
86+
'targetedManagedAppConfiguration' { 'App Configuration (MAM)'; break }
87+
'defaultManagedAppProtection' { 'Default App Protection'; break }
8988
default { 'App Protection Policy' }
9089
}
9190

9291
# Process assignments
9392
$PolicyAssignment = [System.Collections.Generic.List[string]]::new()
9493
$PolicyExclude = [System.Collections.Generic.List[string]]::new()
95-
$Assignments = $AssignmentResults[$Policy.id]
96-
if ($Assignments) {
97-
foreach ($Assignment in $Assignments) {
94+
if ($Policy.assignments) {
95+
foreach ($Assignment in $Policy.assignments) {
9896
$target = $Assignment.target
9997
switch ($target.'@odata.type') {
10098
'#microsoft.graph.allDevicesAssignmentTarget' { $PolicyAssignment.Add('All Devices') }
@@ -112,7 +110,7 @@
112110
}
113111

114112
$Policy | Add-Member -NotePropertyName 'PolicyTypeName' -NotePropertyValue $policyType -Force
115-
$Policy | Add-Member -NotePropertyName 'URLName' -NotePropertyValue 'managedAppPolicies' -Force
113+
# $Policy | Add-Member -NotePropertyName 'URLName' -NotePropertyValue 'managedAppPolicies' -Force
116114
$Policy | Add-Member -NotePropertyName 'PolicySource' -NotePropertyValue 'AppProtection' -Force
117115
$Policy | Add-Member -NotePropertyName 'PolicyAssignment' -NotePropertyValue ($PolicyAssignment -join ', ') -Force
118116
$Policy | Add-Member -NotePropertyName 'PolicyExclude' -NotePropertyValue ($PolicyExclude -join ', ') -Force

0 commit comments

Comments
 (0)