Skip to content

Commit 3167935

Browse files
kris6673kris6673
committed
Feat: Enhance Invoke-ListAppProtectionPolicies and Invoke-ListIntunePolicy to support group assignments and bulk requests
1 parent 2856a6b commit 3167935

File tree

2 files changed

+106
-10
lines changed

2 files changed

+106
-10
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1‎

Lines changed: 95 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,27 +15,68 @@
1515
$TenantFilter = $Request.Query.tenantFilter
1616

1717
try {
18-
# Use bulk requests to get both managed app policies and mobile app configurations
18+
# Use bulk requests to get groups, managed app policies and mobile app configurations
1919
$BulkRequests = @(
20+
@{
21+
id = 'Groups'
22+
method = 'GET'
23+
url = '/groups?$top=999&$select=id,displayName'
24+
}
2025
@{
2126
id = 'ManagedAppPolicies'
2227
method = 'GET'
23-
url = '/deviceAppManagement/managedAppPolicies?$orderby=displayName'
28+
url = '/deviceAppManagement/managedAppPolicies?$expand=assignments&$orderby=displayName'
2429
}
2530
@{
2631
id = 'MobileAppConfigurations'
2732
method = 'GET'
28-
url = '/deviceAppManagement/mobileAppConfigurations?$orderby=displayName'
33+
url = '/deviceAppManagement/mobileAppConfigurations?$expand=assignments&$orderby=displayName'
2934
}
3035
)
3136

3237
$BulkResults = New-GraphBulkRequest -Requests $BulkRequests -tenantid $TenantFilter
3338

39+
# Extract groups for resolving assignment names
40+
$Groups = ($BulkResults | Where-Object { $_.id -eq 'Groups' }).body.value
41+
3442
$GraphRequest = [System.Collections.Generic.List[object]]::new()
3543

36-
# Process Managed App Policies
44+
# Process Managed App Policies - these need separate assignment lookups
3745
$ManagedAppPolicies = ($BulkResults | Where-Object { $_.id -eq 'ManagedAppPolicies' }).body.value
3846
if ($ManagedAppPolicies) {
47+
# Build bulk requests for assignments of policies that support them
48+
$AssignmentRequests = [System.Collections.Generic.List[object]]::new()
49+
foreach ($Policy in $ManagedAppPolicies) {
50+
# Only certain policy types support assignments endpoint
51+
$odataType = $Policy.'@odata.type'
52+
if ($odataType -match 'androidManagedAppProtection|iosManagedAppProtection|windowsManagedAppProtection|targetedManagedAppConfiguration') {
53+
$urlSegment = switch -Wildcard ($odataType) {
54+
'*androidManagedAppProtection*' { 'androidManagedAppProtections' }
55+
'*iosManagedAppProtection*' { 'iosManagedAppProtections' }
56+
'*windowsManagedAppProtection*' { 'windowsManagedAppProtections' }
57+
'*targetedManagedAppConfiguration*' { 'targetedManagedAppConfigurations' }
58+
}
59+
if ($urlSegment) {
60+
$AssignmentRequests.Add(@{
61+
id = $Policy.id
62+
method = 'GET'
63+
url = "/deviceAppManagement/$urlSegment('$($Policy.id)')/assignments"
64+
})
65+
}
66+
}
67+
}
68+
69+
# Fetch assignments in bulk if we have any
70+
$AssignmentResults = @{}
71+
if ($AssignmentRequests.Count -gt 0) {
72+
$AssignmentBulkResults = New-GraphBulkRequest -Requests $AssignmentRequests -tenantid $TenantFilter
73+
foreach ($result in $AssignmentBulkResults) {
74+
if ($result.body.value) {
75+
$AssignmentResults[$result.id] = $result.body.value
76+
}
77+
}
78+
}
79+
3980
foreach ($Policy in $ManagedAppPolicies) {
4081
$policyType = switch -Wildcard ($Policy.'@odata.type') {
4182
'*androidManagedAppProtection*' { 'Android App Protection' }
@@ -47,14 +88,39 @@
4788
'*defaultManagedAppProtection*' { 'Default App Protection' }
4889
default { 'App Protection Policy' }
4990
}
91+
92+
# Process assignments
93+
$PolicyAssignment = [System.Collections.Generic.List[string]]::new()
94+
$PolicyExclude = [System.Collections.Generic.List[string]]::new()
95+
$Assignments = $AssignmentResults[$Policy.id]
96+
if ($Assignments) {
97+
foreach ($Assignment in $Assignments) {
98+
$target = $Assignment.target
99+
switch ($target.'@odata.type') {
100+
'#microsoft.graph.allDevicesAssignmentTarget' { $PolicyAssignment.Add('All Devices') }
101+
'#microsoft.graph.allLicensedUsersAssignmentTarget' { $PolicyAssignment.Add('All Licensed Users') }
102+
'#microsoft.graph.groupAssignmentTarget' {
103+
$groupName = ($Groups | Where-Object { $_.id -eq $target.groupId }).displayName
104+
if ($groupName) { $PolicyAssignment.Add($groupName) }
105+
}
106+
'#microsoft.graph.exclusionGroupAssignmentTarget' {
107+
$groupName = ($Groups | Where-Object { $_.id -eq $target.groupId }).displayName
108+
if ($groupName) { $PolicyExclude.Add($groupName) }
109+
}
110+
}
111+
}
112+
}
113+
50114
$Policy | Add-Member -NotePropertyName 'PolicyTypeName' -NotePropertyValue $policyType -Force
51115
$Policy | Add-Member -NotePropertyName 'URLName' -NotePropertyValue 'managedAppPolicies' -Force
52116
$Policy | Add-Member -NotePropertyName 'PolicySource' -NotePropertyValue 'AppProtection' -Force
117+
$Policy | Add-Member -NotePropertyName 'PolicyAssignment' -NotePropertyValue ($PolicyAssignment -join ', ') -Force
118+
$Policy | Add-Member -NotePropertyName 'PolicyExclude' -NotePropertyValue ($PolicyExclude -join ', ') -Force
53119
$GraphRequest.Add($Policy)
54120
}
55121
}
56122

57-
# Process Mobile App Configurations
123+
# Process Mobile App Configurations - assignments are already expanded
58124
$MobileAppConfigs = ($BulkResults | Where-Object { $_.id -eq 'MobileAppConfigurations' }).body.value
59125
if ($MobileAppConfigs) {
60126
foreach ($Config in $MobileAppConfigs) {
@@ -64,9 +130,33 @@
64130
'*iosMobileAppConfiguration*' { 'iOS App Configuration' }
65131
default { 'App Configuration Policy' }
66132
}
133+
134+
# Process assignments
135+
$PolicyAssignment = [System.Collections.Generic.List[string]]::new()
136+
$PolicyExclude = [System.Collections.Generic.List[string]]::new()
137+
if ($Config.assignments) {
138+
foreach ($Assignment in $Config.assignments) {
139+
$target = $Assignment.target
140+
switch ($target.'@odata.type') {
141+
'#microsoft.graph.allDevicesAssignmentTarget' { $PolicyAssignment.Add('All Devices') }
142+
'#microsoft.graph.allLicensedUsersAssignmentTarget' { $PolicyAssignment.Add('All Licensed Users') }
143+
'#microsoft.graph.groupAssignmentTarget' {
144+
$groupName = ($Groups | Where-Object { $_.id -eq $target.groupId }).displayName
145+
if ($groupName) { $PolicyAssignment.Add($groupName) }
146+
}
147+
'#microsoft.graph.exclusionGroupAssignmentTarget' {
148+
$groupName = ($Groups | Where-Object { $_.id -eq $target.groupId }).displayName
149+
if ($groupName) { $PolicyExclude.Add($groupName) }
150+
}
151+
}
152+
}
153+
}
154+
67155
$Config | Add-Member -NotePropertyName 'PolicyTypeName' -NotePropertyValue $policyType -Force
68156
$Config | Add-Member -NotePropertyName 'URLName' -NotePropertyValue 'mobileAppConfigurations' -Force
69157
$Config | Add-Member -NotePropertyName 'PolicySource' -NotePropertyValue 'AppConfiguration' -Force
158+
$Config | Add-Member -NotePropertyName 'PolicyAssignment' -NotePropertyValue ($PolicyAssignment -join ', ') -Force
159+
$Config | Add-Member -NotePropertyName 'PolicyExclude' -NotePropertyValue ($PolicyExclude -join ', ') -Force
70160

71161
# Ensure isAssigned property exists for consistency
72162
if (-not $Config.PSObject.Properties['isAssigned']) {

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
Function Invoke-ListIntunePolicy {
2+
function Invoke-ListIntunePolicy {
33
<#
44
.FUNCTIONALITY
55
Entrypoint
@@ -16,9 +16,12 @@ Function Invoke-ListIntunePolicy {
1616
if ($ID) {
1717
$GraphRequest = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$($URLName)('$ID')" -tenantid $TenantFilter
1818
} else {
19-
$Groups = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups?$top=999' -tenantid $TenantFilter | Select-Object -Property id, displayName
20-
2119
$BulkRequests = [PSCustomObject]@(
20+
@{
21+
id = 'Groups'
22+
method = 'GET'
23+
url = '/groups?$top=999&$select=id,displayName'
24+
}
2225
@{
2326
id = 'DeviceConfigurations'
2427
method = 'GET'
@@ -63,7 +66,10 @@ Function Invoke-ListIntunePolicy {
6366

6467
$BulkResults = New-GraphBulkRequest -Requests $BulkRequests -tenantid $TenantFilter
6568

66-
$GraphRequest = $BulkResults | ForEach-Object {
69+
# Extract groups for resolving assignment names
70+
$Groups = ($BulkResults | Where-Object { $_.id -eq 'Groups' }).body.value
71+
72+
$GraphRequest = $BulkResults | Where-Object { $_.id -ne 'Groups' } | ForEach-Object {
6773
$URLName = $_.Id
6874
$_.body.Value | ForEach-Object {
6975
$policyTypeName = switch -Wildcard ($_.'[email protected]') {
@@ -89,7 +95,7 @@ Function Invoke-ListIntunePolicy {
8995
$Assignments = $_.assignments.target | Select-Object -Property '@odata.type', groupId
9096
$PolicyAssignment = [System.Collections.Generic.List[string]]::new()
9197
$PolicyExclude = [System.Collections.Generic.List[string]]::new()
92-
ForEach ($target in $Assignments) {
98+
foreach ($target in $Assignments) {
9399
switch ($target.'@odata.type') {
94100
'#microsoft.graph.allDevicesAssignmentTarget' { $PolicyAssignment.Add('All Devices') }
95101
'#microsoft.graph.exclusionallDevicesAssignmentTarget' { $PolicyExclude.Add('All Devices') }

0 commit comments

Comments
 (0)