Merge pull request #160 from KelvinTegelaar/dev

pull[bot] · web-flow · commit 8181d5b0cd5b · 2025-03-23T18:41:05.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPAccessAssignment.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ExecGDAPAccessAssignment.ps1
@@ -52,6 +52,7 @@ function Invoke-ExecGDAPAccessAssignment {
                 $Messages = [System.Collections.Generic.List[object]]::new()
 
                 foreach ($AccessAssignment in $AccessAssignments) {
+                    $RoleCount = ($AccessAssignment.accessDetails.unifiedRoles | Measure-Object).Count
                     if ($Mappings.GroupId -notcontains $AccessAssignment.accessContainer.accessContainerId -and $AccessAssignment.status -notin @('deleting', 'deleted', 'error')) {
                         Write-Warning "Deleting access assignment for $($AccessAssignment.accessContainer.accessContainerId)"
                         $Group = $Groups | Where-Object id -EQ $AccessAssignment.accessContainer.accessContainerId
@@ -65,44 +66,87 @@ function Invoke-ExecGDAPAccessAssignment {
                             })
 
                         $Messages.Add(@{
-                                'id'      = $AccessAssignment.id
+                                'id'      = "delete-$($AccessAssignment.id)"
                                 'message' = "Deleting access assignment for $($Group.displayName)"
                             })
 
+                    } elseif ($AccessAssignment.status -notin @('deleting', 'deleted', 'error')) {
+                        # check for mismatched role definitions (e.g. role in assignment does not match role in mapping)
+                        $Mapping = $Mappings | Where-Object { $_.GroupId -eq $AccessAssignment.accessContainer.accessContainerId }
+                        $Group = $Groups | Where-Object id -EQ $AccessAssignment.accessContainer.accessContainerId
+
+                        if ($RoleCount -gt 1 -or $AccessAssignment.accessDetails.unifiedRoles.roleDefinitionId -notcontains $Mapping.roleDefinitionId) {
+                            Write-Warning "Patching access assignment for $($AccessAssignment.accessContainer.accessContainerId)"
+                            $Requests.Add(@{
+                                    'id'      = "patch-$($AccessAssignment.id)"
+                                    'url'     = "tenantRelationships/delegatedAdminRelationships/$Id/accessAssignments/$($AccessAssignment.id)"
+                                    'method'  = 'PATCH'
+                                    'body'    = @{
+                                        'accessDetails' = @{
+                                            'unifiedRoles' = @(
+                                                @{
+                                                    roleDefinitionId = $Mapping.roleDefinitionId
+                                                }
+                                            )
+                                        }
+                                    }
+                                    'headers' = @{
+                                        'If-Match'     = $AccessAssignment.'@odata.etag'
+                                        'Content-Type' = 'application/json'
+                                    }
+                                })
+
+                            $Messages.Add(@{
+                                    'id'      = "patch-$($AccessAssignment.id)"
+                                    'message' = "Updating access assignment for $($Group.displayName)"
+                                })
+                        }
                     }
                 }
 
                 foreach ($Mapping in $Mappings) {
-                    if ($AccessAssignments.accessContainer.accessContainerId -notcontains $Mapping.GroupId -and $Relationship.accessDetails.unifiedRoles.roleDefinitionId -contains $Mapping.roleDefinitionId) {
+                    $DeletedAssignments = $AccessAssignments | Where-Object { $_.accessContainer.accessContainerId -eq $Mapping.GroupId -and $_.status -eq 'deleted' }
+                    if (($AccessAssignments.accessContainer.accessContainerId -notcontains $Mapping.GroupId -or $DeletedAssignments.accessContainer.accessContainerId -contains $Mapping.GroupId) -and $Relationship.accessDetails.unifiedRoles.roleDefinitionId -contains $Mapping.roleDefinitionId) {
                         Write-Information "Creating access assignment for $($Mapping.GroupId)"
                         $Requests.Add(@{
-                                'id'     = "create-$($Mapping.GroupId)"
-                                'url'    = "tenantRelationships/delegatedAdminRelationships/$Id/accessAssignments"
-                                'method' = 'POST'
-                                'body'   = @{
+                                'id'      = "create-$($Mapping.GroupId)"
+                                'url'     = "tenantRelationships/delegatedAdminRelationships/$Id/accessAssignments"
+                                'method'  = 'POST'
+                                'body'    = @{
                                     'accessDetails'   = @{
-                                        'unifiedRoles' = @($Mapping.roleDefinitionId)
+                                        'unifiedRoles' = @(
+                                            @{
+                                                roleDefinitionId = $Mapping.roleDefinitionId
+                                            }
+                                        )
                                     }
                                     'accessContainer' = @{
-                                        'accessContainerId' = $Mapping.GroupId
+                                        'accessContainerId'   = $Mapping.GroupId
+                                        'accessContainerType' = 'securityGroup'
                                     }
                                 }
+                                'headers' = @{
+                                    'Content-Type' = 'application/json'
+                                }
                             })
                         $Messages.Add(@{
-                                'id'      = $Mapping.GroupId
+                                'id'      = "create-$($Mapping.GroupId)"
                                 'message' = "Creating access assignment for $($Mapping.GroupName)"
                             })
                     }
                 }
 
                 if ($Requests) {
                     Write-Warning "Executing $($Requests.Count) access assignment changes"
-                    #Write-Information ($Requests | ConvertTo-Json -Depth 10)
+                    Write-Information ($Requests | ConvertTo-Json -Depth 10)
 
                     $BulkResults = New-GraphBulkRequest -Requests $Requests -NoAuthCheck $true
+
+                    Write-Warning "Received $($BulkResults.Count) access assignment results"
+                    Write-Information ($BulkResults | ConvertTo-Json -Depth 10)
                     $Results = foreach ($Result in $BulkResults) {
                         $Message = $Messages | Where-Object id -EQ $Result.id
-                        if ($Result.status -eq 204) {
+                        if ($Result.status -in @('201', '202', '204')) {
                             @{
                                 resultText = $Message.message
                                 state      = 'success'
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPAccessAssignments.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPAccessAssignments.ps1
@@ -19,7 +19,7 @@ function Invoke-ListGDAPAccessAssignments {
 
     # get groups asapp
     $Groups = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/groups?`$top=999&`$select=id,displayName&`$filter=securityEnabled eq true" -tenantid $TenantFilter -asApp $true -NoAuthCheck $true
-    
+
 
     # Get all the access containers
     $AccessContainers = $AccessAssignments.accessContainer.accessContainerId
@@ -47,6 +47,8 @@ function Invoke-ListGDAPAccessAssignments {
     }
     if (!$Results) {
         $Results = @()
+    } else {
+        $Results = $Results | Sort-Object -Property @{Expression = { $_.group.displayName }; Ascending = $true }
     }
 
     $Body = @{
diff --git a/Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1 b/Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1
@@ -162,7 +162,7 @@ function Test-CIPPAuditLogRules {
                         $HasLocationData = $true
                     }
                 }
-                $Data.AuditRecord = $AuditRecord
+                $Data.AuditRecord = $RootProperties
                 $Data | Select-Object *,
                 @{n = 'HasLocationData'; exp = { $HasLocationData } } -ExcludeProperty ExtendedProperties, DeviceProperties, parameters
             } catch {

Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ function Invoke-ListGDAPAccessAssignments {`
`19`	`19`
`20`	`20`	`# get groups asapp`
`21`	`21`	$Groups = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/groups?`$top=999&`$select=id,displayName&`$filter=securityEnabled eq true" -tenantid $TenantFilter -asApp $true -NoAuthCheck $true
`22`		`-`
	`22`	`+`
`23`	`23`
`24`	`24`	`# Get all the access containers`
`25`	`25`	`$AccessContainers = $AccessAssignments.accessContainer.accessContainerId`
`@@ -47,6 +47,8 @@ function Invoke-ListGDAPAccessAssignments {`
`47`	`47`	`}`
`48`	`48`	`if (!$Results) {`
`49`	`49`	`$Results = @()`
	`50`	`+ } else {`
	`51`	`+ $Results = $Results \| Sort-Object -Property @{Expression = { $_.group.displayName }; Ascending = $true }`
`50`	`52`	`}`
`51`	`53`
`52`	`54`	`$Body = @{`
Original file line number	Diff line number	Diff line change
`@@ -162,7 +162,7 @@ function Test-CIPPAuditLogRules {`
`162`	`162`	`$HasLocationData = $true`
`163`	`163`	`}`
`164`	`164`	`}`
`165`		`- $Data.AuditRecord = $AuditRecord`
	`165`	`+ $Data.AuditRecord = $RootProperties`
`166`	`166`	`$Data \| Select-Object *,`
`167`	`167`	`@{n = 'HasLocationData'; exp = { $HasLocationData } } -ExcludeProperty ExtendedProperties, DeviceProperties, parameters`
`168`	`168`	`} catch {`