Skip to content

Commit 9e89325

Browse files
pull[bot]pull[bot]
authored
Merge pull request #417 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents e9dbf4f + 2848860 commit 9e89325

File tree

5 files changed

+415
-375
lines changed

5 files changed

+415
-375
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,14 @@ function Invoke-ListGroups {
1919
$GroupType = $Request.Query.groupType
2020
$Members = $Request.Query.members
2121
$Owners = $Request.Query.owners
22-
$SelectString = 'id,createdDateTime,displayName,description,mail,mailEnabled,mailNickname,resourceProvisioningOptions,securityEnabled,visibility,organizationId,onPremisesSamAccountName,membershipRule,groupTypes,onPremisesSyncEnabled,resourceProvisioningOptions,userPrincipalName&$expand=members($select=userPrincipalName)'
22+
23+
$ExpandMembers = $Request.Query.expandMembers ?? $false
24+
25+
$SelectString = 'id,createdDateTime,displayName,description,mail,mailEnabled,mailNickname,resourceProvisioningOptions,securityEnabled,visibility,organizationId,onPremisesSamAccountName,membershipRule,groupTypes,onPremisesSyncEnabled,resourceProvisioningOptions,userPrincipalName'
26+
if ($ExpandMembers -ne $false) {
27+
$SelectString = '{0}&$expand=members($select=userPrincipalName)' -f $SelectString
28+
}
29+
2330

2431
$BulkRequestArrayList = [System.Collections.Generic.List[object]]::new()
2532

@@ -86,7 +93,7 @@ function Invoke-ListGroups {
8693
$RawGraphRequest = New-GraphBulkRequest -tenantid $TenantFilter -scope 'https://graph.microsoft.com/.default' -Requests @($BulkRequestArrayList) -asapp $true
8794
$GraphRequest = [PSCustomObject]@{
8895
groupInfo = ($RawGraphRequest | Where-Object { $_.id -eq 1 }).body | Select-Object *, @{ Name = 'primDomain'; Expression = { $_.mail -split '@' | Select-Object -Last 1 } },
89-
@{Name = 'teamsEnabled'; Expression = { if ($_.resourceProvisioningOptions -Like '*Team*') { $true } else { $false } } },
96+
@{Name = 'teamsEnabled'; Expression = { if ($_.resourceProvisioningOptions -like '*Team*') { $true } else { $false } } },
9097
@{Name = 'calculatedGroupType'; Expression = {
9198
if ($_.mailEnabled -and $_.securityEnabled) { 'Mail-Enabled Security' }
9299
if (!$_.mailEnabled -and $_.securityEnabled) { 'Security' }
@@ -129,4 +136,4 @@ function Invoke-ListGroups {
129136
Body = $GraphRequest
130137
})
131138

132-
}
139+
}

‎Modules/CIPPCore/Public/GraphHelper/Write-AlertTrace.ps1‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ function Write-AlertTrace {
2020
$TableRow = @{
2121
'PartitionKey' = $PartitionKey
2222
'RowKey' = "$($tenantFilter)-$($cmdletName)"
23-
'CmdletName' = $cmdletName
24-
'Tenant' = $tenantFilter
23+
'CmdletName' = "$cmdletName"
24+
'Tenant' = "$tenantFilter"
2525
'LogData' = [string]$LogData
2626
}
2727
$Table.Entity = $TableRow
@@ -33,8 +33,8 @@ function Write-AlertTrace {
3333
$TableRow = @{
3434
'PartitionKey' = $PartitionKey
3535
'RowKey' = "$($tenantFilter)-$($cmdletName)"
36-
'CmdletName' = $cmdletName
37-
'Tenant' = $tenantFilter
36+
'CmdletName' = "$cmdletName"
37+
'Tenant' = "$tenantFilter"
3838
'LogData' = [string]$LogData
3939
}
4040
$Table.Entity = $TableRow

‎Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1‎

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ function New-CIPPCAPolicy {
153153
}
154154

155155
foreach ($location in $JSONObj.conditions.locations.includeLocations) {
156-
Write-Information "Replacing $location"
156+
Write-Information "Replacing named location - $location"
157157
$lookup = $LocationLookupTable | Where-Object -Property name -EQ $location
158158
Write-Information "Found $lookup"
159159
if (!$lookup) { continue }
@@ -198,6 +198,11 @@ function New-CIPPCAPolicy {
198198
}
199199
}
200200

201+
if ($JSONObj.conditions.users.includeUsers.Count -eq 0) {
202+
Write-Information 'No users matched in this policy, setting to none'
203+
$JSONObj.conditions.users.includeUsers = 'none'
204+
}
205+
201206
} catch {
202207
$ErrorMessage = Get-CippException -Exception $_
203208
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to replace displayNames for conditional access rule $($JSONObj.displayName). Error: $($ErrorMessage.NormalizedError)" -sev 'Error' -LogData $ErrorMessage
@@ -229,14 +234,19 @@ function New-CIPPCAPolicy {
229234
if ($DisableSD -eq $true) {
230235
#Send request to disable security defaults.
231236
$body = '{ "isEnabled": false }'
232-
$null = New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy' -Type patch -Body $body -ContentType 'application/json'
233-
Write-LogMessage -Headers $User -API 'Create CA Policy' -tenant $($Tenant) -message "Disabled Security Defaults for tenant $($TenantFilter)" -Sev 'Info'
234-
Start-Sleep 3
237+
try {
238+
$null = New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy' -Type patch -Body $body -asApp $true -ContentType 'application/json'
239+
Write-LogMessage -Headers $User -API 'Create CA Policy' -tenant $($Tenant) -message "Disabled Security Defaults for tenant $($TenantFilter)" -Sev 'Info'
240+
Start-Sleep 3
241+
} catch {
242+
$ErrorMessage = Get-CippException -Exception $_
243+
Write-Information "Failed to disable security defaults for tenant $($TenantFilter): $($ErrorMessage.NormalizedError)"
244+
}
235245
}
236246
$RawJSON = ConvertTo-Json -InputObject $JSONObj -Depth 10 -Compress
237247
Write-Information $RawJSON
238248
try {
239-
Write-Information 'Checking'
249+
Write-Information 'Checking for existing policies'
240250
$CheckExististing = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies' -tenantid $TenantFilter -asApp $true | Where-Object -Property displayName -EQ $displayname
241251
if ($CheckExististing) {
242252
if ($Overwrite -ne $true) {
@@ -249,7 +259,7 @@ function New-CIPPCAPolicy {
249259
return "Updated policy $displayname for $tenantfilter"
250260
}
251261
} else {
252-
Write-Information 'Creating'
262+
Write-Information 'Creating new policy'
253263
if ($JSONobj.GrantControls.authenticationStrength.policyType -or $JSONObj.$jsonobj.LocationInfo) {
254264
Start-Sleep 3
255265
}
@@ -260,6 +270,10 @@ function New-CIPPCAPolicy {
260270
} catch {
261271
$ErrorMessage = Get-CippException -Exception $_
262272
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create or update conditional access rule $($JSONObj.displayName): $($ErrorMessage.NormalizedError) " -sev 'Error' -LogData $ErrorMessage
273+
274+
Write-Warning "Failed to create or update conditional access rule $($JSONObj.displayName): $($ErrorMessage.NormalizedError)"
275+
Write-Information $_.InvocationInfo.PositionMessage
276+
Write-Information ($JSONObj | ConvertTo-Json -Depth 10)
263277
throw "Failed to create or update conditional access rule $($JSONObj.displayName): $($ErrorMessage.NormalizedError)"
264278
}
265279
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
3232
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'ConditionalAccess'
3333
$Table = Get-CippTable -tablename 'templates'
3434
$TestResult = Test-CIPPStandardLicense -StandardName 'ConditionalAccessTemplate_general' -TenantFilter $Tenant -RequiredCapabilities @('AAD_PREMIUM', 'AAD_PREMIUM_P2')
35+
$TestP2 = Test-CIPPStandardLicense -StandardName 'ConditionalAccessTemplate_p2' -TenantFilter $Tenant -RequiredCapabilities @('AAD_PREMIUM_P2')
3536
if ($TestResult -eq $false) {
3637
#writing to each item that the license is not present.
3738
$settings.TemplateList | ForEach-Object {
@@ -42,9 +43,8 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
4243
} #we're done.
4344

4445
try {
45-
$AllCAPolicies = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies?$top=999' -tenantid $Tenant
46-
}
47-
catch {
46+
$AllCAPolicies = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies?$top=999' -tenantid $Tenant -asApp $true
47+
} catch {
4848
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
4949
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the ConditionalAccessTemplate state for $Tenant. Error: $ErrorMessage" -Sev Error
5050
return
@@ -55,6 +55,13 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
5555
try {
5656
$Filter = "PartitionKey eq 'CATemplate' and RowKey eq '$($Setting.TemplateList.value)'"
5757
$JSONObj = (Get-CippAzDataTableEntity @Table -Filter $Filter).JSON
58+
$Policy = $JSONObj | ConvertFrom-Json
59+
if ($Policy.conditions.userRiskLevels.count -gt 0 -or $Policy.conditions.signInRiskLevels.count -gt 0) {
60+
if (!$TestP2) {
61+
Write-Information "Skipping policy $($Policy.displayName) as it requires AAD Premium P2 license."
62+
continue
63+
}
64+
}
5865
$null = New-CIPPCAPolicy -replacePattern 'displayName' -TenantFilter $tenant -state $Setting.state -RawJSON $JSONObj -Overwrite $true -APIName $APIName -Headers $Request.Headers -DisableSD $Setting.DisableSD
5966
} catch {
6067
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
@@ -70,7 +77,15 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
7077
$policy = $Policies | Where-Object { $_.displayName -eq $Setting.label }
7178
$CheckExististing = $AllCAPolicies | Where-Object -Property displayName -EQ $Setting.label
7279
if (!$CheckExististing) {
73-
Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Setting.value)" -FieldValue "Policy $($Setting.label) is missing from this tenant." -Tenant $Tenant
80+
if ($Setting.conditions.userRiskLevels.Count -gt 0 -or $Setting.conditions.signInRiskLevels.Count -gt 0) {
81+
if (!$TestP2) {
82+
Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Setting.value)" -FieldValue "Policy $($Setting.label) requires AAD Premium P2 license." -Tenant $Tenant
83+
} else {
84+
Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Setting.value)" -FieldValue "Policy $($Setting.label) is missing from this tenant." -Tenant $Tenant
85+
}
86+
} else {
87+
Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Setting.value)" -FieldValue "Policy $($Setting.label) is missing from this tenant." -Tenant $Tenant
88+
}
7489
} else {
7590
$CompareObj = ConvertFrom-Json -ErrorAction SilentlyContinue -InputObject (New-CIPPCATemplate -TenantFilter $tenant -JSON $CheckExististing)
7691
$Compare = Compare-CIPPIntuneObject -ReferenceObject $policy -DifferenceObject $CompareObj

0 commit comments

Comments
 (0)