Skip to content

Commit 4397a3c

Browse files
KelvinTegelaarKelvinTegelaar
committed
add disable Ca
1 parent fa50f5d commit 4397a3c

File tree

3 files changed

+43
-38
lines changed

3 files changed

+43
-38
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListConditionalAccessPolicies.ps1‎

Lines changed: 35 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,13 @@ function Invoke-ListConditionalAccessPolicies {
2323
$Locations
2424
)
2525
if ($id -eq 'All') {
26-
return @{label = 'All'; value = 'All' }
26+
return 'All'
2727
}
2828
$DisplayName = $Locations | Where-Object { $_.id -eq $ID } | Select-Object -ExpandProperty DisplayName
29-
if (![string]::IsNullOrEmpty($displayName)) {
30-
return @{label = $DisplayName; value = $ID }
29+
if ([string]::IsNullOrEmpty($displayName)) {
30+
return $ID
31+
} else {
32+
return $DisplayName
3133
}
3234
}
3335

@@ -39,13 +41,13 @@ function Invoke-ListConditionalAccessPolicies {
3941
$RoleDefinitions
4042
)
4143
if ($id -eq 'All') {
42-
return @{label = 'All'; value = 'All' }
44+
return 'All'
4345
}
4446
$DisplayName = $RoleDefinitions | Where-Object { $_.id -eq $ID } | Select-Object -ExpandProperty DisplayName
4547
if ([string]::IsNullOrEmpty($displayName)) {
46-
return @{label = $ID; value = $ID }
48+
return $ID
4749
} else {
48-
return @{label = $DisplayName; value = $ID }
50+
return $DisplayName
4951
}
5052
}
5153

@@ -57,13 +59,13 @@ function Invoke-ListConditionalAccessPolicies {
5759
$Users
5860
)
5961
if ($id -eq 'All') {
60-
return @{label = 'All'; value = 'All' }
62+
return 'All'
6163
}
6264
$DisplayName = $Users | Where-Object { $_.id -eq $ID } | Select-Object -ExpandProperty DisplayName
6365
if ([string]::IsNullOrEmpty($displayName)) {
64-
return @{label = $ID; value = $ID }
66+
return $ID
6567
} else {
66-
return @{label = $DisplayName; value = $ID }
68+
return $DisplayName
6769
}
6870
}
6971

@@ -74,13 +76,13 @@ function Invoke-ListConditionalAccessPolicies {
7476
$Groups
7577
)
7678
if ($id -eq 'All') {
77-
return @{label = 'All'; value = 'All' }
79+
return 'All'
7880
}
7981
$DisplayName = $Groups | Where-Object { $_.id -eq $ID } | Select-Object -ExpandProperty DisplayName
8082
if ([string]::IsNullOrEmpty($displayName)) {
81-
return @{label = 'No Data'; value = 'No Data' }
83+
return 'No Data'
8284
} else {
83-
return @{label = $DisplayName; value = $ID }
85+
return $DisplayName
8486
}
8587
}
8688

@@ -93,7 +95,7 @@ function Invoke-ListConditionalAccessPolicies {
9395
$ServicePrincipals
9496
)
9597
if ($id -eq 'All') {
96-
return @{label = 'All'; value = 'All' }
98+
return 'All'
9799
}
98100

99101
$return = $ServicePrincipals | Where-Object { $_.appId -eq $ID } | Select-Object -ExpandProperty DisplayName
@@ -110,10 +112,7 @@ function Invoke-ListConditionalAccessPolicies {
110112
$return = ''
111113
}
112114

113-
if ($return) {
114-
$return = @{label = $return; value = $ID }
115-
return $return
116-
}
115+
return $return
117116
}
118117

119118
# Interact with query parameters or the body of the request.
@@ -177,25 +176,25 @@ function Invoke-ListConditionalAccessPolicies {
177176
createdDateTime = $(if (![string]::IsNullOrEmpty($cap.createdDateTime)) { [datetime]$cap.createdDateTime } else { '' })
178177
modifiedDateTime = $(if (![string]::IsNullOrEmpty($cap.modifiedDateTime)) { [datetime]$cap.modifiedDateTime }else { '' })
179178
state = $cap.state
180-
clientAppTypes = @(if ($cap.conditions.clientAppTypes) { $cap.conditions.clientAppTypes | ForEach-Object { return @{label = $_; value = $_ } } } else { @() })
181-
includePlatforms = @(if ($cap.conditions.platforms.includePlatforms) { $cap.conditions.platforms.includePlatforms | ForEach-Object { return @{label = $_; value = $_ } } } else { @() })
182-
excludePlatforms = @(if ($cap.conditions.platforms.excludePlatforms) { $cap.conditions.platforms.excludePlatforms | ForEach-Object { return @{label = $_; value = $_ } } } else { @() })
183-
includeLocations = @(Get-LocationNameFromId -Locations $AllNamedLocations -id $cap.conditions.locations.includeLocations)
184-
excludeLocations = @(Get-LocationNameFromId -Locations $AllNamedLocations -id $cap.conditions.locations.excludeLocations)
185-
includeApplications = @(Get-ApplicationNameFromId -Applications $AllApplications -ServicePrincipals $AllServicePrincipals -id $cap.conditions.applications.includeApplications)
186-
excludeApplications = @(Get-ApplicationNameFromId -Applications $AllApplications -ServicePrincipals $AllServicePrincipals -id $cap.conditions.applications.excludeApplications)
187-
includeUserActions = @($cap.conditions.applications.includeUserActions )
188-
includeAuthenticationContextClassReferences = @($cap.conditions.applications.includeAuthenticationContextClassReferences )
189-
includeUsers = @($cap.conditions.users.includeUsers | ForEach-Object { Get-UserNameFromId -Users $UserListOutput -id $_ })
190-
excludeUsers = @($cap.conditions.users.excludeUsers | ForEach-Object { Get-UserNameFromId -Users $UserListOutput -id $_ })
191-
includeGroups = @($cap.conditions.users.includeGroups | ForEach-Object { Get-GroupNameFromId -Groups $GroupListOutput -id $_ })
192-
excludeGroups = @($cap.conditions.users.excludeGroups | ForEach-Object { Get-GroupNameFromId -Groups $GroupListOutput -id $_ })
193-
includeRoles = @($cap.conditions.users.includeRoles | ForEach-Object { Get-RoleNameFromId -RoleDefinitions $AllRoleDefinitions -id $_ })
194-
excludeRoles = @($cap.conditions.users.excludeRoles | ForEach-Object { Get-RoleNameFromId -RoleDefinitions $AllRoleDefinitions -id $_ })
195-
grantControlsOperator = @(if ($cap.grantControls.operator) { $cap.grantControls.operator | ForEach-Object { return @{label = $_; value = $_ } } } else { @() })
196-
builtInControls = @(if ($cap.grantControls.builtInControls) { $cap.grantControls.builtInControls | ForEach-Object { return @{label = $_; value = $_ } } } else { @() })
197-
customAuthenticationFactors = @(if ($cap.grantControls.customAuthenticationFactors) { $cap.grantControls.customAuthenticationFactors | ForEach-Object { return @{label = $_; value = $_ } } } else { @() })
198-
termsOfUse = @(if ($cap.grantControls.termsOfUse) { $cap.grantControls.termsOfUse | ForEach-Object { return @{label = $_; value = $_ } } } else { @() })
179+
clientAppTypes = ($cap.conditions.clientAppTypes) -join ','
180+
includePlatforms = ($cap.conditions.platforms.includePlatforms) -join ','
181+
excludePlatforms = ($cap.conditions.platforms.excludePlatforms) -join ','
182+
includeLocations = (Get-LocationNameFromId -Locations $AllNamedLocations -id $cap.conditions.locations.includeLocations) -join ','
183+
excludeLocations = (Get-LocationNameFromId -Locations $AllNamedLocations -id $cap.conditions.locations.excludeLocations) -join ','
184+
includeApplications = ($cap.conditions.applications.includeApplications | ForEach-Object { Get-ApplicationNameFromId -Applications $AllApplications -ServicePrincipals $AllServicePrincipals -id $_ }) -join ','
185+
excludeApplications = ($cap.conditions.applications.excludeApplications | ForEach-Object { Get-ApplicationNameFromId -Applications $AllApplications -ServicePrincipals $AllServicePrincipals -id $_ }) -join ','
186+
includeUserActions = ($cap.conditions.applications.includeUserActions | Out-String)
187+
includeAuthenticationContextClassReferences = ($cap.conditions.applications.includeAuthenticationContextClassReferences | Out-String)
188+
includeUsers = ($cap.conditions.users.includeUsers | ForEach-Object { Get-UserNameFromId -Users $UserListOutput -id $_ }) | Out-String
189+
excludeUsers = ($cap.conditions.users.excludeUsers | ForEach-Object { Get-UserNameFromId -Users $UserListOutput -id $_ }) | Out-String
190+
includeGroups = ($cap.conditions.users.includeGroups | ForEach-Object { Get-GroupNameFromId -Groups $GroupListOutput -id $_ }) | Out-String
191+
excludeGroups = ($cap.conditions.users.excludeGroups | ForEach-Object { Get-GroupNameFromId -Groups $GroupListOutput -id $_ }) | Out-String
192+
includeRoles = ($cap.conditions.users.includeRoles | ForEach-Object { Get-RoleNameFromId -RoleDefinitions $AllRoleDefinitions -id $_ }) | Out-String
193+
excludeRoles = ($cap.conditions.users.excludeRoles | ForEach-Object { Get-RoleNameFromId -RoleDefinitions $AllRoleDefinitions -id $_ }) | Out-String
194+
grantControlsOperator = ($cap.grantControls.operator) -join ','
195+
builtInControls = ($cap.grantControls.builtInControls) -join ','
196+
customAuthenticationFactors = ($cap.grantControls.customAuthenticationFactors) -join ','
197+
termsOfUse = ($cap.grantControls.termsOfUse) -join ','
199198
rawjson = ($cap | ConvertTo-Json -Depth 100)
200199
}
201200
$temp

‎Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ function New-CIPPCAPolicy {
77
$State,
88
$Overwrite,
99
$ReplacePattern = 'none',
10+
$DisableSD = $false,
1011
$APIName = 'Create CA Policy',
1112
$Headers
1213
)
@@ -225,7 +226,12 @@ function New-CIPPCAPolicy {
225226
}
226227
}
227228
}
228-
229+
if ($DisableSD -eq $true) {
230+
#Send request to disable security defaults.
231+
$body = '{ "isEnabled": false }'
232+
$null = New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy' -Type patch -Body $body -ContentType 'application/json'
233+
Write-LogMessage -Headers $User -API $APINAME -tenant $($Tenant) -message "Disabled Security Defaults for tenant $($TenantFilter)" -Sev 'Info'
234+
}
229235
$RawJSON = ConvertTo-Json -InputObject $JSONObj -Depth 10 -Compress
230236
Write-Information $RawJSON
231237
try {

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
3939
$Table = Get-CippTable -tablename 'templates'
4040
$Filter = "PartitionKey eq 'CATemplate' and RowKey eq '$($Setting.TemplateList.value)'"
4141
$JSONObj = (Get-CippAzDataTableEntity @Table -Filter $Filter).JSON
42-
$null = New-CIPPCAPolicy -replacePattern 'displayName' -TenantFilter $tenant -state $Setting.state -RawJSON $JSONObj -Overwrite $true -APIName $APIName -Headers $Request.Headers
42+
$null = New-CIPPCAPolicy -replacePattern 'displayName' -TenantFilter $tenant -state $Setting.state -RawJSON $JSONObj -Overwrite $true -APIName $APIName -Headers $Request.Headers -DisableSD $Setting.DisableSD
4343
} catch {
4444
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
4545
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create or update conditional access rule $($JSONObj.displayName). Error: $ErrorMessage" -sev 'Error'

0 commit comments

Comments
 (0)