Merge pull request #632 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1

@@ -17,15 +17,15 @@ function Test-CIPPAccess {
         $CIPPCoreModule = Get-Module -Name CIPPCore
         if ($CIPPCoreModule) {
             $PermissionsFileJson = Join-Path $CIPPCoreModule.ModuleBase 'lib' 'data' 'function-permissions.json'
-            
+
             if (Test-Path $PermissionsFileJson) {
                 try {
                     $jsonData = Get-Content -Path $PermissionsFileJson -Raw | ConvertFrom-Json -AsHashtable
                     $global:CIPPFunctionPermissions = [System.Collections.Hashtable]::new([StringComparer]::OrdinalIgnoreCase)
                     foreach ($key in $jsonData.Keys) {
                         $global:CIPPFunctionPermissions[$key] = $jsonData[$key]
                     }
-                    Write-Information "Loaded $($global:CIPPFunctionPermissions.Count) function permissions from JSON cache"
+                    Write-Debug "Loaded $($global:CIPPFunctionPermissions.Count) function permissions from JSON cache"
                 } catch {
                     Write-Warning "Failed to load function permissions from JSON: $($_.Exception.Message)"
                 }
@@ -41,13 +41,13 @@ function Test-CIPPAccess {
             $PermissionData = $global:CIPPFunctionPermissions[$FunctionName]
             $APIRole = $PermissionData['Role']
             $Functionality = $PermissionData['Functionality']
-            Write-Information "Loaded function permission data from cache for '$FunctionName': Role='$APIRole', Functionality='$Functionality'"
+            Write-Debug "Loaded function permission data from cache for '$FunctionName': Role='$APIRole', Functionality='$Functionality'"
         } else {
             try {
                 $Help = Get-Help $FunctionName -ErrorAction Stop
                 $APIRole = $Help.Role
                 $Functionality = $Help.Functionality
-                Write-Information "Loaded function permission data via Get-Help for '$FunctionName': Role='$APIRole', Functionality='$Functionality'"
+                Write-Debug "Loaded function permission data via Get-Help for '$FunctionName': Role='$APIRole', Functionality='$Functionality'"
             } catch {
                 Write-Warning "Function '$FunctionName' not found"
             }

Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1

@@ -111,18 +111,27 @@ function Get-CIPPTenantAlignment {
 
             if ($Template.tenantFilter -and $Template.tenantFilter.Count -gt 0) {
                 # Extract tenant values from the tenantFilter array
-                $TenantValues = $Template.tenantFilter | ForEach-Object {
-                    if ($_.type -eq 'group') {
-                        ($TenantGroups | Where-Object -Property GroupName -EQ $_.value).Members.defaultDomainName
+                $TenantValues = [System.Collections.Generic.List[string]]::new()
+                foreach ($filterItem in $Template.tenantFilter) {
+                    if ($filterItem.type -eq 'group') {
+                        # Look up group members by Id (GUID in the value field)
+                        $GroupMembers = $TenantGroups | Where-Object { $_.Id -eq $filterItem.value }
+                        if ($GroupMembers -and $GroupMembers.Members) {
+                            foreach ($member in $GroupMembers.Members.defaultDomainName) {
+                                $TenantValues.Add($member)
+                            }
+                        }
                     } else {
-                        $_.value
+                        $TenantValues.Add($filterItem.value)
                     }
                 }
 
                 if ($TenantValues -contains 'AllTenants') {
                     $AppliestoAllTenants = $true
+                } elseif ($TenantValues.Count -gt 0) {
+                    $TemplateAssignedTenants = @($TenantValues)
                 } else {
-                    $TemplateAssignedTenants = $TenantValues
+                    $TemplateAssignedTenants = @()
                 }
             } else {
                 $AppliestoAllTenants = $true