Skip to content

Commit 1354aa6

Browse files
Merge pull request KelvinTegelaar#1737 from kris6673/AutoArchive
Feat: Add auto-archiving configuration standard
2 parents d118bcc + e80f04a commit 1354aa6

12 files changed

+133
-34
lines changed

Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ function Invoke-CIPPStandardAntiPhishPolicy {
2323
"CIS M365 5.0 (2.1.7)"
2424
"NIST CSF 2.0 (DE.CM-09)"
2525
ADDEDCOMPONENT
26+
{"type":"textField","name":"standards.AntiPhishPolicy.name","label":"Policy Name","required":true,"defaultValue":"CIPP Default Anti-Phishing Policy"}
2627
{"type":"number","label":"Phishing email threshold. (Default 1)","name":"standards.AntiPhishPolicy.PhishThresholdLevel","defaultValue":1}
2728
{"type":"switch","label":"Show first contact safety tip","name":"standards.AntiPhishPolicy.EnableFirstContactSafetyTips","defaultValue":true}
2829
{"type":"switch","label":"Show user impersonation safety tip","name":"standards.AntiPhishPolicy.EnableSimilarUsersSafetyTips","defaultValue":true}
Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
function Invoke-CIPPStandardAutoArchive {
2+
<#
3+
.FUNCTIONALITY
4+
Internal
5+
.COMPONENT
6+
(APIName) AutoArchive
7+
.SYNOPSIS
8+
(Label) Configure Auto-Archiving Threshold
9+
.DESCRIPTION
10+
(Helptext) Configures the auto-archiving threshold percentage for the tenant. When a mailbox exceeds this threshold, the oldest items are automatically moved to the archive mailbox. Archive must be enabled manually or via the CIPP standard 'Enable Online Archive for all users'. More information can be found in [Microsoft's documentation.](https://learn.microsoft.com/en-us/exchange/security-and-compliance/messaging-records-management/auto-archiving)
11+
(DocsDescription) Configures the auto-archiving threshold at the organization level. Auto-archiving automatically moves the oldest items from a user's primary mailbox to their archive mailbox when mailbox usage exceeds the configured threshold percentage. This prevents mail flow disruptions caused by full mailboxes. Valid range is 80-100, where 100 disables auto-archiving for the tenant. More information can be found in [Microsoft's documentation.](https://learn.microsoft.com/en-us/exchange/security-and-compliance/messaging-records-management/auto-archiving)
12+
.NOTES
13+
CAT
14+
Exchange Standards
15+
TAG
16+
EXECUTIVETEXT
17+
Configures automatic archiving of mailbox items when storage approaches capacity, preventing email delivery failures due to full mailboxes. This proactive storage management ensures business continuity and reduces helpdesk tickets related to mailbox quota issues.
18+
ADDEDCOMPONENT
19+
{"type":"number","name":"standards.AutoArchive.AutoArchivingThresholdPercentage","label":"Auto-Archiving Threshold Percentage (80-100, default 96, 100 disables)","defaultValue":96}
20+
IMPACT
21+
Low Impact
22+
ADDEDDATE
23+
2025-12-11
24+
POWERSHELLEQUIVALENT
25+
Set-OrganizationConfig -AutoArchivingThresholdPercentage 80-100
26+
RECOMMENDEDBY
27+
UPDATECOMMENTBLOCK
28+
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
29+
.LINK
30+
https://docs.cipp.app/user-documentation/tenant/standards/list-standards
31+
#>
32+
33+
param($Tenant, $Settings)
34+
$TestResult = Test-CIPPStandardLicense -StandardName 'AutoArchive' -TenantFilter $Tenant -RequiredCapabilities @('EXCHANGE_S_STANDARD', 'EXCHANGE_S_ENTERPRISE', 'EXCHANGE_S_STANDARD_GOV', 'EXCHANGE_S_ENTERPRISE_GOV', 'EXCHANGE_LITE')
35+
36+
if ($TestResult -eq $false) {
37+
Write-Host "We're exiting as the correct license is not present for this standard."
38+
return $true
39+
}
40+
41+
# Get the threshold value from settings
42+
$DesiredThreshold = [int]($Settings.AutoArchivingThresholdPercentage)
43+
44+
# Validate the threshold is within valid range
45+
if ($DesiredThreshold -lt 80 -or $DesiredThreshold -gt 100) {
46+
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Invalid AutoArchivingThresholdPercentage value: $DesiredThreshold. Must be between 80 and 100." -Sev Error
47+
return
48+
}
49+
50+
try {
51+
$CurrentState = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig' -Select 'AutoArchivingThresholdPercentage').AutoArchivingThresholdPercentage
52+
} catch {
53+
$ErrorMessage = Get-CippException -Exception $_
54+
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the AutoArchive state for $Tenant. Error: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage
55+
return
56+
}
57+
58+
$CorrectState = $CurrentState -eq $DesiredThreshold
59+
60+
if ($Settings.remediate -eq $true) {
61+
Write-Host 'Time to remediate'
62+
63+
if ($CorrectState) {
64+
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Auto-archiving threshold is already set to $CurrentState%." -Sev Info
65+
} else {
66+
try {
67+
$null = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-OrganizationConfig' -cmdParams @{ AutoArchivingThresholdPercentage = $DesiredThreshold }
68+
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Auto-archiving threshold has been set to $DesiredThreshold%." -Sev Info
69+
} catch {
70+
$ErrorMessage = Get-CippException -Exception $_
71+
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Failed to set auto-archiving threshold. Error: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage
72+
}
73+
}
74+
}
75+
76+
if ($Settings.alert -eq $true) {
77+
78+
if ($CorrectState) {
79+
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Auto-archiving threshold is correctly set to $CurrentState%." -Sev Info
80+
} else {
81+
Write-StandardsAlert -message "Auto-archiving threshold is set to $CurrentState% but should be $DesiredThreshold%." -object @{ CurrentThreshold = $CurrentState; DesiredThreshold = $DesiredThreshold } -tenant $Tenant -standardName 'AutoArchive' -standardId $Settings.standardId
82+
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Auto-archiving threshold is set to $CurrentState% but should be $DesiredThreshold%." -Sev Info
83+
}
84+
}
85+
86+
if ($Settings.report -eq $true) {
87+
Add-CIPPBPAField -FieldName 'AutoArchive' -FieldValue $CorrectState -StoreAs bool -Tenant $Tenant
88+
89+
if ($CorrectState) {
90+
$FieldValue = $true
91+
} else {
92+
$FieldValue = @{ CurrentThreshold = $CurrentState; DesiredThreshold = $DesiredThreshold }
93+
}
94+
Set-CIPPStandardsCompareField -FieldName 'standards.AutoArchive' -FieldValue $FieldValue -Tenant $Tenant
95+
}
96+
}

Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBitLockerKeysForOwnedDevice.ps1

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,29 @@
1-
function Invoke-CIPPStandardBitLockerKeysForOwnedDevice {
1+
function Invoke-CIPPStandardBitLockerKeysForOwnedDevice {
22
<#
33
.FUNCTIONALITY
44
Internal
55
.COMPONENT
66
(APIName) BitLockerKeysForOwnedDevice
77
.SYNOPSIS
8-
(Label) Restrict users from recovering BitLocker keys for owned devices
8+
(Label) Control BitLocker key recovery for owned devices
99
.DESCRIPTION
10-
(Helptext) Controls whether standard users can recover BitLocker keys for devices they own via Microsoft 365 portals.
11-
(DocsDescription) Updates the default user role setting that governs access to BitLocker recovery keys for owned devices. This allows administrators to either permit self-service recovery or require helpdesk involvement through Microsoft Entra authorization policies.
10+
(Helptext) Controls whether standard users can recover BitLocker keys for devices they own.
11+
(DocsDescription) Updates the Microsoft Entra authorization policy that controls whether standard users can read BitLocker recovery keys for devices they own. Choose to restrict access for tighter security or allow self-service recovery when operational needs require it.
1212
.NOTES
1313
CAT
1414
Entra (AAD) Standards
1515
TAG
16-
"NIST CSF 2.0 (PR.AA-05)"
1716
EXECUTIVETEXT
18-
Ensures administrators retain control over BitLocker recovery secrets when required, while still allowing flexibility to enable self-service recovery when business needs demand it.
17+
Gives administrators centralized control over BitLocker recovery secrets—restrict access to ensure IT-assisted recovery flows, or allow self-service when rapid device unlocks are a priority.
1918
ADDEDCOMPONENT
2019
{"type":"autoComplete","multiple":false,"creatable":false,"label":"Select state","name":"standards.BitLockerKeysForOwnedDevice.state","options":[{"label":"Restrict","value":"restrict"},{"label":"Allow","value":"allow"}]}
2120
IMPACT
22-
Medium Impact
21+
Low Impact
2322
ADDEDDATE
2423
2025-10-12
2524
POWERSHELLEQUIVALENT
2625
Update-MgBetaPolicyAuthorizationPolicy
2726
RECOMMENDEDBY
28-
"CIPP"
2927
UPDATECOMMENTBLOCK
3028
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
3129
.LINK

Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,10 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
2323
EXECUTIVETEXT
2424
Deploys standardized conditional access policies that automatically enforce security requirements based on user location, device compliance, and risk factors. These templates ensure consistent security controls across the organization while enabling secure access to business resources.
2525
ADDEDCOMPONENT
26-
{"type":"autoComplete","name":"TemplateList","multiple":false,"label":"Select Conditional Access Template","api":{"url":"/api/ListCATemplates","labelField":"displayName","valueField":"GUID","queryKey":"ListCATemplates"}}
26+
{"type":"autoComplete","name":"TemplateList","multiple":false,"label":"Select Conditional Access Template","api":{"url":"/api/ListCATemplates","labelField":"displayName","valueField":"GUID","queryKey":"ListCATemplates","showRefresh":true,"templateView":{"title":"Conditional Access Policy"}}}
2727
{"name":"state","label":"What state should we deploy this template in?","type":"radio","options":[{"value":"donotchange","label":"Do not change state"},{"value":"Enabled","label":"Set to enabled"},{"value":"Disabled","label":"Set to disabled"},{"value":"enabledForReportingButNotEnforced","label":"Set to report only"}]}
2828
{"type":"switch","name":"DisableSD","label":"Disable Security Defaults when deploying policy"}
29+
{"type":"switch","name":"CreateGroups","label":"Create groups if they do not exist"}
2930
UPDATECOMMENTBLOCK
3031
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
3132
.LINK

Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,13 @@ function Invoke-CIPPStandardIntuneTemplate {
2323
EXECUTIVETEXT
2424
Deploys standardized device management configurations across all corporate devices, ensuring consistent security policies, application settings, and compliance requirements. This template-based approach streamlines device management while maintaining uniform security standards across the organization.
2525
ADDEDCOMPONENT
26-
{"type":"autoComplete","multiple":false,"creatable":false,"required":false,"name":"TemplateList","label":"Select Intune Template","api":{"queryKey":"ListIntuneTemplates-autcomplete","url":"/api/ListIntuneTemplates","labelField":"Displayname","valueField":"GUID"}}
26+
{"type":"autoComplete","multiple":false,"creatable":false,"required":false,"name":"TemplateList","label":"Select Intune Template","api":{"queryKey":"ListIntuneTemplates-autcomplete","url":"/api/ListIntuneTemplates","labelField":"Displayname","valueField":"GUID","showRefresh":true,"templateView":{"title":"Intune Template","property":"RAWJson","type":"intune"}}}
2727
{"type":"autoComplete","multiple":false,"required":false,"creatable":false,"name":"TemplateList-Tags","label":"Or select a package of Intune Templates","api":{"queryKey":"ListIntuneTemplates-tag-autcomplete","url":"/api/ListIntuneTemplates?mode=Tag","labelField":"label","valueField":"value","addedField":{"templates":"templates"}}}
2828
{"name":"AssignTo","label":"Who should this template be assigned to?","type":"radio","options":[{"label":"Do not assign","value":"On"},{"label":"Assign to all users","value":"allLicensedUsers"},{"label":"Assign to all devices","value":"AllDevices"},{"label":"Assign to all users and devices","value":"AllDevicesAndUsers"},{"label":"Assign to Custom Group","value":"customGroup"}]}
2929
{"type":"textField","required":false,"name":"customGroup","label":"Enter the custom group name if you selected 'Assign to Custom Group'. Wildcards are allowed."}
3030
{"name":"excludeGroup","label":"Exclude Groups","type":"textField","required":false,"helpText":"Enter the group name(s) to exclude from the assignment. Wildcards are allowed. Multiple group names are comma-seperated."}
31+
{"type":"textField","required":false,"name":"assignmentFilter","label":"Assignment Filter Name (Optional)","helpText":"Enter the assignment filter name to apply to this policy assignment. Wildcards are allowed."}
32+
{"name":"assignmentFilterType","label":"Assignment Filter Mode (Optional)","type":"radio","required":false,"helpText":"Choose whether to include or exclude devices matching the filter. Only applies if you specified a filter name above. Defaults to Include if not specified.","options":[{"label":"Include - Assign to devices matching the filter","value":"include"},{"label":"Exclude - Assign to devices NOT matching the filter","value":"exclude"}]}
3133
UPDATECOMMENTBLOCK
3234
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
3335
.LINK

Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ function Invoke-CIPPStandardMalwareFilterPolicy {
2020
"mdo_zapmalware"
2121
"NIST CSF 2.0 (DE.CM-09)"
2222
ADDEDCOMPONENT
23+
{"type":"textField","name":"standards.MalwareFilterPolicy.name","label":"Policy Name","required":true,"defaultValue":"CIPP Default Malware Policy"}
2324
{"type":"select","multiple":false,"label":"FileTypeAction","name":"standards.MalwareFilterPolicy.FileTypeAction","options":[{"label":"Reject","value":"Reject"},{"label":"Quarantine the message","value":"Quarantine"}]}
2425
{"type":"textField","name":"standards.MalwareFilterPolicy.OptionalFileTypes","required":false,"label":"Optional File Types, Comma separated"}
2526
{"type":"select","multiple":false,"creatable":true,"label":"QuarantineTag","name":"standards.MalwareFilterPolicy.QuarantineTag","options":[{"label":"AdminOnlyAccessPolicy","value":"AdminOnlyAccessPolicy"},{"label":"DefaultFullAccessPolicy","value":"DefaultFullAccessPolicy"},{"label":"DefaultFullAccessWithNotificationPolicy","value":"DefaultFullAccessWithNotificationPolicy"}]}

Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
1919
"mdo_safeattachmentpolicy"
2020
"NIST CSF 2.0 (DE.CM-09)"
2121
ADDEDCOMPONENT
22+
{"type":"textField","name":"standards.SafeAttachmentPolicy.name","label":"Policy Name","required":true,"defaultValue":"CIPP Default Safe Attachment Policy"}
2223
{"type":"select","multiple":false,"label":"Safe Attachment Action","name":"standards.SafeAttachmentPolicy.SafeAttachmentAction","options":[{"label":"Allow","value":"Allow"},{"label":"Block","value":"Block"},{"label":"DynamicDelivery","value":"DynamicDelivery"}]}
2324
{"type":"select","multiple":false,"creatable":true,"label":"QuarantineTag","name":"standards.SafeAttachmentPolicy.QuarantineTag","options":[{"label":"AdminOnlyAccessPolicy","value":"AdminOnlyAccessPolicy"},{"label":"DefaultFullAccessPolicy","value":"DefaultFullAccessPolicy"},{"label":"DefaultFullAccessWithNotificationPolicy","value":"DefaultFullAccessWithNotificationPolicy"}]}
2425
{"type":"switch","label":"Redirect","name":"standards.SafeAttachmentPolicy.Redirect"}

Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ function Invoke-CIPPStandardSafeLinksPolicy {
1818
"mdo_safelinksforOfficeApps"
1919
"NIST CSF 2.0 (DE.CM-09)"
2020
ADDEDCOMPONENT
21+
{"type":"textField","name":"standards.SafeLinksPolicy.name","label":"Policy Name","required":true,"defaultValue":"CIPP Default SafeLinks Policy"}
2122
{"type":"switch","label":"AllowClickThrough","name":"standards.SafeLinksPolicy.AllowClickThrough"}
2223
{"type":"switch","label":"DisableUrlRewrite","name":"standards.SafeLinksPolicy.DisableUrlRewrite"}
2324
{"type":"switch","label":"EnableOrganizationBranding","name":"standards.SafeLinksPolicy.EnableOrganizationBranding"}

Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,26 +8,23 @@ function Invoke-CIPPStandardSecureScoreRemediation {
88
(Label) Update Secure Score Control Profiles
99
.DESCRIPTION
1010
(Helptext) Allows bulk updating of Secure Score control profiles across tenants. Select controls and assign them to different states: Default, Ignored, Third-Party, or Reviewed.
11-
(DocsDescription) Enables automated or template-based updates to Microsoft Secure Score recommendations. This is particularly useful for MSPs managing multiple tenants, allowing you to mark controls as "Third-party" (e.g., when using Mimecast, IronScales, or other third-party security tools) or set them to other states in bulk. This ensures Secure Scores accurately reflect each tenant's true security posture without repetitive manual updates.
11+
(DocsDescription) Allows bulk updating of Secure Score control profiles across tenants. Select controls and assign them to different states: Default, Ignored, Third-Party, or Reviewed.
1212
.NOTES
1313
CAT
1414
Global Standards
1515
TAG
1616
"lowimpact"
17-
EXECUTIVETEXT
18-
Automates the management of Secure Score control profiles by allowing bulk updates across tenants. This ensures accurate representation of security posture when using third-party security tools or when certain controls need to be marked as resolved or ignored, significantly reducing manual administrative overhead for MSPs managing multiple clients.
1917
ADDEDCOMPONENT
20-
{"type":"autoComplete","multiple":true,"creatable":true,"name":"standards.SecureScoreRemediation.Default","label":"Controls to set to Default"}
21-
{"type":"autoComplete","multiple":true,"creatable":true,"name":"standards.SecureScoreRemediation.Ignored","label":"Controls to set to Ignored"}
22-
{"type":"autoComplete","multiple":true,"creatable":true,"name":"standards.SecureScoreRemediation.ThirdParty","label":"Controls to set to Third-Party"}
23-
{"type":"autoComplete","multiple":true,"creatable":true,"name":"standards.SecureScoreRemediation.Reviewed","label":"Controls to set to Reviewed"}
18+
{"type":"autoComplete","multiple":true,"creatable":true,"required":false,"name":"standards.SecureScoreRemediation.Default","label":"Controls to set to Default","api":{"url":"/secureScore.json","labelField":"title","valueField":"id"}}
19+
{"type":"autoComplete","multiple":true,"creatable":true,"required":false,"name":"standards.SecureScoreRemediation.Ignored","label":"Controls to set to Ignored","api":{"url":"/secureScore.json","labelField":"title","valueField":"id"}}
20+
{"type":"autoComplete","multiple":true,"creatable":true,"required":false,"name":"standards.SecureScoreRemediation.ThirdParty","label":"Controls to set to Third-Party","api":{"url":"/secureScore.json","labelField":"title","valueField":"id"}}
21+
{"type":"autoComplete","multiple":true,"required":false,"creatable":true,"name":"standards.SecureScoreRemediation.Reviewed","label":"Controls to set to Reviewed","api":{"url":"/secureScore.json","labelField":"title","valueField":"id"}}
2422
IMPACT
2523
Low Impact
2624
ADDEDDATE
2725
2025-11-19
2826
POWERSHELLEQUIVALENT
2927
New-GraphPostRequest to /beta/security/secureScoreControlProfiles/{id}
30-
RECOMMENDEDBY
3128
UPDATECOMMENTBLOCK
3229
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
3330
.LINK

0 commit comments

Comments
 (0)