add gdap age group option.

Author: KelvinTegelaar

Modules/CIPPCore/Public/TenantGroups/Test-CIPPDynamicGroupFilter.ps1

@@ -27,8 +27,8 @@ function Test-CIPPDynamicGroupFilter {
         [hashtable]$TenantGroupMembersCache = @{}
     )
 
-    $AllowedOperators = @('eq', 'ne', 'like', 'notlike', 'in', 'notin', 'contains', 'notcontains')
-    $AllowedProperties = @('delegatedAccessStatus', 'availableLicense', 'availableServicePlan', 'tenantGroupMember', 'customVariable')
+    $AllowedOperators = @('eq', 'ne', 'like', 'notlike', 'in', 'notin', 'contains', 'notcontains', 'gt', 'ge', 'lt', 'le')
+    $AllowedProperties = @('delegatedAccessStatus', 'availableLicense', 'availableServicePlan', 'tenantGroupMember', 'customVariable', 'gdapRelationshipAge')
 
     # Regex for sanitizing string values - block characters that enable code injection
     $SafeValueRegex = [regex]'^[^;|`\$\{\}\(\)]*$'
@@ -202,6 +202,22 @@ function Test-CIPPDynamicGroupFilter {
                 }
             }
         }
+        'gdapRelationshipAge' {
+            if ($OperatorLower -notin @('eq', 'ne', 'gt', 'ge', 'lt', 'le')) {
+                Write-Warning "Unsupported operator '$OperatorLower' for gdapRelationshipAge"
+                return $null
+            }
+            $RawDays = if ($null -ne $Value.value) { $Value.value } else { $Value }
+            $Days = 0
+            if (-not [int]::TryParse([string]$RawDays, [ref]$Days) -or $Days -lt 0) {
+                Write-Warning "Blocked invalid day count in gdapRelationshipAge rule: '$RawDays'"
+                return $null
+            }
+            # Tenants without an active GDAP relationship have a $null age and never match an
+            # age rule - without the null guard, '$null -lt 14' would be true and direct
+            # tenants would permanently land in every 'younger than' group.
+            return "(`$null -ne `$_.gdapRelationshipAgeDays -and `$_.gdapRelationshipAgeDays -$OperatorLower $Days)"
+        }
         default {
             Write-Warning "Unknown property type: $Property"
             return $null

Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1

@@ -43,6 +43,8 @@ function Update-CIPPDynamicTenantGroups {
         $TotalMembersAdded = 0
         $TotalMembersRemoved = 0
         $GroupsProcessed = 0
+        $GdapAgeByCustomer = $null
+        $GdapFetchAttempted = $false
 
         # Pre-load tenant group memberships for tenantGroupMember rules
         # This creates a cache to avoid repeated table queries during rule evaluation
@@ -69,8 +71,37 @@ function Update-CIPPDynamicTenantGroups {
                 $RequiresLicense = $Rules.property -contains 'availableLicense'
                 $RequiresCustomVariables = $Rules.property -contains 'customVariable'
                 $RequiresServicePlans = $Rules.property -contains 'availableServicePlan'
+                $RequiresGdapAge = $Rules.property -contains 'gdapRelationshipAge'
                 Write-Information "Processing $($Rules.Count) rules for group '$($Group.Name)'"
 
+                if ($RequiresGdapAge) {
+                    if (-not $GdapFetchAttempted) {
+                        $GdapFetchAttempted = $true
+                        try {
+                            $Relationships = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships?`$top=300" -tenantid $env:TenantID -NoAuthCheck $true -ComplexFilter
+                            $Now = (Get-Date).ToUniversalTime()
+                            $AgeMap = @{}
+                            foreach ($Relationship in $Relationships) {
+                                $RelCustomerId = [string]$Relationship.customer.tenantId
+                                if ([string]::IsNullOrEmpty($RelCustomerId) -or -not $Relationship.activatedDateTime) { continue }
+                                if ($Relationship.status -in @('terminated', 'expired')) { continue }
+                                $AgeDays = [int][math]::Floor(($Now - ([datetime]$Relationship.activatedDateTime).ToUniversalTime()).TotalDays)
+                                # Oldest active relationship wins - relationship age should not reset
+                                # when an additional/replacement relationship is accepted later.
+                                if (-not $AgeMap.ContainsKey($RelCustomerId) -or $AgeMap[$RelCustomerId] -lt $AgeDays) {
+                                    $AgeMap[$RelCustomerId] = $AgeDays
+                                }
+                            }
+                            $GdapAgeByCustomer = $AgeMap
+                        } catch {
+                            Write-LogMessage -API 'TenantGroups' -message "Failed to get GDAP relationships for dynamic group evaluation: $((Get-NormalizedError -Message $_.Exception.Message))" -sev Error
+                        }
+                    }
+                    if ($null -eq $GdapAgeByCustomer) {
+                        throw 'Could not retrieve GDAP relationships, skipping this group so existing membership is preserved.'
+                    }
+                }
+
                 $TenantObj = foreach ($Tenant in $AllTenants) {
                     $LicenseInfo = $null
                     $SKUId = @()
@@ -126,6 +157,7 @@ function Update-CIPPDynamicTenantGroups {
                         servicePlans             = $ServicePlans
                         delegatedPrivilegeStatus = $Tenant.delegatedPrivilegeStatus
                         customVariables          = $TenantVariables
+                        gdapRelationshipAgeDays  = if ($GdapAgeByCustomer -and $GdapAgeByCustomer.ContainsKey([string]$Tenant.customerId)) { $GdapAgeByCustomer[[string]$Tenant.customerId] } else { $null }
                     }
                 }
                 # Evaluate rules safely using Test-CIPPDynamicGroupFilter with AND/OR logic

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1

@@ -26,8 +26,8 @@ function Invoke-ExecTenantGroup {
 
     # Validate dynamic rules to prevent code injection
     if ($groupType -eq 'dynamic' -and $dynamicRules) {
-        $AllowedDynamicOperators = @('eq', 'ne', 'like', 'notlike', 'in', 'notin', 'contains', 'notcontains')
-        $AllowedDynamicProperties = @('delegatedAccessStatus', 'availableLicense', 'availableServicePlan', 'tenantGroupMember', 'customVariable')
+        $AllowedDynamicOperators = @('eq', 'ne', 'like', 'notlike', 'in', 'notin', 'contains', 'notcontains', 'gt', 'ge', 'lt', 'le')
+        $AllowedDynamicProperties = @('delegatedAccessStatus', 'availableLicense', 'availableServicePlan', 'tenantGroupMember', 'customVariable', 'gdapRelationshipAge')
         foreach ($rule in $dynamicRules) {
             if ($rule.operator -and $rule.operator.ToLower() -notin $AllowedDynamicOperators) {
                 return ([HttpResponseContext]@{