Skip to content

Commit 559d698

Browse files
pull[bot]pull[bot]
authored
Merge pull request #649 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents ae18d41 + 9660318 commit 559d698

40 files changed

+318
-298
lines changed

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1‎

Lines changed: 72 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,14 @@ function Push-CIPPDBCacheData {
1818
try {
1919
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Starting database cache collection for tenant' -sev Info
2020

21+
# Check tenant capabilities for license-specific features
22+
$IntuneCapable = Test-CIPPStandardLicense -StandardName 'IntuneLicenseCheck' -TenantFilter $TenantFilter -RequiredCapabilities @('INTUNE_A', 'MDM_Services', 'EMS', 'SCCM', 'MICROSOFTINTUNEPLAN1') -SkipLog
23+
$ConditionalAccessCapable = Test-CIPPStandardLicense -StandardName 'ConditionalAccessLicenseCheck' -TenantFilter $TenantFilter -RequiredCapabilities @('AAD_PREMIUM', 'AAD_PREMIUM_P2') -SkipLog
24+
$AzureADPremiumP2Capable = Test-CIPPStandardLicense -StandardName 'AzureADPremiumP2LicenseCheck' -TenantFilter $TenantFilter -RequiredCapabilities @('AAD_PREMIUM_P2') -SkipLog
25+
26+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "License capabilities - Intune: $IntuneCapable, Conditional Access: $ConditionalAccessCapable, Azure AD Premium P2: $AzureADPremiumP2Capable" -sev Info
27+
28+
#region All Licenses - Basic tenant data collection
2129
Write-Host 'Getting cache for Users'
2230
try { Set-CIPPDBCacheUsers -TenantFilter $TenantFilter } catch {
2331
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Users collection failed: $($_.Exception.Message)" -sev Error
@@ -48,11 +56,6 @@ function Push-CIPPDBCacheData {
4856
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Devices collection failed: $($_.Exception.Message)" -sev Error
4957
}
5058

51-
Write-Host 'Getting cache for ManagedDevices'
52-
try { Set-CIPPDBCacheManagedDevices -TenantFilter $TenantFilter } catch {
53-
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ManagedDevices collection failed: $($_.Exception.Message)" -sev Error
54-
}
55-
5659
Write-Host 'Getting cache for Organization'
5760
try { Set-CIPPDBCacheOrganization -TenantFilter $TenantFilter } catch {
5861
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Organization collection failed: $($_.Exception.Message)" -sev Error
@@ -108,16 +111,6 @@ function Push-CIPPDBCacheData {
108111
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "SecureScore collection failed: $($_.Exception.Message)" -sev Error
109112
}
110113

111-
Write-Host 'Getting cache for IntunePolicies'
112-
try { Set-CIPPDBCacheIntunePolicies -TenantFilter $TenantFilter } catch {
113-
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "IntunePolicies collection failed: $($_.Exception.Message)" -sev Error
114-
}
115-
116-
Write-Host 'Getting cache for ConditionalAccessPolicies'
117-
try { Set-CIPPDBCacheConditionalAccessPolicies -TenantFilter $TenantFilter } catch {
118-
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ConditionalAccessPolicies collection failed: $($_.Exception.Message)" -sev Error
119-
}
120-
121114
Write-Host 'Getting cache for PIMSettings'
122115
try { Set-CIPPDBCachePIMSettings -TenantFilter $TenantFilter } catch {
123116
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "PIMSettings collection failed: $($_.Exception.Message)" -sev Error
@@ -153,26 +146,6 @@ function Push-CIPPDBCacheData {
153146
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "AuthenticationFlowsPolicy collection failed: $($_.Exception.Message)" -sev Error
154147
}
155148

156-
Write-Host 'Getting cache for RiskyUsers'
157-
try { Set-CIPPDBCacheRiskyUsers -TenantFilter $TenantFilter } catch {
158-
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskyUsers collection failed: $($_.Exception.Message)" -sev Error
159-
}
160-
161-
Write-Host 'Getting cache for RiskyServicePrincipals'
162-
try { Set-CIPPDBCacheRiskyServicePrincipals -TenantFilter $TenantFilter } catch {
163-
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskyServicePrincipals collection failed: $($_.Exception.Message)" -sev Error
164-
}
165-
166-
Write-Host 'Getting cache for ServicePrincipalRiskDetections'
167-
try { Set-CIPPDBCacheServicePrincipalRiskDetections -TenantFilter $TenantFilter } catch {
168-
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ServicePrincipalRiskDetections collection failed: $($_.Exception.Message)" -sev Error
169-
}
170-
171-
Write-Host 'Getting cache for RiskDetections'
172-
try { Set-CIPPDBCacheRiskDetections -TenantFilter $TenantFilter } catch {
173-
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskDetections collection failed: $($_.Exception.Message)" -sev Error
174-
}
175-
176149
Write-Host 'Getting cache for DeviceRegistrationPolicy'
177150
try { Set-CIPPDBCacheDeviceRegistrationPolicy -TenantFilter $TenantFilter } catch {
178151
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "DeviceRegistrationPolicy collection failed: $($_.Exception.Message)" -sev Error
@@ -188,11 +161,6 @@ function Push-CIPPDBCacheData {
188161
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "UserRegistrationDetails collection failed: $($_.Exception.Message)" -sev Error
189162
}
190163

191-
Write-Host 'Getting cache for ManagedDeviceEncryptionStates'
192-
try { Set-CIPPDBCacheManagedDeviceEncryptionStates -TenantFilter $TenantFilter } catch {
193-
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ManagedDeviceEncryptionStates collection failed: $($_.Exception.Message)" -sev Error
194-
}
195-
196164
Write-Host 'Getting cache for OAuth2PermissionGrants'
197165
try { Set-CIPPDBCacheOAuth2PermissionGrants -TenantFilter $TenantFilter } catch {
198166
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "OAuth2PermissionGrants collection failed: $($_.Exception.Message)" -sev Error
@@ -242,11 +210,70 @@ function Push-CIPPDBCacheData {
242210
try { Set-CIPPDBCacheExoAcceptedDomains -TenantFilter $TenantFilter } catch {
243211
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoAcceptedDomains collection failed: $($_.Exception.Message)" -sev Error
244212
}
245-
246-
Write-Host 'Getting cache for IntuneAppProtectionPolicies'
247-
try { Set-CIPPDBCacheIntuneAppProtectionPolicies -TenantFilter $TenantFilter } catch {
248-
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "IntuneAppProtectionPolicies collection failed: $($_.Exception.Message)" -sev Error
249-
}
213+
#endregion All Licenses
214+
215+
#region Conditional Access Licensed - Azure AD Premium features
216+
if ($ConditionalAccessCapable) {
217+
Write-Host 'Getting cache for ConditionalAccessPolicies'
218+
try { Set-CIPPDBCacheConditionalAccessPolicies -TenantFilter $TenantFilter } catch {
219+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ConditionalAccessPolicies collection failed: $($_.Exception.Message)" -sev Error
220+
}
221+
} else {
222+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Skipping Conditional Access data collection - tenant does not have required license' -sev Info
223+
}
224+
#endregion Conditional Access Licensed
225+
226+
#region Azure AD Premium P2 - Identity Protection features
227+
if ($AzureADPremiumP2Capable) {
228+
Write-Host 'Getting cache for RiskyUsers'
229+
try { Set-CIPPDBCacheRiskyUsers -TenantFilter $TenantFilter } catch {
230+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskyUsers collection failed: $($_.Exception.Message)" -sev Error
231+
}
232+
233+
Write-Host 'Getting cache for RiskyServicePrincipals'
234+
try { Set-CIPPDBCacheRiskyServicePrincipals -TenantFilter $TenantFilter } catch {
235+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskyServicePrincipals collection failed: $($_.Exception.Message)" -sev Error
236+
}
237+
238+
Write-Host 'Getting cache for ServicePrincipalRiskDetections'
239+
try { Set-CIPPDBCacheServicePrincipalRiskDetections -TenantFilter $TenantFilter } catch {
240+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ServicePrincipalRiskDetections collection failed: $($_.Exception.Message)" -sev Error
241+
}
242+
243+
Write-Host 'Getting cache for RiskDetections'
244+
try { Set-CIPPDBCacheRiskDetections -TenantFilter $TenantFilter } catch {
245+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskDetections collection failed: $($_.Exception.Message)" -sev Error
246+
}
247+
} else {
248+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Skipping Azure AD Premium P2 Identity Protection data collection - tenant does not have required license' -sev Info
249+
}
250+
#endregion Azure AD Premium P2
251+
252+
#region Intune Licensed - Intune management features
253+
if ($IntuneCapable) {
254+
Write-Host 'Getting cache for ManagedDevices'
255+
try { Set-CIPPDBCacheManagedDevices -TenantFilter $TenantFilter } catch {
256+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ManagedDevices collection failed: $($_.Exception.Message)" -sev Error
257+
}
258+
259+
Write-Host 'Getting cache for IntunePolicies'
260+
try { Set-CIPPDBCacheIntunePolicies -TenantFilter $TenantFilter } catch {
261+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "IntunePolicies collection failed: $($_.Exception.Message)" -sev Error
262+
}
263+
264+
Write-Host 'Getting cache for ManagedDeviceEncryptionStates'
265+
try { Set-CIPPDBCacheManagedDeviceEncryptionStates -TenantFilter $TenantFilter } catch {
266+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ManagedDeviceEncryptionStates collection failed: $($_.Exception.Message)" -sev Error
267+
}
268+
269+
Write-Host 'Getting cache for IntuneAppProtectionPolicies'
270+
try { Set-CIPPDBCacheIntuneAppProtectionPolicies -TenantFilter $TenantFilter } catch {
271+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "IntuneAppProtectionPolicies collection failed: $($_.Exception.Message)" -sev Error
272+
}
273+
} else {
274+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Skipping Intune data collection - tenant does not have required license' -sev Info
275+
}
276+
#endregion Intune Licensed
250277

251278
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Completed database cache collection for tenant' -sev Info
252279

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21837.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ function Invoke-CippTestZTNA21837 {
55
#Tested
66
try {
77
# Get device registration policy
8-
$DeviceSettings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'deviceRegistrationPolicy'
8+
$DeviceSettings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DeviceRegistrationPolicy'
99

1010
if (-not $DeviceSettings) {
1111
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Investigate' -ResultMarkdown 'Device settings not found in database' -Risk 'High' -Name 'Limit the maximum number of devices per user to 10' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Devices'

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21896.ps1‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
function Invoke-CippTestZTNA21896 {
22
param($Tenant)
3-
3+
#tested
44
try {
55
$ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
66
if (-not $ServicePrincipals) {
@@ -47,8 +47,7 @@ function Invoke-CippTestZTNA21896 {
4747
$Result = $ResultLines -join "`n"
4848

4949
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21896' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Service principals do not have certificates or credentials associated with them' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application management'
50-
}
51-
catch {
50+
} catch {
5251
$ErrorMessage = Get-CippException -Exception $_
5352
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
5453
Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21896' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Service principals do not have certificates or credentials associated with them' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application management'

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21941.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ function Invoke-CippTestZTNA21941 {
1616
[Parameter(Mandatory = $true)]
1717
[string]$Tenant
1818
)
19-
19+
#Tested
2020
try {
2121
# Get CA policies from cache
2222
$CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'

‎Modules/CIPPCore/Public/Tests/Invoke-CippTestZTNA21953.ps1‎

Lines changed: 28 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,24 @@ function Invoke-CippTestZTNA21953 {
1515
[Parameter(Mandatory = $true)]
1616
[string]$Tenant
1717
)
18+
#Tested
1819

1920
try {
2021
# Get device registration policy from cache
2122
$DeviceRegPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DeviceRegistrationPolicy'
2223

2324
if (-not $DeviceRegPolicy) {
2425
$TestParams = @{
25-
TestId = 'ZTNA21953'
26-
TenantFilter = $Tenant
27-
TestType = 'ZeroTrustNetworkAccess'
28-
Status = 'Skipped'
29-
ResultMarkdown = 'Unable to retrieve device registration policy from cache.'
30-
Risk = 'High'
31-
Name = 'Deploy Windows Local Administrator Password Solution (LAPS)'
32-
UserImpact = 'Low'
26+
TestId = 'ZTNA21953'
27+
TenantFilter = $Tenant
28+
TestType = 'ZeroTrustNetworkAccess'
29+
Status = 'Skipped'
30+
ResultMarkdown = 'Unable to retrieve device registration policy from cache.'
31+
Risk = 'High'
32+
Name = 'Deploy Windows Local Administrator Password Solution (LAPS)'
33+
UserImpact = 'Low'
3334
ImplementationEffort = 'Low'
34-
Category = 'Device security'
35+
Category = 'Device security'
3536
}
3637
Add-CippTestResult @TestParams
3738
return
@@ -51,31 +52,31 @@ function Invoke-CippTestZTNA21953 {
5152
}
5253

5354
$TestParams = @{
54-
TestId = 'ZTNA21953'
55-
TenantFilter = $Tenant
56-
TestType = 'ZeroTrustNetworkAccess'
57-
Status = $Status
58-
ResultMarkdown = $ResultMarkdown
59-
Risk = 'High'
60-
Name = 'Deploy Windows Local Administrator Password Solution (LAPS)'
61-
UserImpact = 'Low'
55+
TestId = 'ZTNA21953'
56+
TenantFilter = $Tenant
57+
TestType = 'ZeroTrustNetworkAccess'
58+
Status = $Status
59+
ResultMarkdown = $ResultMarkdown
60+
Risk = 'High'
61+
Name = 'Deploy Windows Local Administrator Password Solution (LAPS)'
62+
UserImpact = 'Low'
6263
ImplementationEffort = 'Low'
63-
Category = 'Device security'
64+
Category = 'Device security'
6465
}
6566
Add-CippTestResult @TestParams
6667

6768
} catch {
6869
$TestParams = @{
69-
TestId = 'ZTNA21953'
70-
TenantFilter = $Tenant
71-
TestType = 'ZeroTrustNetworkAccess'
72-
Status = 'Failed'
73-
ResultMarkdown = "❌ **Error**: $($_.Exception.Message)"
74-
Risk = 'High'
75-
Name = 'Deploy Windows Local Administrator Password Solution (LAPS)'
76-
UserImpact = 'Low'
70+
TestId = 'ZTNA21953'
71+
TenantFilter = $Tenant
72+
TestType = 'ZeroTrustNetworkAccess'
73+
Status = 'Failed'
74+
ResultMarkdown = "❌ **Error**: $($_.Exception.Message)"
75+
Risk = 'High'
76+
Name = 'Deploy Windows Local Administrator Password Solution (LAPS)'
77+
UserImpact = 'Low'
7778
ImplementationEffort = 'Low'
78-
Category = 'Device security'
79+
Category = 'Device security'
7980
}
8081
Add-CippTestResult @TestParams
8182
Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21953 failed: $($_.Exception.Message)" -sev Error

0 commit comments

Comments
 (0)