Skip to content

Commit f27efee

Browse files
pull[bot]pull[bot]
authored
Merge pull request #69 from KelvinTegelaar/master
[pull] master from KelvinTegelaar:master
2 parents a3423d5 + cb45ce7 commit f27efee

File tree

212 files changed

+1685
-1952
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

212 files changed

+1685
-1952
lines changed

‎.DS_Store‎

10 KB
Binary file not shown.

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,7 @@ yarn.lock
1515

1616
# Cursor IDE
1717
.cursor/rules
18+
19+
# Ignore all root PowerShell files except profile.ps1
20+
/*.ps1
21+
!/profile.ps1

‎CIPP-Permissions.json‎

Lines changed: 0 additions & 814 deletions
This file was deleted.

‎Config/ExcludeSkuList.JSON‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,15 @@
55
},
66
{
77
"GUID": "f30db892-07e9-47e9-837c-80727f46fd3d",
8-
"Product_Display_Name": "MICROSOFT FLOW FREE"
8+
"Product_Display_Name": "Microsoft Power Automate Free"
99
},
1010
{
1111
"GUID": "16ddbbfc-09ea-4de2-b1d7-312db6112d70",
12-
"Product_Display_Name": "MICROSOFT TEAMS (FREE)"
12+
"Product_Display_Name": "Microsoft Teams (Free)"
1313
},
1414
{
1515
"GUID": "a403ebcc-fae0-4ca2-8c8c-7a907fd6c235",
16-
"Product_Display_Name": "Power BI (free)"
16+
"Product_Display_Name": "Microsoft Fabric (Free)"
1717
},
1818
{
1919
"GUID": "61e6bd70-fbdb-4deb-82ea-912842f39431",
@@ -25,7 +25,7 @@
2525
},
2626
{
2727
"GUID": "338148b6-1b11-4102-afb9-f92b6cdc0f8d",
28-
"Product_Display_Name": "DYNAMICS 365 P1 TRIAL FOR INFORMATION WORKERS"
28+
"Product_Display_Name": "Dynamics 365 P1 Tria for Information Workers"
2929
},
3030
{
3131
"GUID": "fcecd1f9-a91e-488d-a918-a96cdb6ce2b0",
@@ -41,19 +41,19 @@
4141
},
4242
{
4343
"GUID": "606b54a9-78d8-4298-ad8b-df6ef4481c80",
44-
"Product_Display_Name": "Power Virtual Agents Viral Trial"
44+
"Product_Display_Name": "Microsoft Copilot Studio Viral Trial"
4545
},
4646
{
4747
"GUID": "1f2f344a-700d-42c9-9427-5cea1d5d7ba6",
48-
"Product_Display_Name": "MICROSOFT STREAM"
48+
"Product_Display_Name": "Microsoft Stream"
4949
},
5050
{
5151
"GUID": "6470687e-a428-4b7a-bef2-8a291ad947c9",
52-
"Product_Display_Name": "WINDOWS STORE FOR BUSINESS"
52+
"Product_Display_Name": "Windows Store for Business"
5353
},
5454
{
5555
"GUID": "710779e8-3d4a-4c88-adb9-386c958d1fdf",
56-
"Product_Display_Name": "MICROSOFT TEAMS EXPLORATORY"
56+
"Product_Display_Name": "Microsoft Teams Exploratory"
5757
},
5858
{
5959
"GUID": "8c4ce438-32a7-4ac5-91a6-e22ae08d9c8b",
@@ -94,5 +94,9 @@
9494
{
9595
"GUID": "99049c9c-6011-4908-bf17-15f496e6519d",
9696
"Product_Display_Name": "Office 365 Extra File Storage"
97+
},
98+
{
99+
"GUID": "47794cd0-f0e5-45c5-9033-2eb6b5fc84e0",
100+
"Product_Display_Name": "Communications Credits"
97101
}
98102
]

‎Modules/CIPPCore/Public/Add-CIPPApplicationPermission.ps1‎

Lines changed: 78 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,9 @@ function Add-CIPPApplicationPermission {
77
$TenantFilter
88
)
99
if ($ApplicationId -eq $env:ApplicationID -and $TenantFilter -eq $env:TenantID) {
10-
#return @('Cannot modify application permissions for CIPP-SAM on partner tenant')
1110
$RequiredResourceAccess = 'CIPPDefaults'
1211
}
13-
Set-Location (Get-Item $PSScriptRoot).FullName
1412
if ($RequiredResourceAccess -eq 'CIPPDefaults') {
15-
#$RequiredResourceAccess = (Get-Content '.\SAMManifest.json' | ConvertFrom-Json).requiredResourceAccess
1613

1714
$Permissions = Get-CippSamPermissions -NoDiff
1815
$RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
@@ -59,33 +56,72 @@ function Add-CIPPApplicationPermission {
5956
}
6057
}
6158

59+
Write-Information "Adding application permissions to application $ApplicationId in tenant $TenantFilter"
6260

63-
$ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -skipTokenCache $true -tenantid $TenantFilter -NoAuthCheck $true
61+
$ServicePrincipalList = [System.Collections.Generic.List[object]]::new()
62+
$SPList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -skipTokenCache $true -tenantid $TenantFilter -NoAuthCheck $true
63+
foreach ($SP in $SPList) { $ServicePrincipalList.Add($SP) }
6464
$ourSVCPrincipal = $ServicePrincipalList | Where-Object -Property AppId -EQ $ApplicationId
6565
if (!$ourSVCPrincipal) {
6666
#Our Service Principal isn't available yet. We do a sleep and reexecute after 3 seconds.
6767
Start-Sleep -Seconds 5
68-
$ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -skipTokenCache $true -tenantid $TenantFilter -NoAuthCheck $true
68+
$ServicePrincipalList.Clear()
69+
$SPList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -skipTokenCache $true -tenantid $TenantFilter -NoAuthCheck $true
70+
foreach ($SP in $SPList) { $ServicePrincipalList.Add($SP) }
6971
$ourSVCPrincipal = $ServicePrincipalList | Where-Object -Property AppId -EQ $ApplicationId
7072
}
7173

7274
$Results = [System.Collections.Generic.List[string]]::new()
7375

7476
$CurrentRoles = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals/$($ourSVCPrincipal.id)/appRoleAssignments" -tenantid $TenantFilter -skipTokenCache $true -NoAuthCheck $true
7577

76-
$Grants = foreach ($App in $RequiredResourceAccess) {
78+
# Collect missing service principals and prepare bulk request
79+
$MissingServicePrincipals = [System.Collections.Generic.List[object]]::new()
80+
$AppIdToRequestId = @{}
81+
$requestId = 1
82+
83+
foreach ($App in $RequiredResourceAccess) {
7784
$svcPrincipalId = $ServicePrincipalList | Where-Object -Property AppId -EQ $App.resourceAppId
7885
if (!$svcPrincipalId) {
79-
try {
80-
$Body = @{
81-
appId = $App.resourceAppId
82-
} | ConvertTo-Json -Compress
83-
$svcPrincipalId = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals' -tenantid $TenantFilter -body $Body -type POST
84-
} catch {
85-
$Results.add("Failed to create service principal for $($App.resourceAppId): $(Get-NormalizedError -message $_.Exception.Message)")
86-
continue
86+
$Body = @{
87+
appId = $App.resourceAppId
88+
}
89+
$MissingServicePrincipals.Add(@{
90+
id = $requestId.ToString()
91+
method = 'POST'
92+
url = '/servicePrincipals'
93+
headers = @{
94+
'Content-Type' = 'application/json'
95+
}
96+
body = $Body
97+
})
98+
$AppIdToRequestId[$App.resourceAppId] = $requestId.ToString()
99+
$requestId++
100+
}
101+
}
102+
103+
# Create missing service principals in bulk
104+
if ($MissingServicePrincipals.Count -gt 0) {
105+
try {
106+
$BulkResults = New-GraphBulkRequest -Requests $MissingServicePrincipals -tenantid $TenantFilter -NoAuthCheck $true
107+
foreach ($Result in $BulkResults) {
108+
if ($Result.status -eq 201) {
109+
$ServicePrincipalList.Add($Result.body)
110+
} else {
111+
$AppId = ($MissingServicePrincipals | Where-Object { $_.id -eq $Result.id }).body.appId
112+
$Results.add("Failed to create service principal for $($AppId): $($Result.body.error.message)")
113+
}
87114
}
115+
} catch {
116+
$Results.add("Failed to create service principals in bulk: $(Get-NormalizedError -message $_.Exception.Message)")
88117
}
118+
}
119+
120+
# Build grants list
121+
$Grants = foreach ($App in $RequiredResourceAccess) {
122+
$svcPrincipalId = $ServicePrincipalList | Where-Object -Property AppId -EQ $App.resourceAppId
123+
if (!$svcPrincipalId) { continue }
124+
89125
foreach ($SingleResource in $App.ResourceAccess | Where-Object -Property Type -EQ 'Role') {
90126
if ($SingleResource.id -in $CurrentRoles.appRoleId) { continue }
91127
[pscustomobject]@{
@@ -95,14 +131,37 @@ function Add-CIPPApplicationPermission {
95131
}
96132
}
97133
}
134+
135+
# Apply grants in bulk
98136
$counter = 0
99-
foreach ($Grant in $Grants) {
137+
if ($Grants.Count -gt 0) {
138+
$GrantRequests = [System.Collections.Generic.List[object]]::new()
139+
$requestId = 1
140+
foreach ($Grant in $Grants) {
141+
$GrantRequests.Add(@{
142+
id = $requestId.ToString()
143+
method = 'POST'
144+
url = "/servicePrincipals/$($ourSVCPrincipal.id)/appRoleAssignedTo"
145+
headers = @{
146+
'Content-Type' = 'application/json'
147+
}
148+
body = $Grant
149+
})
150+
$requestId++
151+
}
152+
100153
try {
101-
$SettingsRequest = New-GraphPOSTRequest -body (ConvertTo-Json -InputObject $Grant -Depth 5) -uri "https://graph.microsoft.com/beta/servicePrincipals/$($ourSVCPrincipal.id)/appRoleAssignedTo" -tenantid $TenantFilter -type POST -NoAuthCheck $true
102-
$counter++
154+
$BulkResults = New-GraphBulkRequest -Requests $GrantRequests -tenantid $TenantFilter -NoAuthCheck $true
155+
foreach ($Result in $BulkResults) {
156+
if ($Result.status -eq 201) {
157+
$counter++
158+
} else {
159+
$GrantRequest = $GrantRequests | Where-Object { $_.id -eq $Result.id }
160+
$Results.add("Failed to grant $($GrantRequest.body.appRoleId) to $($GrantRequest.body.resourceId): $($Result.body.error.message)")
161+
}
162+
}
103163
} catch {
104-
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
105-
$Results.add("Failed to grant $($Grant.appRoleId) to $($Grant.resourceId): $ErrorMessage")
164+
$Results.add("Failed to grant permissions in bulk: $(Get-NormalizedError -message $_.Exception.Message)")
106165
}
107166
}
108167
"Added $counter Application permissions to $($ourSVCPrincipal.displayName)"

0 commit comments

Comments
 (0)