Skip to content

Commit fa8aeb5

Browse files
JohnDupreyJohnDuprey
committed
more standards
1 parent de27394 commit fa8aeb5

File tree

3 files changed

+32
-17
lines changed

3 files changed

+32
-17
lines changed

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,11 @@ function Invoke-CIPPStandardOauthConsent {
3232
#>
3333

3434
param($tenant, $settings)
35-
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'OauthConsent'
3635

3736
$State = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $tenant
3837
$StateIsCorrect = if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -eq 'managePermissionGrantsForSelf.cipp-consent-policy') { $true } else { $false }
3938

40-
If ($Settings.remediate -eq $true) {
39+
if ($Settings.remediate -eq $true) {
4140
$AllowedAppIdsForTenant = $settings.AllowedApps -split ','
4241
try {
4342
if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -notin @('managePermissionGrantsForSelf.cipp-consent-policy')) {
@@ -70,11 +69,17 @@ function Invoke-CIPPStandardOauthConsent {
7069
if ($StateIsCorrect -eq $true) {
7170
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Application Consent Mode is enabled.' -sev Info
7271
} else {
73-
Write-StandardsAlert -message "Application Consent Mode is not enabled." -object $State -tenant $tenant -standardName 'OauthConsent' -standardId $Settings.standardId
72+
Write-StandardsAlert -message 'Application Consent Mode is not enabled.' -object $State -tenant $tenant -standardName 'OauthConsent' -standardId $Settings.standardId
7473
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Application Consent Mode is not enabled.' -sev Info
7574
}
7675
}
7776
if ($Settings.report -eq $true) {
7877
Add-CIPPBPAField -FieldName 'OauthConsent' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
78+
if ($StateIsCorrect) {
79+
$FieldValue = $true
80+
} else {
81+
$FieldValue = $State
82+
}
83+
Set-CIPPStandardsCompareField -FieldName 'standards.OauthConsent' -FieldValue $FieldValue -Tenant $tenant
7984
}
8085
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -28,24 +28,23 @@ function Invoke-CIPPStandardOauthConsentLowSec {
2828
#>
2929

3030
param($Tenant, $Settings)
31-
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'OauthConsentLowSec'
3231

3332
$State = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $tenant)
3433
$PermissionState = (New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/servicePrincipals(appId='00000003-0000-0000-c000-000000000000')/delegatedPermissionClassifications" -tenantid $tenant) | Select-Object -Property permissionName
3534

3635
$requiredPermissions = @('offline_access', 'openid', 'User.Read', 'profile', 'email')
3736
$missingPermissions = $requiredPermissions | Where-Object { $PermissionState.permissionName -notcontains $_ }
3837

39-
If ($Settings.remediate -eq $true) {
38+
if ($Settings.remediate -eq $true) {
4039
if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -in @('managePermissionGrantsForSelf.microsoft-user-default-low')) {
4140
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Application Consent Mode(microsoft-user-default-low) is already enabled.' -sev Info
4241
} else {
4342
try {
4443
$GraphParam = @{
45-
tenantid = $tenant
46-
Uri = 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy'
47-
Type = 'PATCH'
48-
Body = @{
44+
tenantid = $tenant
45+
Uri = 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy'
46+
Type = 'PATCH'
47+
Body = @{
4948
permissionGrantPolicyIdsAssignedToDefaultUserRole = @('managePermissionGrantsForSelf.microsoft-user-default-low')
5049
} | ConvertTo-Json
5150
ContentType = 'application/json'
@@ -64,10 +63,10 @@ function Invoke-CIPPStandardOauthConsentLowSec {
6463
try {
6564
$missingPermissions | ForEach-Object {
6665
$GraphParam = @{
67-
tenantid = $tenant
68-
Uri = "https://graph.microsoft.com/beta/servicePrincipals(appId='00000003-0000-0000-c000-000000000000')/delegatedPermissionClassifications"
69-
Type = 'POST'
70-
Body = @{
66+
tenantid = $tenant
67+
Uri = "https://graph.microsoft.com/beta/servicePrincipals(appId='00000003-0000-0000-c000-000000000000')/delegatedPermissionClassifications"
68+
Type = 'POST'
69+
Body = @{
7170
permissionName = $_
7271
classification = 'low'
7372
} | ConvertTo-Json
@@ -85,7 +84,7 @@ function Invoke-CIPPStandardOauthConsentLowSec {
8584

8685
if ($Settings.alert -eq $true) {
8786
if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -notin @('managePermissionGrantsForSelf.microsoft-user-default-low')) {
88-
Write-StandardsAlert -message "Application Consent Mode(microsoft-user-default-low) is not enabled" -object $State -tenant $tenant -standardName 'OauthConsentLowSec' -standardId $Settings.standardId
87+
Write-StandardsAlert -message 'Application Consent Mode(microsoft-user-default-low) is not enabled' -object $State -tenant $tenant -standardName 'OauthConsentLowSec' -standardId $Settings.standardId
8988
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Application Consent Mode(microsoft-user-default-low) is not enabled.' -sev Info
9089
} else {
9190
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Application Consent Mode(microsoft-user-default-low) is enabled.' -sev Info
@@ -95,9 +94,15 @@ function Invoke-CIPPStandardOauthConsentLowSec {
9594
if ($Settings.report -eq $true) {
9695
if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -notin @('managePermissionGrantsForSelf.microsoft-user-default-low')) {
9796
$State.permissionGrantPolicyIdsAssignedToDefaultUserRole = $false
97+
$ValueField = @{
98+
authorizationPolicy = $State
99+
permissionClassifications = $PermissionState
100+
}
98101
} else {
99102
$State.permissionGrantPolicyIdsAssignedToDefaultUserRole = $true
103+
$ValueField = $true
100104
}
101105
Add-CIPPBPAField -FieldName 'OauthConsentLowSec' -FieldValue $State.permissionGrantPolicyIdsAssignedToDefaultUserRole -StoreAs bool -Tenant $tenant
106+
Set-CIPPStandardsCompareField -FieldName 'standards.OauthConsentLowSec' -FieldValue $ValueField -Tenant $tenant
102107
}
103108
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,10 @@ function Invoke-CIPPStandardOutBoundSpamAlert {
3131
#>
3232

3333
param($Tenant, $Settings)
34-
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'OutBoundSpamAlert'
3534

3635
$CurrentInfo = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-HostedOutboundSpamFilterPolicy' -useSystemMailbox $true
3736

38-
If ($Settings.remediate -eq $true) {
37+
if ($Settings.remediate -eq $true) {
3938

4039
if ($CurrentInfo.NotifyOutboundSpam -ne $true -or $CurrentInfo.NotifyOutboundSpamRecipients -ne $settings.OutboundSpamContact) {
4140
$Contacts = $settings.OutboundSpamContact
@@ -56,12 +55,18 @@ function Invoke-CIPPStandardOutBoundSpamAlert {
5655
if ($CurrentInfo.NotifyOutboundSpam -eq $true) {
5756
Write-LogMessage -API 'Standards' -tenant $tenant -message "Outbound spam filter alert is set to $($CurrentInfo.NotifyOutboundSpamRecipients)" -sev Info
5857
} else {
59-
Write-StandardsAlert -message "Outbound spam filter alert is not set" -object $CurrentInfo -tenant $tenant -standardName 'OutBoundSpamAlert' -standardId $Settings.standardId
58+
Write-StandardsAlert -message 'Outbound spam filter alert is not set' -object $CurrentInfo -tenant $tenant -standardName 'OutBoundSpamAlert' -standardId $Settings.standardId
6059
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Outbound spam filter alert is not set' -sev Info
6160
}
6261
}
6362

6463
if ($Settings.report -eq $true) {
6564
Add-CIPPBPAField -FieldName 'OutboundSpamAlert' -FieldValue $CurrentInfo.NotifyOutboundSpam -StoreAs bool -Tenant $tenant
65+
if ($CurrentInfo.NotifyOutboundSpam -ne $true -or $CurrentInfo.NotifyOutboundSpamRecipients -ne $settings.OutboundSpamContact) {
66+
$ValueField = $CurrentInfo | Select-Object -Property NotifyOutboundSpamRecipients, NotifyOutboundSpam
67+
} else {
68+
$ValueField = $true
69+
}
70+
Set-CIPPStandardsCompareField -FieldName 'standards.OutBoundSpamAlert' -FieldValue $ValueField -Tenant $tenant
6671
}
6772
}

0 commit comments

Comments
 (0)