Skip to content

Commit baa663e

Browse files
KelvinTegelaarKelvinTegelaar
committed
prerelease push
1 parent c34f132 commit baa663e

File tree

3 files changed

+176
-21
lines changed

3 files changed

+176
-21
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecUpdateDriftDeviation.ps1‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -72,20 +72,19 @@ function Invoke-ExecUpdateDriftDeviation {
7272
Write-LogMessage -tenant $TenantFilter -user $request.headers.'x-ms-client-principal' -API $APINAME -message "Scheduled drift remediation task for $Setting" -Sev 'Info'
7373
}
7474
if ($Deviation.status -eq 'deniedDelete') {
75-
if ($Deviation.standardName -like 'ConditionalAccessTemplate*') {
76-
$ID = $Deviation.standardName -replace 'ConditionalAccessTemplates.', ''
77-
Write-Host "Going to delete CA Policy with ID $ID. Deviation Name is $($Deviation.standardName)"
78-
$null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/$($ID)" -type DELETE -tenant $TenantFilter -asapp $true
79-
"Deleted CA Policy $($ID)"
80-
Write-LogMessage -tenant $TenantFilter -user $request.headers.'x-ms-client-principal' -API $APINAME -message "Deleted Conditional Access Policy with ID $($ID)" -Sev 'Info'
75+
$Policy = $Deviation.receivedValue | ConvertFrom-Json -ErrorAction SilentlyContinue
76+
Write-Host "Policy is $($Policy)"
77+
$URLName = Get-CIPPURLName -Template $Policy
78+
if ($Policy -and $URLName) {
79+
Write-Host "Going to delete Policy with ID $($policy.ID) Deviation Name is $($Deviation.standardName)"
80+
$null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/$($URLName)/$($policy.id)" -type DELETE -tenant $TenantFilter
81+
"Deleted Policy $($ID)"
82+
Write-LogMessage -tenant $TenantFilter -user $request.headers.'x-ms-client-principal' -API $APINAME -message "Deleted Policy with ID $($ID)" -Sev 'Info'
83+
} else {
84+
"could not find policy with ID $($ID)"
85+
Write-LogMessage -tenant $TenantFilter -user $request.headers.'x-ms-client-principal' -API $APINAME -message "Could not find Policy with ID $($ID) to delete for remediation" -Sev 'Warning'
8186
}
8287

83-
if ($Deviation.standardName -like 'IntuneTemplates*') {
84-
New-GraphPostRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$($UrlName)('$($PolicyId)')" -type DELETE -tenant $TenantFilter
85-
"Deleted Intune Policy $($ID)"
86-
Write-LogMessage -tenant $TenantFilter -user $request.headers.'x-ms-client-principal' -API $APINAME -message "Deleted Intune Policy with ID $($ID)" -Sev 'Info'
87-
88-
}
8988

9089
}
9190
} catch {

‎Modules/CIPPCore/Public/Functions/Get-CIPPURLName.ps1‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
function Get-CIPPURLName {
2+
<#
3+
.SYNOPSIS
4+
Gets the correct Microsoft Graph URL based on the OData type of a template
5+
.DESCRIPTION
6+
This function examines the @odata.type property of a JSON template object and returns
7+
the appropriate full Microsoft Graph API URL for that resource type.
8+
.PARAMETER Template
9+
The template object containing the @odata.type property to analyze
10+
.FUNCTIONALITY
11+
Internal
12+
.EXAMPLE
13+
Get-CIPPURLName -Template $MyTemplate
14+
.EXAMPLE
15+
$Template | Get-CIPPURLName
16+
#>
17+
[CmdletBinding()]
18+
param(
19+
[Parameter(Mandatory = $true, ValueFromPipeline = $true)]
20+
[PSCustomObject]$Template
21+
)
22+
23+
# Extract the OData type from the template
24+
$ODataType = $Template.'@odata.type'
25+
if ($Template.urlName) { return $Template.urlName }
26+
27+
if (-not $ODataType) {
28+
Write-Warning 'No @odata.type property found in template'
29+
return $null
30+
}
31+
32+
# Determine the full Microsoft Graph URL based on the OData type
33+
$URLName = switch -wildcard ($ODataType) {
34+
# Device Compliance Policies
35+
'*CompliancePolicy' {
36+
'deviceManagement/deviceCompliancePolicies'
37+
}
38+
'*deviceCompliancePolicy' {
39+
'deviceManagement/deviceCompliancePolicies'
40+
}
41+
42+
# Managed App Policies (App Protection)
43+
'*ManagedAppProtection' {
44+
'deviceAppManagement/managedAppPolicies'
45+
}
46+
'*managedAppPolicies' {
47+
'deviceAppManagement/managedAppPolicies'
48+
}
49+
'*managedAppPolicy' {
50+
'deviceAppManagement/managedAppPolicies'
51+
}
52+
'*appProtectionPolicy' {
53+
'deviceAppManagement/managedAppPolicies'
54+
}
55+
56+
# Configuration Policies (Settings Catalog)
57+
'*configurationPolicies' {
58+
'deviceManagement/configurationPolicies'
59+
}
60+
'*deviceManagementConfigurationPolicy' {
61+
'deviceManagement/configurationPolicies'
62+
}
63+
64+
# Windows Driver Update Profiles
65+
'*windowsDriverUpdateProfiles' {
66+
'deviceManagement/windowsDriverUpdateProfiles'
67+
}
68+
'*windowsDriverUpdateProfile' {
69+
'deviceManagement/windowsDriverUpdateProfiles'
70+
}
71+
72+
# Device Configurations
73+
'*deviceConfigurations' {
74+
'deviceManagement/deviceConfigurations'
75+
}
76+
'*deviceConfiguration' {
77+
'deviceManagement/deviceConfigurations'
78+
}
79+
80+
# Group Policy Configurations (Administrative Templates)
81+
'*groupPolicyConfigurations' {
82+
'deviceManagement/groupPolicyConfigurations'
83+
}
84+
'*groupPolicyConfiguration' {
85+
'deviceManagement/groupPolicyConfigurations'
86+
}
87+
88+
# Conditional Access Policies
89+
'*conditionalAccessPolicy' {
90+
'identity/conditionalAccess/policies'
91+
}
92+
93+
# Device Enrollment Configurations
94+
'*deviceEnrollmentConfiguration' {
95+
'deviceManagement/deviceEnrollmentConfigurations'
96+
}
97+
'*enrollmentConfiguration' {
98+
'deviceManagement/deviceEnrollmentConfigurations'
99+
}
100+
101+
# Mobile App Configurations
102+
'*mobileAppConfiguration' {
103+
'deviceAppManagement/mobileAppConfigurations'
104+
}
105+
'*appConfiguration' {
106+
'deviceAppManagement/mobileAppConfigurations'
107+
}
108+
109+
# Windows Feature Update Profiles
110+
'*windowsFeatureUpdateProfile' {
111+
'deviceManagement/windowsFeatureUpdateProfiles'
112+
}
113+
114+
# Device Health Scripts (Remediation Scripts)
115+
'*deviceHealthScript' {
116+
'deviceManagement/deviceHealthScripts'
117+
}
118+
119+
# Device Management Scripts (PowerShell Scripts)
120+
'*deviceManagementScript' {
121+
'deviceManagement/deviceManagementScripts'
122+
}
123+
124+
# Mobile Applications
125+
'*mobileApp' {
126+
'deviceAppManagement/mobileApps'
127+
}
128+
'*winGetApp' {
129+
'deviceAppManagement/mobileApps'
130+
}
131+
'*officeSuiteApp' {
132+
'deviceAppManagement/mobileApps'
133+
}
134+
135+
# Named Locations
136+
'*namedLocation' {
137+
'identity/conditionalAccess/namedLocations'
138+
}
139+
'*ipNamedLocation' {
140+
'identity/conditionalAccess/namedLocations'
141+
}
142+
'*countryNamedLocation' {
143+
'identity/conditionalAccess/namedLocations'
144+
}
145+
146+
# Default fallback
147+
default {
148+
Write-Warning "Unknown OData type: $ODataType"
149+
$null
150+
}
151+
}
152+
153+
return $URLName
154+
}
155+

‎Modules/CIPPCore/Public/Get-CIPPDrift.ps1‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -84,47 +84,47 @@ function Get-CIPPDrift {
8484
# Always get live data when not in AllTenants mode
8585
$IntuneRequests = @(
8686
@{
87-
id = 'deviceAppManagement'
87+
id = 'deviceAppManagement/managedAppPolicies'
8888
url = 'deviceAppManagement/managedAppPolicies'
8989
method = 'GET'
9090
}
9191
@{
92-
id = 'deviceCompliancePolicies'
92+
id = 'deviceManagement/deviceCompliancePolicies'
9393
url = 'deviceManagement/deviceCompliancePolicies'
9494
method = 'GET'
9595
}
9696
@{
97-
id = 'groupPolicyConfigurations'
97+
id = 'deviceManagement/groupPolicyConfigurations'
9898
url = 'deviceManagement/groupPolicyConfigurations'
9999
method = 'GET'
100100
}
101101
@{
102-
id = 'deviceConfigurations'
102+
id = 'deviceManagement/deviceConfigurations'
103103
url = 'deviceManagement/deviceConfigurations'
104104
method = 'GET'
105105
}
106106
@{
107-
id = 'configurationPolicies'
107+
id = 'deviceManagement/configurationPolicies'
108108
url = 'deviceManagement/configurationPolicies'
109109
method = 'GET'
110110
}
111111
@{
112-
id = 'windowsDriverUpdateProfiles'
112+
id = 'deviceManagement/windowsDriverUpdateProfiles'
113113
url = 'deviceManagement/windowsDriverUpdateProfiles'
114114
method = 'GET'
115115
}
116116
@{
117-
id = 'windowsFeatureUpdateProfiles'
117+
id = 'deviceManagement/windowsFeatureUpdateProfiles'
118118
url = 'deviceManagement/windowsFeatureUpdateProfiles'
119119
method = 'GET'
120120
}
121121
@{
122-
id = 'windowsQualityUpdatePolicies'
122+
id = 'deviceManagement/windowsQualityUpdatePolicies'
123123
url = 'deviceManagement/windowsQualityUpdatePolicies'
124124
method = 'GET'
125125
}
126126
@{
127-
id = 'windowsQualityUpdateProfiles'
127+
id = 'deviceManagement/windowsQualityUpdateProfiles'
128128
url = 'deviceManagement/windowsQualityUpdateProfiles'
129129
method = 'GET'
130130
}
@@ -220,6 +220,7 @@ function Get-CIPPDrift {
220220
# Check for extra Intune policies not in template
221221
foreach ($TenantPolicy in $TenantIntunePolicies) {
222222
$PolicyFound = $false
223+
$tenantPolicy.policy | Add-Member -MemberType NoteProperty -Name 'URLName' -Value $TenantPolicy.Type -Force
223224
$TenantPolicyName = if ($TenantPolicy.Policy.displayName) { $TenantPolicy.Policy.displayName } else { $TenantPolicy.Policy.name }
224225

225226
foreach ($TemplatePolicy in $TemplateIntuneTemplates) {

0 commit comments

Comments
 (0)