Skip to content

Commit 5617557

Browse files
pull[bot]pull[bot]
authored
Merge pull request #309 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents 3a6d855 + 269148d commit 5617557

15 files changed

+253
-132
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyCalPerms.ps1‎

Lines changed: 53 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,21 @@ Function Invoke-ExecModifyCalPerms {
55
.FUNCTIONALITY
66
Entrypoint
77
.ROLE
8-
Exchange.Calendar.ReadWrite
8+
Exchange.Mailbox.ReadWrite
99
#>
1010
[CmdletBinding()]
1111
param($Request, $TriggerMetadata)
1212

1313
$APIName = $Request.Params.CIPPEndpoint
1414
Write-LogMessage -headers $Request.Headers -API $APINAME-message 'Accessed this API' -Sev 'Debug'
15-
15+
1616
$Username = $request.body.userID
1717
$Tenantfilter = $request.body.tenantfilter
1818
$Permissions = $request.body.permissions
1919

2020
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Processing request for user: $Username, tenant: $Tenantfilter" -Sev 'Debug'
2121

22-
if ($username -eq $null) {
22+
if ($username -eq $null) {
2323
Write-LogMessage -headers $Request.Headers -API $APINAME-message 'Username is null' -Sev 'Error'
2424
$body = [pscustomobject]@{'Results' = @('Username is required') }
2525
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
@@ -28,11 +28,12 @@ Function Invoke-ExecModifyCalPerms {
2828
})
2929
return
3030
}
31-
31+
3232
try {
3333
$userid = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$($username)" -tenantid $Tenantfilter).id
3434
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Retrieved user ID: $userid" -Sev 'Debug'
35-
} catch {
35+
}
36+
catch {
3637
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Failed to get user ID: $($_.Exception.Message)" -Sev 'Error'
3738
$body = [pscustomobject]@{'Results' = @("Failed to get user ID: $($_.Exception.Message)") }
3839
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
@@ -49,7 +50,8 @@ Function Invoke-ExecModifyCalPerms {
4950
if ($Permissions -is [PSCustomObject]) {
5051
if ($Permissions.PSObject.Properties.Name -match '^\d+$') {
5152
$Permissions = $Permissions.PSObject.Properties.Value
52-
} else {
53+
}
54+
else {
5355
$Permissions = @($Permissions)
5456
}
5557
}
@@ -58,14 +60,13 @@ Function Invoke-ExecModifyCalPerms {
5860

5961
foreach ($Permission in $Permissions) {
6062
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Processing permission: $($Permission | ConvertTo-Json)" -Sev 'Debug'
61-
63+
6264
$PermissionLevel = $Permission.PermissionLevel.value ?? $Permission.PermissionLevel
6365
$Modification = $Permission.Modification
6466
$CanViewPrivateItems = $Permission.CanViewPrivateItems ?? $false
65-
$FolderName = $Permission.FolderName ?? 'Calendar'
66-
67-
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Permission Level: $PermissionLevel, Modification: $Modification, CanViewPrivateItems: $CanViewPrivateItems, FolderName: $FolderName" -Sev 'Debug'
68-
67+
68+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Permission Level: $PermissionLevel, Modification: $Modification, CanViewPrivateItems: $CanViewPrivateItems" -Sev 'Debug'
69+
6970
# Handle UserID as array or single value
7071
$TargetUsers = @($Permission.UserID | ForEach-Object { $_.value ?? $_ })
7172

@@ -74,24 +75,48 @@ Function Invoke-ExecModifyCalPerms {
7475
foreach ($TargetUser in $TargetUsers) {
7576
try {
7677
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Processing target user: $TargetUser" -Sev 'Debug'
77-
$Params = @{
78-
APIName = $APIName
79-
Headers = $Request.Headers
80-
RemoveAccess = if ($Modification -eq 'Remove') { $TargetUser } else { $null }
81-
TenantFilter = $Tenantfilter
82-
UserID = $userid
83-
folderName = $FolderName
84-
UserToGetPermissions = $TargetUser
85-
LoggingName = $TargetUser
86-
Permissions = $PermissionLevel
87-
CanViewPrivateItems = $CanViewPrivateItems
78+
79+
if ($Modification -eq 'Remove') {
80+
try {
81+
$CalPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Remove-MailboxFolderPermission' -cmdParams @{
82+
Identity = "$($userid):\Calendar"
83+
User = $TargetUser
84+
Confirm = $false
85+
}
86+
$null = $results.Add("Removed $($TargetUser) from $($username) Calendar permissions")
87+
}
88+
catch {
89+
$null = $results.Add("No existing permissions to remove for $($TargetUser)")
90+
}
91+
}
92+
else {
93+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Setting permissions with AccessRights: $PermissionLevel" -Sev 'Debug'
94+
95+
$cmdParams = @{
96+
Identity = "$($userid):\Calendar"
97+
User = $TargetUser
98+
AccessRights = $PermissionLevel
99+
Confirm = $false
100+
}
101+
102+
if ($CanViewPrivateItems) {
103+
$cmdParams['SharingPermissionFlags'] = 'Delegate,CanViewPrivateItems'
104+
}
105+
106+
try {
107+
# Try Add first
108+
$CalPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Add-MailboxFolderPermission' -cmdParams $cmdParams
109+
$null = $results.Add("Granted $($TargetUser) $($PermissionLevel) access to $($username) Calendar$($CanViewPrivateItems ? ' with access to private items' : '')")
110+
}
111+
catch {
112+
# If Add fails, try Set
113+
$CalPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Set-MailboxFolderPermission' -cmdParams $cmdParams
114+
$null = $results.Add("Updated $($TargetUser) $($PermissionLevel) access to $($username) Calendar$($CanViewPrivateItems ? ' with access to private items' : '')")
115+
}
88116
}
89-
90-
$Result = Set-CIPPCalendarPermission @Params
91-
92-
$null = $results.Add($Result)
93117
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Successfully executed $($PermissionLevel) permission modification for $($TargetUser) on $($username)" -Sev 'Info' -tenant $TenantFilter
94-
} catch {
118+
}
119+
catch {
95120
$HasErrors = $true
96121
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Could not execute $($PermissionLevel) permission modification for $($TargetUser) on $($username). Error: $($_.Exception.Message)" -Sev 'Error' -tenant $TenantFilter
97122
$null = $results.Add("Could not execute $($PermissionLevel) permission modification for $($TargetUser) on $($username). Error: $($_.Exception.Message)")
@@ -112,4 +137,4 @@ Function Invoke-ExecModifyCalPerms {
112137
StatusCode = if ($HasErrors) { [HttpStatusCode]::InternalServerError } else { [HttpStatusCode]::OK }
113138
Body = $Body
114139
})
115-
}
140+
}

‎Modules/CIPPCore/Public/GraphHelper/New-GraphPOSTRequest.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ function New-GraphPOSTRequest ($uri, $tenantid, $body, $type, $scope, $AsApp, $N
77
if ($NoAuthCheck -or (Get-AuthorisedRequest -Uri $uri -TenantID $tenantid)) {
88
$headers = Get-GraphToken -tenantid $tenantid -scope $scope -AsApp $asapp -SkipCache $skipTokenCache
99
if ($AddedHeaders) {
10-
foreach ($header in $AddedHeaders.getenumerator()) {
10+
foreach ($header in $AddedHeaders.GetEnumerator()) {
1111
$headers.Add($header.Key, $header.Value)
1212
}
1313
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ function Invoke-CIPPStandardAutopilotProfile {
1818
ADDEDCOMPONENT
1919
{"type":"textField","name":"standards.AutopilotProfile.DisplayName","label":"Profile Display Name"}
2020
{"type":"textField","name":"standards.AutopilotProfile.Description","label":"Profile Description"}
21-
{"type":"textField","name":"standards.AutopilotProfile.DeviceNameTemplate","label":"Unique Device Name Template"}
21+
{"type":"textField","name":"standards.AutopilotProfile.DeviceNameTemplate","label":"Unique Device Name Template","required":false}
2222
{"type":"autoComplete","multiple":false,"creatable":false,"required":false,"name":"standards.AutopilotProfile.Languages","label":"Languages","api":{"url":"/languageList.json","labelField":"language","valueField":"tag"}}
2323
{"type":"switch","name":"standards.AutopilotProfile.CollectHash","label":"Convert all targeted devices to Autopilot","defaultValue":true}
2424
{"type":"switch","name":"standards.AutopilotProfile.AssignToAllDevices","label":"Assign to all devices","defaultValue":true}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,22 +5,22 @@ function Invoke-CIPPStandardDeployContactTemplates {
55
.COMPONENT
66
(APIName) DeployContactTemplates
77
.SYNOPSIS
8-
(Label) Deploy Contact Templates
8+
(Label) Deploy Mail Contact Template
99
.DESCRIPTION
10-
(Helptext) Creates a new contacts in Exchange Online across all selected tenants from saved contact templates. The contact will be visible in the Global Address List unless hidden.
11-
(DocsDescription) This standard creates new contacts in Exchange Online from saved contact templates. Mail contacts are useful for adding external email addresses to your organization's address book. They can be used for distribution lists, shared mailboxes, and other collaboration scenarios.
10+
(Helptext) Creates new mail contacts in Exchange Online across all selected tenants based on the selected templates. The contact will be visible in the Global Address List unless hidden.
11+
(DocsDescription) This standard creates new mail contacts in Exchange Online based on the selected templates. Mail contacts are useful for adding external email addresses to your organization's address book. They can be used for distribution lists, shared mailboxes, and other collaboration scenarios.
1212
.NOTES
1313
CAT
1414
Exchange Standards
1515
TAG
1616
ADDEDCOMPONENT
17-
{"type":"textField","name":"TemplateGUID","label":"Contact Template GUID","required":true}
18-
MULTIPLE
19-
True
17+
{"type":"autoComplete","multiple":true,"creatable":false,"label":"Select Mail Contact Templates","name":"standards.DeployContactTemplates.templateIds","api":{"url":"/api/ListContactTemplates","labelField":"name","valueField":"GUID","queryKey":"Contact Templates"}}
18+
DISABLEDFEATURES
19+
{"report":false,"warn":false,"remediate":false}
2020
IMPACT
2121
Low Impact
2222
ADDEDDATE
23-
2024-03-19
23+
2025-05-31
2424
POWERSHELLEQUIVALENT
2525
New-MailContact
2626
RECOMMENDEDBY

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,15 @@ function Invoke-CIPPStandardDeployMailContact {
2121
IMPACT
2222
Low Impact
2323
ADDEDDATE
24-
2025-05-28
24+
2024-03-19
2525
POWERSHELLEQUIVALENT
2626
New-MailContact
2727
RECOMMENDEDBY
2828
"CIPP"
29+
UPDATECOMMENTBLOCK
30+
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
31+
.LINK
32+
https://docs.cipp.app/user-documentation/tenant/standards/list-standards
2933
#>
3034

3135
param($Tenant, $Settings)

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -33,38 +33,38 @@ function Invoke-CIPPStandardDisableAdditionalStorageProviders {
3333
param($Tenant, $Settings)
3434
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableAdditionalStorageProviders'
3535

36-
$AdditionalStorageProvidersState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OwaMailboxPolicy' -cmdParams @{Identity = 'OwaMailboxPolicy-Default' }
36+
$AdditionalStorageProvidersState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OwaMailboxPolicy' -cmdParams @{Identity = 'OwaMailboxPolicy-Default' } -Select 'Identity, AdditionalStorageProvidersAvailable'
3737

3838
if ($Settings.remediate -eq $true) {
3939

4040
try {
4141
if ($AdditionalStorageProvidersState.AdditionalStorageProvidersAvailable) {
42-
New-ExoRequest -tenantid $Tenant -cmdlet 'Set-OwaMailboxPolicy' -cmdParams @{ Identity = $AdditionalStorageProvidersState.Identity; AdditionalStorageProvidersAvailable = $false } -useSystemMailbox $true
43-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'OWA additional storage providers have been disabled.' -sev Info
42+
$null = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-OwaMailboxPolicy' -cmdParams @{ Identity = $AdditionalStorageProvidersState.Identity; AdditionalStorageProvidersAvailable = $false } -useSystemMailbox $true
43+
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'OWA additional storage providers has been disabled.' -sev Info
4444
$AdditionalStorageProvidersState.AdditionalStorageProvidersAvailable = $false
4545
} else {
46-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'OWA additional storage providers are already disabled.' -sev Info
46+
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'OWA additional storage providers are already disabled.' -sev Info
4747
}
4848
} catch {
49-
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
50-
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to disable OWA additional storage providers. Error: $ErrorMessage" -sev Error
49+
$ErrorMessage = Get-CippException -Exception $_
50+
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to disable OWA additional storage providers. Error: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
5151
}
5252

5353
}
5454

5555
if ($Settings.alert -eq $true) {
5656
if ($AdditionalStorageProvidersState.AdditionalStorageProvidersAvailable) {
5757
$Object = $AdditionalStorageProvidersState | Select-Object -Property AdditionalStorageProvidersAvailable
58-
Write-StandardsAlert -message 'OWA additional storage providers are enabled' -object $Object -tenant $tenant -standardName 'DisableAdditionalStorageProviders' -standardId $Settings.standardId
59-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'OWA additional storage providers are enabled' -sev Info
58+
Write-StandardsAlert -message 'OWA additional storage providers are enabled' -object $Object -tenant $Tenant -standardName 'DisableAdditionalStorageProviders' -standardId $Settings.standardId
59+
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'OWA additional storage providers are enabled' -sev Info
6060
} else {
61-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'OWA additional storage providers are disabled' -sev Info
61+
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'OWA additional storage providers are disabled' -sev Info
6262
}
6363
}
6464

6565
if ($Settings.report -eq $true) {
66-
$state = $AdditionalStorageProvidersState.AdditionalStorageProvidersEnabled ? $false : $true
67-
Set-CIPPStandardsCompareField -FieldName 'standards.DisableAdditionalStorageProviders' -FieldValue $state -TenantFilter $Tenant
68-
Add-CIPPBPAField -FieldName 'AdditionalStorageProvidersEnabled' -FieldValue $AdditionalStorageProvidersState.AdditionalStorageProvidersEnabled -StoreAs bool -Tenant $tenant
66+
$State = $AdditionalStorageProvidersState.AdditionalStorageProvidersEnabled ? $false : $true
67+
Set-CIPPStandardsCompareField -FieldName 'standards.DisableAdditionalStorageProviders' -FieldValue $State -TenantFilter $Tenant
68+
Add-CIPPBPAField -FieldName 'AdditionalStorageProvidersEnabled' -FieldValue $State -StoreAs bool -Tenant $Tenant
6969
}
7070
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTenantCreation.ps1‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -37,37 +37,37 @@ function Invoke-CIPPStandardDisableTenantCreation {
3737
$StateIsCorrect = ($CurrentState.defaultUserRolePermissions.allowedToCreateTenants -eq $false)
3838

3939
If ($Settings.remediate -eq $true) {
40+
Write-Host "Time to remediate DisableTenantCreation standard for tenant $Tenant"
4041
if ($StateIsCorrect -eq $true) {
41-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are already disabled from creating tenants.' -sev Info
42+
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Users are already disabled from creating tenants.' -sev Info
4243
} else {
4344
try {
4445
$GraphRequest = @{
45-
tenantid = $tenant
46-
uri = 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy'
47-
AsApp = $false
48-
Type = 'PATCH'
49-
ContentType = 'application/json'
50-
Body = '{"defaultUserRolePermissions":{"allowedToCreateTenants":false}}'
46+
tenantid = $Tenant
47+
uri = 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy'
48+
Type = 'PATCH'
49+
Body = '{"defaultUserRolePermissions":{"allowedToCreateTenants":false}}'
5150
}
52-
New-GraphPostRequest @GraphRequest
53-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Disabled users from creating tenants.' -sev Info
51+
New-GraphPOSTRequest @GraphRequest
52+
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Successfully disabled users from creating tenants.' -sev Info
5453
} catch {
55-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Failed to disable users from creating tenants' -sev 'Error' -LogData $_
54+
$ErrorMessage = Get-CippException -Exception $_
55+
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to disable users from creating tenants. Error: $($ErrorMessage.NormalizedError)" -sev 'Error' -LogData $ErrorMessage
5656
}
5757
}
5858
}
5959

6060
if ($Settings.alert -eq $true) {
6161
if ($StateIsCorrect -eq $true) {
62-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are not allowed to create tenants.' -sev Info
62+
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Users are not allowed to create tenants.' -sev Info
6363
} else {
64-
Write-StandardsAlert -message 'Users are allowed to create tenants' -object $CurrentState -tenant $tenant -standardName 'DisableTenantCreation' -standardId $Settings.standardId
65-
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are allowed to create tenants.' -sev Info
64+
Write-StandardsAlert -message 'Users are allowed to create tenants' -object $CurrentState -tenant $Tenant -standardName 'DisableTenantCreation' -standardId $Settings.standardId
65+
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Users are allowed to create tenants.' -sev Info
6666
}
6767
}
6868

6969
if ($Settings.report -eq $true) {
7070
Set-CIPPStandardsCompareField -FieldName 'standards.DisableTenantCreation' -FieldValue $StateIsCorrect -TenantFilter $Tenant
71-
Add-CIPPBPAField -FieldName 'DisableTenantCreation' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
71+
Add-CIPPBPAField -FieldName 'DisableTenantCreation' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
7272
}
7373
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableNamePronunciation.ps1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ function Invoke-CIPPStandardEnableNamePronunciation {
1919
ADDEDDATE
2020
2025-06-06
2121
RECOMMENDEDBY
22+
"CIPP"
2223
UPDATECOMMENTBLOCK
2324
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
2425
.LINK

0 commit comments

Comments
 (0)