Skip to content

Commit 6a58018

Browse files
JohnDupreyJohnDuprey
committed
feat: vacation mode exclusions from audit log rules
excluding a user from a location based CA policy will now allow you to exclude the user from a location based audit log rule fixes KelvinTegelaar/CIPP#4965
1 parent b50c4bb commit 6a58018

File tree

3 files changed

+106
-0
lines changed

3 files changed

+106
-0
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCAExclusion.ps1‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ function Invoke-ExecCAExclusion {
1818
$EndDate = $Request.Body.EndDate
1919
$PolicyId = $Request.Body.PolicyId
2020
$ExclusionType = $Request.Body.ExclusionType
21+
$ExcludeLocationAuditAlerts = $Request.Body.excludeLocationAuditAlerts
2122

2223
if ($Users) {
2324
$UserID = $Users.value
@@ -61,6 +62,12 @@ function Invoke-ExecCAExclusion {
6162
if ($Request.Body.vacation -eq 'true') {
6263
$StartDate = $Request.Body.StartDate
6364
$EndDate = $Request.Body.EndDate
65+
# Detect if policy targets specific named locations (GUIDs) and user requested audit log exclusion
66+
$GuidRegex = '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'
67+
$LocationIds = @()
68+
if ($Policy.conditions.locations.includeLocations) { $LocationIds += $Policy.conditions.locations.includeLocations }
69+
if ($Policy.conditions.locations.excludeLocations) { $LocationIds += $Policy.conditions.locations.excludeLocations }
70+
$PolicyHasGuidLocations = $LocationIds | Where-Object { $_ -match $GuidRegex }
6471

6572
$Parameters = [PSCustomObject]@{
6673
GroupType = 'Security'
@@ -82,6 +89,18 @@ function Invoke-ExecCAExclusion {
8289
Write-Information ($TaskBody | ConvertTo-Json -Depth 10)
8390

8491
Add-CIPPScheduledTask -Task $TaskBody -hidden $false
92+
# Optional: schedule audit log exclusion add task if requested and policy has location GUIDs
93+
if ($ExcludeLocationAuditAlerts -and $PolicyHasGuidLocations) {
94+
$AuditUsers = $Users.addedFields.userPrincipalName ?? $Users.value ?? $Users ?? $UserID
95+
$AuditAddTask = [pscustomobject]@{
96+
TenantFilter = $TenantFilter
97+
Name = "Add Audit Log Location Exclusion: $PolicyName"
98+
Command = @{ value = 'Set-CIPPAuditLogUserExclusion'; label = 'Set-CIPPAuditLogUserExclusion' }
99+
Parameters = [pscustomobject]@{ Users = $AuditUsers; Action = 'Add'; Type = 'Location' }
100+
ScheduledTime = $StartDate
101+
}
102+
Add-CIPPScheduledTask -Task $AuditAddTask -hidden $true
103+
}
85104
#Removal of the exclusion
86105
$TaskBody.Command = @{
87106
label = 'Remove-CIPPGroupMember'
@@ -90,6 +109,17 @@ function Invoke-ExecCAExclusion {
90109
$TaskBody.Name = "Remove CA Exclusion Vacation Mode: $PolicyName"
91110
$TaskBody.ScheduledTime = $EndDate
92111
Add-CIPPScheduledTask -Task $TaskBody -hidden $false
112+
if ($ExcludeLocationAuditAlerts -and $PolicyHasGuidLocations) {
113+
$AuditUsers = $Users.addedFields.userPrincipalName ?? $Users.value ?? $Users ?? $UserID
114+
$AuditRemoveTask = [pscustomobject]@{
115+
TenantFilter = $TenantFilter
116+
Name = "Remove Audit Log Location Exclusion: $PolicyName"
117+
Command = @{ value = 'Set-CIPPAuditLogUserExclusion'; label = 'Set-CIPPAuditLogUserExclusion' }
118+
Parameters = [pscustomobject]@{ Users = $AuditUsers; Action = 'Remove'; Type = 'Location' }
119+
ScheduledTime = $EndDate
120+
}
121+
Add-CIPPScheduledTask -Task $AuditRemoveTask -hidden $true
122+
}
93123
$body = @{ Results = "Successfully added vacation mode schedule for $Username." }
94124
} else {
95125
$Parameters = @{

‎Modules/CIPPCore/Public/Set-CIPPAuditLogUserExclusion.ps1‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
function Set-CIPPAuditLogUserExclusion {
2+
<#
3+
.SYNOPSIS
4+
Sets user exclusions for Audit Log alerting.
5+
.DESCRIPTION
6+
This function allows you to add or remove user exclusions for Audit Log alerting in a specified tenant
7+
by updating the AuditLogUserExclusions CIPP table.
8+
.PARAMETER TenantFilter
9+
The tenant identifier for which to set the user exclusions.
10+
.PARAMETER Users
11+
An array of user identifiers (GUIDs or UPNs) to be added or removed from the exclusion list.
12+
.PARAMETER Action
13+
The action to perform: 'Add' to add users to the exclusion list, 'Remove' to remove users from the exclusion list.
14+
.PARAMETER Headers
15+
The headers to include in the request, typically containing authentication tokens. This is supplied automatically by the API.
16+
#>
17+
[CmdletBinding(SupportsShouldProcess = $true)]
18+
param(
19+
[Parameter(Mandatory = $true)]
20+
[string]$TenantFilter,
21+
[Parameter(Mandatory = $true)]
22+
[string[]]$Users,
23+
[ValidateSet('Add', 'Remove')]
24+
[string]$Action = 'Add',
25+
[ValidateSet('Location')]
26+
[string]$Type = 'Location',
27+
$Headers
28+
)
29+
30+
$AuditLogExclusionsTable = Get-CIPPTable -tablename 'AuditLogUserExclusions'
31+
$ExistingEntries = Get-CIPPAzDataTableEntity @AuditLogExclusionsTable -Filter "PartitionKey eq '$TenantFilter'"
32+
33+
$Results = foreach ($User in $Users) {
34+
if ($Action -eq 'Add') {
35+
$ExistingUser = $ExistingEntries | Where-Object { $_.RowKey -eq $User -and $_.PartitionKey -eq $TenantFilter -and $_.Type -eq $Type }
36+
if (!$ExistingUser) {
37+
$NewEntry = [PSCustomObject]@{
38+
PartitionKey = $TenantFilter
39+
RowKey = $User
40+
ExcludedOn = (Get-Date).ToString('o')
41+
Type = $Type
42+
}
43+
if ($PSCmdlet.ShouldProcess("Adding exclusion for user: $User")) {
44+
Add-CIPPAzDataTableEntity @AuditLogExclusionsTable -Entity $NewEntry
45+
"Added audit log exclusion for user: $User"
46+
Write-LogMessage -headers $Headers -API 'Set-CIPPAuditLogUserExclusion' -message "Added audit log exclusion for user: $User" -Sev 'Info' -tenant $TenantFilter -LogData $NewEntry
47+
}
48+
} else {
49+
"User $User is already excluded."
50+
}
51+
} elseif ($Action -eq 'Remove') {
52+
if ($ExistingEntries.RowKey -contains $User) {
53+
if ($PSCmdlet.ShouldProcess("Removing exclusion for user: $User")) {
54+
$Entity = $ExistingEntries | Where-Object { $_.RowKey -eq $User -and $_.PartitionKey -eq $TenantFilter -and $_.Type -eq $Type }
55+
Remove-AzDataTableEntity @AuditLogExclusionsTable -Entity $Entity
56+
Write-LogMessage -headers $Headers -API 'Set-CIPPAuditLogUserExclusion' -message "Removed audit log exclusion for user: $User" -Sev 'Info' -tenant $TenantFilter -LogData $Entity
57+
"Removed audit log exclusion for user: $User"
58+
}
59+
} else {
60+
"User $User is not in the exclusion list."
61+
}
62+
}
63+
}
64+
return @($Results)
65+
}
66+

‎Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,9 @@ function Test-CIPPAuditLogRules {
185185
throw $_
186186
}
187187

188+
$AuditLogUserExclusions = Get-CIPPTable -TableName 'AuditLogUserExclusions'
189+
$ExcludedUsers = Get-CIPPAzDataTableEntity @AuditLogUserExclusions -Filter "PartitionKey eq '$TenantFilter'"
190+
188191
if ($LogCount -gt 0) {
189192
$LocationTable = Get-CIPPTable -TableName 'knownlocationdbv2'
190193
$ProcessedData = foreach ($AuditRecord in $SearchResults) {
@@ -341,6 +344,13 @@ function Test-CIPPAuditLogRules {
341344
if ($condition.Property.label -eq 'CIPPGeoLocation' -and !$AddedLocationCondition) {
342345
$conditionStrings.Add("`$_.HasLocationData -eq `$true")
343346
$CIPPClause.Add('HasLocationData is true')
347+
$ExcludedUsers = $ExcludedUsers | Where-Object { $_.Type -eq 'Location' }
348+
# Build single -notin condition against all excluded user keys
349+
$ExcludedUserKeys = @($ExcludedUsers.RowKey)
350+
if ($ExcludedUserKeys.Count -gt 0) {
351+
$conditionStrings.Add("`$(`$_.CIPPUserKey) -notin @('$($ExcludedUserKeys -join "', '")')")
352+
$CIPPClause.Add("CIPPUserKey not in [$($ExcludedUserKeys -join ', ')]")
353+
}
344354
$AddedLocationCondition = $true
345355
}
346356
$value = if ($condition.Input.value -is [array]) {

0 commit comments

Comments
 (0)