Skip to content

Commit 4eea87a

Browse files
pull[bot]pull[bot]
authored
Merge pull request #475 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents 915c7df + 440f5f2 commit 4eea87a

File tree

4 files changed

+55
-24
lines changed

4 files changed

+55
-24
lines changed

‎Config/standards.json‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -965,10 +965,18 @@
965965
"name": "standards.DisableGuests",
966966
"cat": "Entra (AAD) Standards",
967967
"tag": [],
968-
"helpText": "Blocks login for guest users that have not logged in for 90 days",
969-
"executiveText": "Automatically disables external guest accounts that haven't been used for 90 days, reducing security risks from dormant accounts while maintaining access for active external collaborators. This helps maintain a clean user directory and reduces potential attack vectors.",
970-
"addedComponent": [],
971-
"label": "Disable Guest accounts that have not logged on for 90 days",
968+
"helpText": "Blocks login for guest users that have not logged in for a number of days",
969+
"executiveText": "Automatically disables external guest accounts that haven't been used for a number of days, reducing security risks from dormant accounts while maintaining access for active external collaborators. This helps maintain a clean user directory and reduces potential attack vectors.",
970+
"addedComponent": [
971+
{
972+
"type": "number",
973+
"name": "standards.DisableGuests.days",
974+
"required": true,
975+
"defaultValue": 90,
976+
"label": "Days of inactivity"
977+
}
978+
],
979+
"label": "Disable Guest accounts that have not logged on for a number of days",
972980
"impact": "Medium Impact",
973981
"impactColour": "warning",
974982
"addedDate": "2022-10-20",

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecAssignPolicy.ps1‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,26 @@ Function Invoke-ExecAssignPolicy {
2424

2525
$results = try {
2626
if ($AssignTo) {
27-
$null = Set-CIPPAssignedPolicy -PolicyId $ID -TenantFilter $TenantFilter -GroupName $AssignTo -Type $Type -Headers $Headers
27+
$AssignmentResult = Set-CIPPAssignedPolicy -PolicyId $ID -TenantFilter $TenantFilter -GroupName $AssignTo -Type $Type -Headers $Headers
28+
if ($AssignmentResult) {
29+
# Check if it's a warning message (no groups found)
30+
if ($AssignmentResult -like "*No groups found*") {
31+
$StatusCode = [HttpStatusCode]::BadRequest
32+
} else {
33+
$StatusCode = [HttpStatusCode]::OK
34+
}
35+
$AssignmentResult
36+
} else {
37+
$StatusCode = [HttpStatusCode]::OK
38+
"Successfully edited policy for $($TenantFilter)"
39+
}
40+
} else {
41+
$StatusCode = [HttpStatusCode]::OK
42+
"Successfully edited policy for $($TenantFilter)"
2843
}
29-
"Successfully edited policy for $($TenantFilter)"
30-
$StatusCode = [HttpStatusCode]::OK
3144
} catch {
32-
"Failed to add policy for $($TenantFilter): $($_.Exception.Message)"
3345
$StatusCode = [HttpStatusCode]::InternalServerError
46+
"Failed to add policy for $($TenantFilter): $($_.Exception.Message)"
3447
}
3548

3649

‎Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@ function Set-CIPPAssignedPolicy {
5151
)
5252
}
5353
default {
54-
Write-Host "We're supposed to assign a custom group. The group is $GroupName"
5554
$GroupNames = $GroupName.Split(',').Trim()
5655
$GroupIds = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups?$select=id,displayName&$top=999' -tenantid $TenantFilter |
5756
ForEach-Object {
@@ -61,6 +60,13 @@ function Set-CIPPAssignedPolicy {
6160
}
6261
}
6362
}
63+
64+
if (-not $GroupIds -or $GroupIds.Count -eq 0) {
65+
$ErrorMessage = "No groups found matching the specified name(s): $GroupName. Policy not assigned."
66+
Write-LogMessage -headers $Headers -API $APIName -message $ErrorMessage -Sev 'Warning' -tenant $TenantFilter
67+
return $ErrorMessage
68+
}
69+
6470
foreach ($gid in $GroupIds) {
6571
$assignmentsList.Add(
6672
@{
@@ -102,19 +108,21 @@ function Set-CIPPAssignedPolicy {
102108
}
103109

104110
$AssignJSON = $assignmentsObject | ConvertTo-Json -Depth 10 -Compress
105-
Write-Host "AssignJSON: $AssignJSON"
106111
if ($PSCmdlet.ShouldProcess($GroupName, "Assigning policy $PolicyId")) {
107112
$uri = "https://graph.microsoft.com/beta/$($PlatformType)/$Type('$($PolicyId)')/assign"
108113
$null = New-GraphPOSTRequest -uri $uri -tenantid $TenantFilter -type POST -body $AssignJSON
109114
if ($ExcludeGroup) {
110115
Write-LogMessage -headers $Headers -API $APIName -message "Assigned group '$GroupName' and excluded group '$ExcludeGroup' on Policy $PolicyId" -Sev 'Info' -tenant $TenantFilter
116+
return "Successfully assigned group '$GroupName' and excluded group '$ExcludeGroup' on Policy $PolicyId"
111117
} else {
112118
Write-LogMessage -headers $Headers -API $APIName -message "Assigned group '$GroupName' on Policy $PolicyId" -Sev 'Info' -tenant $TenantFilter
119+
return "Successfully assigned group '$GroupName' on Policy $PolicyId"
113120
}
114121
}
115122

116123
} catch {
117124
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
118125
Write-LogMessage -headers $Headers -API $APIName -message "Failed to assign $GroupName to Policy $PolicyId, using Platform $PlatformType and $Type. The error is:$ErrorMessage" -Sev 'Error' -tenant $TenantFilter -LogData $ErrorMessage
126+
return "Failed to assign $GroupName to Policy $PolicyId. Error: $ErrorMessage"
119127
}
120128
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,18 @@ function Invoke-CIPPStandardDisableGuests {
55
.COMPONENT
66
(APIName) DisableGuests
77
.SYNOPSIS
8-
(Label) Disable Guest accounts that have not logged on for 90 days
8+
(Label) Disable Guest accounts that have not logged on for a number of days
99
.DESCRIPTION
10-
(Helptext) Blocks login for guest users that have not logged in for 90 days
11-
(DocsDescription) Blocks login for guest users that have not logged in for 90 days
10+
(Helptext) Blocks login for guest users that have not logged in for a number of days
11+
(DocsDescription) Blocks login for guest users that have not logged in for a number of days
1212
.NOTES
1313
CAT
1414
Entra (AAD) Standards
1515
TAG
16+
EXECUTIVETEXT
17+
Automatically disables external guest accounts that haven't been used for a number of days, reducing security risks from dormant accounts while maintaining access for active external collaborators. This helps maintain a clean user directory and reduces potential attack vectors.
1618
ADDEDCOMPONENT
19+
{"type":"number","name":"standards.DisableGuests.days","required":true,"defaultValue":90,"label":"Days of inactivity"}
1720
IMPACT
1821
Medium Impact
1922
ADDEDDATE
@@ -31,27 +34,26 @@ function Invoke-CIPPStandardDisableGuests {
3134

3235
param($Tenant, $Settings)
3336
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableGuests'
34-
35-
$90Days = (Get-Date).AddDays(-90).ToUniversalTime()
36-
$Lookup = $90Days.ToString('o')
37+
$checkDays = if ($Settings.days) { $Settings.days } else { 90 }
38+
$Days = (Get-Date).AddDays(-$checkDays).ToUniversalTime()
39+
$Lookup = $Days.ToString('o')
3740
$AuditLookup = (Get-Date).AddDays(-7).ToUniversalTime().ToString('o')
3841

3942
try {
4043
$GraphRequest = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$filter=createdDateTime le $Lookup and userType eq 'Guest' and accountEnabled eq true &`$select=id,UserPrincipalName,signInActivity,mail,userType,accountEnabled,createdDateTime,externalUserState" -scope 'https://graph.microsoft.com/.default' -tenantid $Tenant |
41-
Where-Object { $_.signInActivity.lastSuccessfulSignInDateTime -le $90Days }
42-
}
43-
catch {
44+
Where-Object { $_.signInActivity.lastSuccessfulSignInDateTime -le $Days }
45+
} catch {
4446
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
4547
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableGuests state for $Tenant. Error: $ErrorMessage" -Sev Error
4648
return
4749
}
4850

4951
$RecentlyReactivatedUsers = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/auditLogs/directoryAudits?`$filter=activityDisplayName eq 'Enable account' and activityDateTime ge $AuditLookup" -scope 'https://graph.microsoft.com/.default' -tenantid $Tenant |
50-
ForEach-Object { $_.targetResources[0].id } | Select-Object -Unique)
52+
ForEach-Object { $_.targetResources[0].id } | Select-Object -Unique)
5153

5254
$GraphRequest = $GraphRequest | Where-Object { -not ($RecentlyReactivatedUsers -contains $_.id) }
5355

54-
If ($Settings.remediate -eq $true) {
56+
if ($Settings.remediate -eq $true) {
5557
if ($GraphRequest.Count -gt 0) {
5658
foreach ($guest in $GraphRequest) {
5759
try {
@@ -63,7 +65,7 @@ function Invoke-CIPPStandardDisableGuests {
6365
}
6466
}
6567
} else {
66-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'No guests accounts with a login longer than 90 days ago.' -sev Info
68+
Write-LogMessage -API 'Standards' -tenant $tenant -message "No guests accounts with a login longer than $($Settings.days) days ago." -sev Info
6769
}
6870

6971
}
@@ -72,9 +74,9 @@ function Invoke-CIPPStandardDisableGuests {
7274
if ($GraphRequest.Count -gt 0) {
7375
$Filtered = $GraphRequest | Select-Object -Property UserPrincipalName, id, signInActivity, mail, userType, accountEnabled, externalUserState
7476
Write-StandardsAlert -message "Guests accounts with a login longer than 90 days ago: $($GraphRequest.count)" -object $Filtered -tenant $tenant -standardName 'DisableGuests' -standardId $Settings.standardId
75-
Write-LogMessage -API 'Standards' -tenant $tenant -message "Guests accounts with a login longer than 90 days ago: $($GraphRequest.count)" -sev Info
77+
Write-LogMessage -API 'Standards' -tenant $tenant -message "Guests accounts with a login longer than $($Settings.days) days ago: $($GraphRequest.count)" -sev Info
7678
} else {
77-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'No guests accounts with a login longer than 90 days ago.' -sev Info
79+
Write-LogMessage -API 'Standards' -tenant $tenant -message "No guests accounts with a login longer than $($Settings.days) days ago." -sev Info
7880
}
7981
}
8082
if ($Settings.report -eq $true) {

0 commit comments

Comments
 (0)