clumsy looking but functional

Author: kris6673

Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1

@@ -45,14 +45,19 @@ function Invoke-CIPPStandardProfilePhotos {
     # Get current Graph policy state
     $Uri = 'https://graph.microsoft.com/beta/admin/people/photoUpdateSettings'
     $CurrentGraphState = New-GraphGetRequest -uri $Uri -tenantid $Tenant
-    $UsersCanChangePhotos = if (($CurrentGraphState.allowedRoles -contains 'fe930be7-5e62-47db-91af-98c3a49a38b1' -and $CurrentGraphState.allowedRoles -contains '62e90394-69f5-4237-9190-012177145e10') -or
-        $null -ne $CurrentGraphState.allowedRoles) { $false } else { $true }
+    $UsersCanChangePhotos = if ([string]::IsNullOrWhiteSpace($CurrentGraphState.allowedRoles) ) { $true } else { $false }
     $GraphStateCorrect = $UsersCanChangePhotos -eq $DesiredState
 
+    if ($UsersCanChangePhotos -eq $false -and $DesiredState -eq $false) {
+        # Check if the correct roles are present
+        $GraphStateCorrect = $CurrentGraphState.allowedRoles -contains '62e90394-69f5-4237-9190-012177145e10' -and $CurrentGraphState.allowedRoles -contains 'fe930be7-5e62-47db-91af-98c3a49a38b1'
+    }
+
     # Get current OWA mailbox policy state
     $CurrentOWAState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OwaMailboxPolicy' -cmdParams @{Identity = 'OwaMailboxPolicy-Default' } -Select 'Identity,SetPhotoEnabled'
     $OWAStateCorrect = $CurrentOWAState.SetPhotoEnabled -eq $DesiredState
 
+    # Check if both states are correct
     $CurrentStatesCorrect = $GraphStateCorrect -eq $true -and $OWAStateCorrect -eq $true
 
     if ($Settings.remediate -eq $true) {