Skip to content

Commit a5cd86d

Browse files
pull[bot]pull[bot]
authored
Merge pull request #643 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents 8cac674 + 2ceb15c commit a5cd86d

File tree

89 files changed

+5602
-6
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

89 files changed

+5602
-6
lines changed

‎ExampleReportTemplate.ps1‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,17 @@
11
$Table = Get-CippTable -tablename 'CippReportTemplates'
22

3+
# Dynamically discover all ZTNA test files
4+
$TestFiles = Get-ChildItem "C:\Github\CIPP-API\Modules\CIPPCore\Public\Tests\Invoke-CippTestZTNA*.ps1" | Sort-Object Name
5+
$AllTestIds = $TestFiles.BaseName | ForEach-Object { $_ -replace 'Invoke-CippTestZTNA', 'ZTNA' }
6+
7+
Write-Host "Discovered $($AllTestIds.Count) ZTNA tests"
8+
39
$Entity = @{
4-
RowKey = (New-Guid).ToString()
5-
PartitionKey = 'ReportingTemplate'
6-
Tests = [string](@('Test01', 'Test02', 'Test03', 'Test04', 'Test05') | ConvertTo-Json -Compress)
7-
Description = 'This is a test report'
8-
Name = 'Test Report'
10+
RowKey = 'd5d1e123-bce0-482d-971f-be6ed820dd92'
11+
PartitionKey = 'ReportingTemplate'
12+
IdentityTests = [string]($AllTestIds | ConvertTo-Json -Compress)
13+
Description = 'Complete Zero Trust Network Assessment Report'
14+
Name = 'Full ZTNA Report'
915
}
1016

1117
Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,10 @@ function Push-CIPPDBCacheData {
6262
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "AuthorizationPolicy collection failed: $($_.Exception.Message)" -sev Error
6363
}
6464

65+
try { Set-CIPPDBCacheAuthenticationMethodsPolicy -TenantFilter $TenantFilter } catch {
66+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "AuthenticationMethodsPolicy collection failed: $($_.Exception.Message)" -sev Error
67+
}
68+
6569
try { Set-CIPPDBCacheDeviceSettings -TenantFilter $TenantFilter } catch {
6670
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "DeviceSettings collection failed: $($_.Exception.Message)" -sev Error
6771
}
@@ -98,6 +102,50 @@ function Push-CIPPDBCacheData {
98102
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "PIMSettings collection failed: $($_.Exception.Message)" -sev Error
99103
}
100104

105+
try { Set-CIPPDBCacheDomains -TenantFilter $TenantFilter } catch {
106+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Domains collection failed: $($_.Exception.Message)" -sev Error
107+
}
108+
109+
try { Set-CIPPDBCacheRoleEligibilitySchedules -TenantFilter $TenantFilter } catch {
110+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RoleEligibilitySchedules collection failed: $($_.Exception.Message)" -sev Error
111+
}
112+
113+
try { Set-CIPPDBCacheRoleManagementPolicies -TenantFilter $TenantFilter } catch {
114+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RoleManagementPolicies collection failed: $($_.Exception.Message)" -sev Error
115+
}
116+
117+
try { Set-CIPPDBCacheRoleAssignmentScheduleInstances -TenantFilter $TenantFilter } catch {
118+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RoleAssignmentScheduleInstances collection failed: $($_.Exception.Message)" -sev Error
119+
}
120+
121+
try { Set-CIPPDBCacheB2BManagementPolicy -TenantFilter $TenantFilter } catch {
122+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "B2BManagementPolicy collection failed: $($_.Exception.Message)" -sev Error
123+
}
124+
125+
try { Set-CIPPDBCacheAuthenticationFlowsPolicy -TenantFilter $TenantFilter } catch {
126+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "AuthenticationFlowsPolicy collection failed: $($_.Exception.Message)" -sev Error
127+
}
128+
129+
try { Set-CIPPDBCacheRiskyUsers -TenantFilter $TenantFilter } catch {
130+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskyUsers collection failed: $($_.Exception.Message)" -sev Error
131+
}
132+
133+
try { Set-CIPPDBCacheRiskyServicePrincipals -TenantFilter $TenantFilter } catch {
134+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskyServicePrincipals collection failed: $($_.Exception.Message)" -sev Error
135+
}
136+
137+
try { Set-CIPPDBCacheServicePrincipalRiskDetections -TenantFilter $TenantFilter } catch {
138+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ServicePrincipalRiskDetections collection failed: $($_.Exception.Message)" -sev Error
139+
}
140+
141+
try { Set-CIPPDBCacheRiskDetections -TenantFilter $TenantFilter } catch {
142+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskDetections collection failed: $($_.Exception.Message)" -sev Error
143+
}
144+
145+
try { Set-CIPPDBCacheDeviceRegistrationPolicy -TenantFilter $TenantFilter } catch {
146+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "DeviceRegistrationPolicy collection failed: $($_.Exception.Message)" -sev Error
147+
}
148+
101149
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Completed database cache collection for tenant' -sev Info
102150

103151
} catch {

‎Modules/CIPPCore/Public/Get-CippDbRole.ps1‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
function Get-CippDbRole {
2+
[CmdletBinding()]
3+
param (
4+
[Parameter(Mandatory = $true)]
5+
[string]$TenantFilter,
6+
7+
[Parameter(Mandatory = $false)]
8+
[switch]$IncludePrivilegedRoles,
9+
10+
[Parameter(Mandatory = $false)]
11+
[switch]$CisaHighlyPrivilegedRoles
12+
)
13+
14+
$Roles = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Roles'
15+
16+
if ($IncludePrivilegedRoles) {
17+
$PrivilegedRoleTemplateIds = @(
18+
'62e90394-69f5-4237-9190-012177145e10',
19+
'194ae4cb-b126-40b2-bd5b-6091b380977d',
20+
'9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3',
21+
'e8611ab8-c189-46e8-94e1-60213ab1f814',
22+
'29232cdf-9323-42fd-ade2-1d097af3e4de',
23+
'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9',
24+
'f28a1f50-f6e7-4571-818b-6a12f2af6b6c',
25+
'fe930be7-5e62-47db-91af-98c3a49a38b1',
26+
'729827e3-9c14-49f7-bb1b-9608f156bbb8',
27+
'966707d0-3269-4727-9be2-8c3a10f19b9d',
28+
'b0f54661-2d74-4c50-afa3-1ec803f12efe',
29+
'7be44c8a-adaf-4e2a-84d6-ab2649e08a13',
30+
'158c047a-c907-4556-b7ef-446551a6b5f7',
31+
'c4e39bd9-1100-46d3-8c65-fb160da0071f',
32+
'9f06204d-73c1-4d4c-880a-6edb90606fd8',
33+
'17315797-102d-40b4-93e0-432062caca18',
34+
'4a5d8f65-41da-4de4-8968-e035b65339cf',
35+
'75941009-915a-4869-abe7-691bff18279e'
36+
)
37+
$Roles = $Roles | Where-Object { $PrivilegedRoleTemplateIds -contains $_.templateId }
38+
}
39+
40+
if ($CisaHighlyPrivilegedRoles) {
41+
$CisaRoleTemplateIds = @(
42+
'62e90394-69f5-4237-9190-012177145e10',
43+
'9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3',
44+
'29232cdf-9323-42fd-ade2-1d097af3e4de',
45+
'729827e3-9c14-49f7-bb1b-9608f156bbb8',
46+
'966707d0-3269-4727-9be2-8c3a10f19b9d',
47+
'b0f54661-2d74-4c50-afa3-1ec803f12efe'
48+
)
49+
$Roles = $Roles | Where-Object { $CisaRoleTemplateIds -contains $_.templateId }
50+
}
51+
52+
return $Roles
53+
}

‎Modules/CIPPCore/Public/Get-CippDbRoleMembers.ps1‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
function Get-CippDbRoleMembers {
2+
[CmdletBinding()]
3+
param (
4+
[Parameter(Mandatory = $true)]
5+
[string]$TenantFilter,
6+
7+
[Parameter(Mandatory = $true)]
8+
[string]$RoleTemplateId
9+
)
10+
11+
$RoleAssignments = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'RoleAssignmentScheduleInstances'
12+
$RoleEligibilities = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'RoleEligibilitySchedules'
13+
14+
$ActiveMembers = $RoleAssignments | Where-Object {
15+
$_.roleDefinitionId -eq $RoleTemplateId -and $_.assignmentType -eq 'Assigned'
16+
}
17+
18+
$EligibleMembers = $RoleEligibilities | Where-Object {
19+
$_.roleDefinitionId -eq $RoleTemplateId
20+
}
21+
22+
$AllMembers = [System.Collections.Generic.List[object]]::new()
23+
24+
foreach ($member in $ActiveMembers) {
25+
$memberObj = [PSCustomObject]@{
26+
id = $member.principalId
27+
displayName = $member.principal.displayName
28+
userPrincipalName = $member.principal.userPrincipalName
29+
'@odata.type' = $member.principal.'@odata.type'
30+
AssignmentType = 'Active'
31+
}
32+
$AllMembers.Add($memberObj)
33+
}
34+
35+
foreach ($member in $EligibleMembers) {
36+
if ($AllMembers.id -notcontains $member.principalId) {
37+
$memberObj = [PSCustomObject]@{
38+
id = $member.principalId
39+
displayName = $member.principal.displayName
40+
userPrincipalName = $member.principal.userPrincipalName
41+
'@odata.type' = $member.principal.'@odata.type'
42+
AssignmentType = 'Eligible'
43+
}
44+
$AllMembers.Add($memberObj)
45+
}
46+
}
47+
48+
return $AllMembers
49+
}

‎Modules/CIPPCore/Public/Set-CIPPDBCacheApps.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ function Set-CIPPDBCacheApps {
1515
try {
1616
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching applications' -sev Info
1717

18-
$Apps = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/applications?$top=999&$select=id,appId,displayName,createdDateTime,signInAudience' -tenantid $TenantFilter
18+
$Apps = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/applications?$top=999' -tenantid $TenantFilter
1919
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Apps' -Data $Apps
2020
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Apps' -Data $Apps -Count
2121
$Apps = $null

‎Modules/CIPPCore/Public/Set-CIPPDBCacheAuthenticationFlowsPolicy.ps1‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
function Set-CIPPDBCacheAuthenticationFlowsPolicy {
2+
<#
3+
.SYNOPSIS
4+
Caches authentication flows policy for a tenant
5+
6+
.PARAMETER TenantFilter
7+
The tenant to cache authentication flows policy for
8+
#>
9+
[CmdletBinding()]
10+
param(
11+
[Parameter(Mandatory = $true)]
12+
[string]$TenantFilter
13+
)
14+
15+
try {
16+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching authentication flows policy' -sev Info
17+
18+
$AuthFlowPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/authenticationFlowsPolicy' -tenantid $TenantFilter
19+
20+
if ($AuthFlowPolicy) {
21+
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AuthenticationFlowsPolicy' -Data @($AuthFlowPolicy)
22+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached authentication flows policy successfully' -sev Info
23+
}
24+
25+
} catch {
26+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
27+
-message "Failed to cache authentication flows policy: $($_.Exception.Message)" `
28+
-sev Warning `
29+
-LogData (Get-CippException -Exception $_)
30+
}
31+
}

‎Modules/CIPPCore/Public/Set-CIPPDBCacheAuthenticationMethodsPolicy.ps1‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
function Set-CIPPDBCacheAuthenticationMethodsPolicy {
2+
<#
3+
.SYNOPSIS
4+
Caches authentication methods policy for a tenant
5+
6+
.PARAMETER TenantFilter
7+
The tenant to cache authentication methods policy for
8+
#>
9+
[CmdletBinding()]
10+
param(
11+
[Parameter(Mandatory = $true)]
12+
[string]$TenantFilter
13+
)
14+
15+
try {
16+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching authentication methods policy' -sev Info
17+
$AuthMethodsPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy' -tenantid $TenantFilter
18+
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AuthenticationMethodsPolicy' -Data @($AuthMethodsPolicy)
19+
$AuthMethodsPolicy = $null
20+
21+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached authentication methods policy successfully' -sev Info
22+
23+
} catch {
24+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache authentication methods policy: $($_.Exception.Message)" -sev Error
25+
}
26+
}

‎Modules/CIPPCore/Public/Set-CIPPDBCacheB2BManagementPolicy.ps1‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
function Set-CIPPDBCacheB2BManagementPolicy {
2+
<#
3+
.SYNOPSIS
4+
Caches B2B management policy for a tenant
5+
6+
.PARAMETER TenantFilter
7+
The tenant to cache B2B management policy for
8+
#>
9+
[CmdletBinding()]
10+
param(
11+
[Parameter(Mandatory = $true)]
12+
[string]$TenantFilter
13+
)
14+
15+
try {
16+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching B2B management policy' -sev Info
17+
18+
$LegacyPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies' -tenantid $TenantFilter
19+
$B2BManagementPolicy = $LegacyPolicies | Where-Object { $_.Type -eq 'B2BManagementPolicy' }
20+
21+
if ($B2BManagementPolicy) {
22+
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'B2BManagementPolicy' -Data @($B2BManagementPolicy)
23+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached B2B management policy successfully' -sev Info
24+
} else {
25+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'No B2B management policy found' -sev Info
26+
}
27+
28+
} catch {
29+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
30+
-message "Failed to cache B2B management policy: $($_.Exception.Message)" `
31+
-sev Warning `
32+
-LogData (Get-CippException -Exception $_)
33+
}
34+
}

‎Modules/CIPPCore/Public/Set-CIPPDBCacheDeviceRegistrationPolicy.ps1‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
function Set-CIPPDBCacheDeviceRegistrationPolicy {
2+
<#
3+
.SYNOPSIS
4+
Caches device registration policy for a tenant
5+
6+
.PARAMETER TenantFilter
7+
The tenant to cache device registration policy for
8+
#>
9+
[CmdletBinding()]
10+
param(
11+
[Parameter(Mandatory = $true)]
12+
[string]$TenantFilter
13+
)
14+
15+
try {
16+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching device registration policy' -sev Info
17+
18+
$DeviceRegistrationPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/deviceRegistrationPolicy' -tenantid $TenantFilter
19+
20+
if ($DeviceRegistrationPolicy) {
21+
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'DeviceRegistrationPolicy' -Data @($DeviceRegistrationPolicy)
22+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached device registration policy successfully' -sev Info
23+
}
24+
25+
} catch {
26+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
27+
-message "Failed to cache device registration policy: $($_.Exception.Message)" `
28+
-sev Warning `
29+
-LogData (Get-CippException -Exception $_)
30+
}
31+
}

‎Modules/CIPPCore/Public/Set-CIPPDBCacheDomains.ps1‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
function Set-CIPPDBCacheDomains {
2+
<#
3+
.SYNOPSIS
4+
Caches domains for a tenant
5+
6+
.PARAMETER TenantFilter
7+
The tenant to cache domains for
8+
#>
9+
[CmdletBinding()]
10+
param(
11+
[Parameter(Mandatory = $true)]
12+
[string]$TenantFilter
13+
)
14+
15+
try {
16+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching domains' -sev Info
17+
$Domains = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/domains' -tenantid $TenantFilter
18+
Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Domains' -Data @($Domains)
19+
$Domains = $null
20+
21+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached domains successfully' -sev Info
22+
23+
} catch {
24+
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache domains: $($_.Exception.Message)" -sev Error
25+
}
26+
}

0 commit comments

Comments
 (0)