Merge pull request #470 from KelvinTegelaar/dev

pull[bot] · web-flow · commit 87e9f9f3224c · 2025-09-29T00:41:21.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/Config/schemaDefinitions.json b/Config/schemaDefinitions.json
@@ -1,16 +1,17 @@
 [
-    {
-        "id": "cippUser",
-        "description": "CIPP User Schema",
-        "targetTypes": ["User"],
-        "properties": [
-            { "name": "jitAdminEnabled", "type": "Boolean" },
-            { "name": "jitAdminExpiration", "type": "DateTime" },
-            { "name": "mailboxType", "type": "String" },
-            { "name": "archiveEnabled", "type": "Boolean" },
-            { "name": "autoExpandingArchiveEnabled", "type": "Boolean" },
-            { "name": "perUserMfaState", "type": "String" }
-        ],
-        "status": "Available"
-    }
+  {
+    "id": "cippUser",
+    "description": "CIPP User Schema",
+    "targetTypes": ["User"],
+    "properties": [
+      { "name": "jitAdminEnabled", "type": "Boolean" },
+      { "name": "jitAdminExpiration", "type": "DateTime" },
+      { "name": "jitAdminReason", "type": "String" },
+      { "name": "mailboxType", "type": "String" },
+      { "name": "archiveEnabled", "type": "Boolean" },
+      { "name": "autoExpandingArchiveEnabled", "type": "Boolean" },
+      { "name": "perUserMfaState", "type": "String" }
+    ],
+    "status": "Available"
+  }
 ]
diff --git a/Modules/CIPPCore/Public/Authentication/Get-CIPPHttpFunctions.ps1 b/Modules/CIPPCore/Public/Authentication/Get-CIPPHttpFunctions.ps1
@@ -18,14 +18,14 @@ function Get-CIPPHttpFunctions {
         }
 
         if ($ByRole.IsPresent -or $ByRoleGroup.IsPresent) {
-            $Results = $Results | Group-Object -Property Role | Select-Object -Property @{l = 'Permission'; e = { $_.Name -eq '' ? 'None' : $_.Name } }, Count, @{l = 'Functions'; e = { $_.Group | Select-Object @{l='Name'; e={$_.Function -replace 'Invoke-'}}, Description } } | Sort-Object -Property Permission
+            $Results = $Results | Group-Object -Property Role | Select-Object -Property @{l = 'Permission'; e = { $_.Name -eq '' ? 'None' : $_.Name } }, Count, @{l = 'Functions'; e = { $_.Group | Select-Object @{l = 'Name'; e = { $_.Function -replace 'Invoke-' } }, Description } } | Sort-Object -Property Permission
             if ($ByRoleGroup.IsPresent) {
                 $RoleGroup = @{}
                 foreach ($Permission in $Results) {
                     $PermSplit = $Permission.Permission -split '\.'
                     if ($PermSplit.Count -ne 3) { continue }
-                    if ($RoleGroup[$PermSplit[0]] -eq $null) { $RoleGroup[$PermSplit[0]] = @{} }
-                    if ($RoleGroup[$PermSplit[0]][$PermSplit[1]] -eq $null) { $RoleGroup[$PermSplit[0]][$PermSplit[1]] = @{} }
+                    if ($null -eq $RoleGroup[$PermSplit[0]]) { $RoleGroup[$PermSplit[0]] = @{} }
+                    if ($null -eq $RoleGroup[$PermSplit[0]][$PermSplit[1]]) { $RoleGroup[$PermSplit[0]][$PermSplit[1]] = @{} }
                     $RoleGroup[$PermSplit[0]][$PermSplit[1]][$PermSplit[2]] = @($Permission.Functions)
                 }
                 $Results = $RoleGroup
diff --git a/Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1 b/Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1
@@ -244,6 +244,9 @@ function Compare-CIPPIntuneObject {
                                             $child.choiceSettingValue.value
                                         }
                                     }
+                                    if (!$childValue -and $null -ne $child.simpleSettingValue -and $null -ne $child.simpleSettingValue.value) {
+                                        $childValue = $child.simpleSettingValue.value
+                                    }
 
                                     # Add object to our temporary list
                                     [PSCustomObject]@{
@@ -337,9 +340,9 @@ function Compare-CIPPIntuneObject {
                                         } else {
                                             $child.choiceSettingValue.value
                                         }
-                                        if (!$childValue -and $child.simpleSettingValue.value) {
-                                            $childValue = $child.simpleSettingValue.value
-                                        }
+                                    }
+                                    if (!$childValue -and $null -ne $child.simpleSettingValue -and $null -ne $child.simpleSettingValue.value) {
+                                        $childValue = $child.simpleSettingValue.value
                                     }
 
                                     # Add object to our temporary list
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetCIPPAutoBackup.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetCIPPAutoBackup.ps1
@@ -1,11 +1,11 @@
 using namespace System.Net
 
-Function Invoke-ExecSetCIPPAutoBackup {
+function Invoke-ExecSetCIPPAutoBackup {
     <#
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        CIPP.Backup.Read
+        CIPP.Backup.ReadWrite
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-ListEquipment.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-ListEquipment.ps1
@@ -1,11 +1,11 @@
 using namespace System.Net
 
-Function Invoke-ListEquipment {
+function Invoke-ListEquipment {
     <#
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Exchange.Equipment.ReadWrite
+        Exchange.Equipment.Read
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditAntiPhishingFilter.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditAntiPhishingFilter.ps1
@@ -3,7 +3,7 @@ function Invoke-EditAntiPhishingFilter {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Exchange.SpamFilter.Read
+        Exchange.SpamFilter.ReadWrite
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -33,7 +33,7 @@ function Invoke-EditAntiPhishingFilter {
             'Disable' {
                 $ExoRequestParam.Add('cmdlet', 'Disable-AntiPhishRule')
             }
-            Default {
+            default {
                 throw 'Invalid state'
             }
         }
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditMalwareFilter.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditMalwareFilter.ps1
@@ -3,7 +3,7 @@ function Invoke-EditMalwareFilter {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Exchange.SpamFilter.Read
+        Exchange.SpamFilter.ReadWrite
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -33,7 +33,7 @@ function Invoke-EditMalwareFilter {
             'Disable' {
                 $ExoRequestParam.Add('cmdlet', 'Disable-MalwareFilterRule')
             }
-            Default {
+            default {
                 throw 'Invalid state'
             }
         }
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditSafeAttachmentsFilter.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditSafeAttachmentsFilter.ps1
@@ -3,7 +3,7 @@ function Invoke-EditSafeAttachmentsFilter {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Exchange.SpamFilter.Read
+        Exchange.SpamFilter.ReadWrite
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -33,7 +33,7 @@ function Invoke-EditSafeAttachmentsFilter {
             'Disable' {
                 $ExoRequestParam.Add('cmdlet', 'Disable-SafeAttachmentRule')
             }
-            Default {
+            default {
                 throw 'Invalid state'
             }
         }
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1
@@ -3,7 +3,7 @@ function Invoke-ListMailQuarantine {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Exchange.SpamFilter.ReadWrite
+        Exchange.SpamFilter.Read
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessage.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessage.ps1
@@ -3,7 +3,7 @@ function Invoke-ListMailQuarantineMessage {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Exchange.SpamFilter.ReadWrite
+        Exchange.SpamFilter.Read
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1
@@ -6,6 +6,9 @@ function Invoke-ExecJITAdmin {
         Entrypoint
     .ROLE
         Identity.Role.ReadWrite
+
+    .DESCRIPTION
+        Just-in-time admin management API endpoint. This function can list JIT admins, create users, add roles, remove roles, delete, or disable a user.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -16,6 +19,7 @@ function Invoke-ExecJITAdmin {
     Write-LogMessage -Headers $User -API $APIName -message 'Accessed this API' -Sev 'Debug'
 
     if ($Request.Query.Action -eq 'List') {
+        # TODO: The list functionality should be moved to a separate function. ListJITAdmin or similar.
         $Schema = Get-CIPPSchemaExtensions | Where-Object { $_.id -match '_cippUser' } | Select-Object -First 1
         if ($Request.Query.TenantFilter -ne 'AllTenants') {
             # Single tenant logic
@@ -48,6 +52,7 @@ function Invoke-ExecJITAdmin {
                     accountEnabled     = $_.accountEnabled
                     jitAdminEnabled    = $_.($Schema.id).jitAdminEnabled
                     jitAdminExpiration = $_.($Schema.id).jitAdminExpiration
+                    jitAdminReason     = $_.($Schema.id).jitAdminReason
                     memberOf           = $MemberOf
                 }
             }
@@ -115,6 +120,7 @@ function Invoke-ExecJITAdmin {
                             accountEnabled     = $UserObject.accountEnabled
                             jitAdminEnabled    = $UserObject.jitAdminEnabled
                             jitAdminExpiration = $UserObject.jitAdminExpiration
+                            jitAdminReason     = $UserObject.jitAdminReason
                             memberOf           = $UserObject.memberOf
                         }
                     )
@@ -130,29 +136,29 @@ function Invoke-ExecJITAdmin {
         if ($Request.Body.existingUser.value -match '^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}$') {
             $Username = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($Request.Body.existingUser.value)" -tenantid $TenantFilter).userPrincipalName
         }
-        Write-LogMessage -Headers $User -API $APIName -message "Executing JIT Admin for $Username" -tenant $TenantFilter -Sev 'Info'
 
         $Start = ([System.DateTimeOffset]::FromUnixTimeSeconds($Request.Body.StartDate)).DateTime.ToLocalTime()
         $Expiration = ([System.DateTimeOffset]::FromUnixTimeSeconds($Request.Body.EndDate)).DateTime.ToLocalTime()
         $Results = [System.Collections.Generic.List[string]]::new()
 
-        if ($Request.Body.useraction -eq 'Create') {
-            Write-LogMessage -Headers $User -API $APIName -tenant $TenantFilter -message "Creating JIT Admin user $($Request.Body.Username)" -Sev 'Info'
-            Write-Information "Creating JIT Admin user $($Request.Body.username)"
+        if ($Request.Body.userAction -eq 'create') {
             $Domain = $Request.Body.Domain.value ? $Request.Body.Domain.value : $Request.Body.Domain
+            $Username = "$($Request.Body.Username)@$($Domain)"
+            Write-Information "Creating JIT Admin user: $($Request.Body.username)"
 
             $JITAdmin = @{
                 User         = @{
                     'FirstName'         = $Request.Body.FirstName
                     'LastName'          = $Request.Body.LastName
-                    'UserPrincipalName' = "$($Request.Body.Username)@$($Domain)"
+                    'UserPrincipalName' = $Username
                 }
                 Expiration   = $Expiration
+                Reason       = $Request.Body.reason
                 Action       = 'Create'
                 TenantFilter = $TenantFilter
             }
             $CreateResult = Set-CIPPUserJITAdmin @JITAdmin
-            $Username = "$($Request.Body.Username)@$($Domain)"
+            Write-LogMessage -Headers $User -API $APIName -tenant $TenantFilter -message "Created JIT Admin user: $Username. Reason: $($Request.Body.reason). Roles: $($Request.Body.adminRoles.label -join ', ')" -Sev 'Info' -LogData $JITAdmin
             $Results.Add("Created User: $Username")
             if (!$Request.Body.UseTAP) {
                 $Results.Add("Password: $($CreateResult.password)")
@@ -212,6 +218,7 @@ function Invoke-ExecJITAdmin {
             }
             Roles        = $Request.Body.AdminRoles.value
             Action       = 'AddRoles'
+            Reason       = $Request.Body.Reason
             Expiration   = $Expiration
         }
         if ($Start -gt (Get-Date)) {
@@ -231,13 +238,15 @@ function Invoke-ExecJITAdmin {
                 }
             }
             Add-CIPPScheduledTask -Task $TaskBody -hidden $false
-            if ($Request.Body.useraction -ne 'Create') {
-                Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $Request.Body.existingUser.value -Expiration $Expiration
+            if ($Request.Body.userAction -ne 'create') {
+                Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $Request.Body.existingUser.value -Expiration $Expiration -Reason $Request.Body.Reason
             }
             $Results.Add("Scheduling JIT Admin enable task for $Username")
+            Write-LogMessage -Headers $User -API $APIName -message "Scheduling JIT Admin for existing user: $Username. Reason: $($Request.Body.reason). Roles: $($Request.Body.adminRoles.label -join ', ') " -tenant $TenantFilter -Sev 'Info'
         } else {
             $Results.Add("Executing JIT Admin enable task for $Username")
             Set-CIPPUserJITAdmin @Parameters
+            Write-LogMessage -Headers $User -API $APIName -message "Executing JIT Admin for existing user: $Username. Reason: $($Request.Body.reason). Roles: $($Request.Body.adminRoles.label -join ', ') " -tenant $TenantFilter -Sev 'Info'
         }
 
         $DisableTaskBody = [pscustomobject]@{
@@ -253,6 +262,7 @@ function Invoke-ExecJITAdmin {
                     'UserPrincipalName' = $Username
                 }
                 Roles        = $Request.Body.AdminRoles.value
+                Reason       = $Request.Body.Reason
                 Action       = $Request.Body.ExpireAction.value
             }
             PostExecution = @{
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppApproval.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppApproval.ps1
@@ -1,6 +1,6 @@
 using namespace System.Net
 
-Function Invoke-ExecAppApproval {
+function Invoke-ExecAppApproval {
     <#
     .FUNCTIONALITY
         Entrypoint
@@ -15,8 +15,7 @@ Function Invoke-ExecAppApproval {
     Write-LogMessage -headers $Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
 
 
-    Write-Host "$($Request.query.ID)"
-    # Interact with query parameters or the body of the request.
+    # Seems to be an unused endpoint? -Bobby
 
     $ApplicationId = if ($Request.Query.ApplicationId) { $Request.Query.ApplicationId } else { $env:ApplicationID }
     $Results = Get-Tenants | ForEach-Object {
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecDomainAnalyser.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecDomainAnalyser.ps1
@@ -3,7 +3,7 @@ function Invoke-ExecDomainAnalyser {
     .FUNCTIONALITY
         Entrypoint,AnyTenant
     .ROLE
-        Tenant.DomainAnalyser.Read
+        Tenant.DomainAnalyser.ReadWrite
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
diff --git a/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1 b/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1
@@ -21,8 +21,11 @@ function Set-CIPPUserJITAdmin {
     .PARAMETER Expiration
     DateTime for expiration
 
+    .PARAMETER Reason
+    Reason for JIT admin assignment. Defaults to 'No reason provided' as due to backwards compatibility this is not a mandatory field.
+
     .EXAMPLE
-    Set-CIPPUserJITAdmin -TenantFilter 'contoso.onmicrosoft.com' -Headers@{UserPrincipalName = 'jit@contoso.onmicrosoft.com'} -Roles @('62e90394-69f5-4237-9190-012177145e10') -Action 'AddRoles' -Expiration (Get-Date).AddDays(1)
+    Set-CIPPUserJITAdmin -TenantFilter 'contoso.onmicrosoft.com' -Headers@{UserPrincipalName = 'jit@contoso.onmicrosoft.com'} -Roles @('62e90394-69f5-4237-9190-012177145e10') -Action 'AddRoles' -Expiration (Get-Date).AddDays(1) -Reason 'Emergency access'
 
     #>
     [CmdletBinding(SupportsShouldProcess = $true)]
@@ -39,7 +42,9 @@ function Set-CIPPUserJITAdmin {
         [ValidateSet('Create', 'AddRoles', 'RemoveRoles', 'DeleteUser', 'DisableUser')]
         [string]$Action,
 
-        [datetime]$Expiration
+        [datetime]$Expiration,
+
+        [string]$Reason = 'No reason provided'
     )
 
     if ($PSCmdlet.ShouldProcess("User: $($User.UserPrincipalName)", "Action: $Action")) {
@@ -67,6 +72,7 @@ function Set-CIPPUserJITAdmin {
                     $Schema.id        = @{
                         jitAdminEnabled    = $false
                         jitAdminExpiration = $Expiration.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+                        jitAdminReason     = $Reason
                     }
                 }
                 $Json = ConvertTo-Json -Depth 5 -InputObject $Body
@@ -109,7 +115,7 @@ function Set-CIPPUserJITAdmin {
                     } catch {}
                 }
 
-                Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $UserObj.id -Enabled -Expiration $Expiration | Out-Null
+                Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $UserObj.id -Enabled -Expiration $Expiration -Reason $Reason | Out-Null
                 return "Added admin roles to user $($UserObj.displayName) ($($UserObj.userPrincipalName))"
             }
             'RemoveRoles' {
diff --git a/Modules/CIPPCore/Public/Set-CIPPUserJITAdminProperties.ps1 b/Modules/CIPPCore/Public/Set-CIPPUserJITAdminProperties.ps1
@@ -1,11 +1,12 @@
 function Set-CIPPUserJITAdminProperties {
     [CmdletBinding()]
-    Param(
+    param(
         [string]$TenantFilter,
         [string]$UserId,
         [switch]$Enabled,
         $Expiration,
-        [switch]$Clear
+        [switch]$Clear,
+        [string]$Reason
     )
     try {
         $Schema = Get-CIPPSchemaExtensions | Where-Object { $_.id -match '_cippUser' } | Select-Object -First 1
@@ -14,13 +15,15 @@ function Set-CIPPUserJITAdminProperties {
                 "$($Schema.id)" = @{
                     jitAdminEnabled    = $null
                     jitAdminExpiration = $null
+                    jitAdminReason     = $null
                 }
             }
         } else {
             $Body = [PSCustomObject]@{
                 "$($Schema.id)" = @{
                     jitAdminEnabled    = $Enabled.IsPresent
                     jitAdminExpiration = $Expiration.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+                    jitAdminReason     = $Reason
                 }
             }
         }

Original file line number	Diff line number	Diff line change
`@@ -244,6 +244,9 @@ function Compare-CIPPIntuneObject {`
`244`	`244`	`$child.choiceSettingValue.value`
`245`	`245`	`}`
`246`	`246`	`}`
	`247`	`+ if (!$childValue -and $null -ne $child.simpleSettingValue -and $null -ne $child.simpleSettingValue.value) {`
	`248`	`+ $childValue = $child.simpleSettingValue.value`
	`249`	`+ }`
`247`	`250`
`248`	`251`	`# Add object to our temporary list`
`249`	`252`	`[PSCustomObject]@{`
`@@ -337,9 +340,9 @@ function Compare-CIPPIntuneObject {`
`337`	`340`	`} else {`
`338`	`341`	`$child.choiceSettingValue.value`
`339`	`342`	`}`
`340`		`- if (!$childValue -and $child.simpleSettingValue.value) {`
`341`		`- $childValue = $child.simpleSettingValue.value`
`342`		`- }`
	`343`	`+ }`
	`344`	`+ if (!$childValue -and $null -ne $child.simpleSettingValue -and $null -ne $child.simpleSettingValue.value) {`
	`345`	`+ $childValue = $child.simpleSettingValue.value`
`343`	`346`	`}`
`344`	`347`
`345`	`348`	`# Add object to our temporary list`
Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@ function Invoke-EditAntiPhishingFilter {`
`3`	`3`	`.FUNCTIONALITY`
`4`	`4`	`Entrypoint`
`5`	`5`	`.ROLE`
`6`		`- Exchange.SpamFilter.Read`
	`6`	`+ Exchange.SpamFilter.ReadWrite`
`7`	`7`	`#>`
`8`	`8`	`[CmdletBinding()]`
`9`	`9`	`param($Request, $TriggerMetadata)`
`@@ -33,7 +33,7 @@ function Invoke-EditAntiPhishingFilter {`
`33`	`33`	`'Disable' {`
`34`	`34`	`$ExoRequestParam.Add('cmdlet', 'Disable-AntiPhishRule')`
`35`	`35`	`}`
`36`		`- Default {`
	`36`	`+ default {`
`37`	`37`	`throw 'Invalid state'`
`38`	`38`	`}`
`39`	`39`	`}`
Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@ function Invoke-EditMalwareFilter {`
`3`	`3`	`.FUNCTIONALITY`
`4`	`4`	`Entrypoint`
`5`	`5`	`.ROLE`
`6`		`- Exchange.SpamFilter.Read`
	`6`	`+ Exchange.SpamFilter.ReadWrite`
`7`	`7`	`#>`
`8`	`8`	`[CmdletBinding()]`
`9`	`9`	`param($Request, $TriggerMetadata)`
`@@ -33,7 +33,7 @@ function Invoke-EditMalwareFilter {`
`33`	`33`	`'Disable' {`
`34`	`34`	`$ExoRequestParam.Add('cmdlet', 'Disable-MalwareFilterRule')`
`35`	`35`	`}`
`36`		`- Default {`
	`36`	`+ default {`
`37`	`37`	`throw 'Invalid state'`
`38`	`38`	`}`
`39`	`39`	`}`
Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@ function Invoke-EditSafeAttachmentsFilter {`
`3`	`3`	`.FUNCTIONALITY`
`4`	`4`	`Entrypoint`
`5`	`5`	`.ROLE`
`6`		`- Exchange.SpamFilter.Read`
	`6`	`+ Exchange.SpamFilter.ReadWrite`
`7`	`7`	`#>`
`8`	`8`	`[CmdletBinding()]`
`9`	`9`	`param($Request, $TriggerMetadata)`
`@@ -33,7 +33,7 @@ function Invoke-EditSafeAttachmentsFilter {`
`33`	`33`	`'Disable' {`
`34`	`34`	`$ExoRequestParam.Add('cmdlet', 'Disable-SafeAttachmentRule')`
`35`	`35`	`}`
`36`		`- Default {`
	`36`	`+ default {`
`37`	`37`	`throw 'Invalid state'`
`38`	`38`	`}`
`39`	`39`	`}`