excluded tenants groups to scheduler and alerts

Synced from CyberDrain/CIPP@f5833a7

Author: github-actions[bot]

Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1

@@ -188,8 +188,15 @@ function Add-CIPPScheduledTask {
                     $task.ScheduledTime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
                 }
             }
-            $excludedTenants = if ($task.excludedTenants.value) {
-                $task.excludedTenants.value -join ','
+            # Split exclusions by type (same pattern as Tenant/TenantGroup): plain tenants are
+            # comma-joined, groups are stored as JSON and expanded at runtime by the orchestrator
+            $ExcludedEntries = @($task.excludedTenants | Where-Object { $_.value })
+            $excludedTenants = @($ExcludedEntries | Where-Object { $_.type -ne 'Group' }).value -join ','
+            $ExcludedGroupEntries = @($ExcludedEntries | Where-Object { $_.type -eq 'Group' } | ForEach-Object {
+                    [PSCustomObject]@{ value = $_.value; label = $_.label; type = 'Group' }
+                })
+            $excludedTenantGroups = if ($ExcludedGroupEntries.Count -gt 0) {
+                ConvertTo-Json -InputObject $ExcludedGroupEntries -Compress -Depth 5
             }
 
             # Handle tenant filter - support both single tenant and tenant groups
@@ -222,6 +229,7 @@ function Add-CIPPScheduledTask {
                 RowKey               = [string]$RowKey
                 Tenant               = [string]$tenantFilter
                 excludedTenants      = [string]$excludedTenants
+                excludedTenantGroups = [string]$excludedTenantGroups
                 Name                 = [string]$task.Name
                 Command              = [string]$RequestedCommand
                 Parameters           = [string]$Parameters

Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-AuditLogIngestion.ps1

@@ -29,7 +29,9 @@ function Start-AuditLogIngestion {
             if (!$ConfigEntry.excludedTenants) {
                 $ConfigEntry | Add-Member -MemberType NoteProperty -Name 'excludedTenants' -Value @() -Force
             } else {
-                $ConfigEntry.excludedTenants = $ConfigEntry.excludedTenants | ConvertFrom-Json
+                # Expand tenant groups in exclusions so group members match on defaultDomainName
+                $Excluded = $ConfigEntry.excludedTenants | ConvertFrom-Json -ErrorAction SilentlyContinue
+                $ConfigEntry.excludedTenants = if ($Excluded) { @(Expand-CIPPTenantGroups -TenantFilter $Excluded) } else { @() }
             }
             $ConfigEntry.Tenants = $ConfigEntry.Tenants | ConvertFrom-Json
             $ConfigEntry

Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-AuditLogSearchCreation.ps1

@@ -15,7 +15,9 @@ function Start-AuditLogSearchCreation {
             if (!$ConfigEntry.excludedTenants) {
                 $ConfigEntry | Add-Member -MemberType NoteProperty -Name 'excludedTenants' -Value @() -Force
             } else {
-                $ConfigEntry.excludedTenants = $ConfigEntry.excludedTenants | ConvertFrom-Json
+                # Expand tenant groups in exclusions so group members match on defaultDomainName
+                $Excluded = $ConfigEntry.excludedTenants | ConvertFrom-Json -ErrorAction SilentlyContinue
+                $ConfigEntry.excludedTenants = if ($Excluded) { @(Expand-CIPPTenantGroups -TenantFilter $Excluded) } else { @() }
             }
             $ConfigEntry.Tenants = $ConfigEntry.Tenants | ConvertFrom-Json
             $ConfigEntry

Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-AuditLogSearchCreationV2.ps1

@@ -25,7 +25,9 @@ function Start-AuditLogSearchCreationV2 {
             if (!$ConfigEntry.excludedTenants) {
                 $ConfigEntry | Add-Member -MemberType NoteProperty -Name 'excludedTenants' -Value @() -Force
             } else {
-                $ConfigEntry.excludedTenants = $ConfigEntry.excludedTenants | ConvertFrom-Json
+                # Expand tenant groups in exclusions so group members match on defaultDomainName
+                $Excluded = $ConfigEntry.excludedTenants | ConvertFrom-Json -ErrorAction SilentlyContinue
+                $ConfigEntry.excludedTenants = if ($Excluded) { @(Expand-CIPPTenantGroups -TenantFilter $Excluded) } else { @() }
             }
             $ConfigEntry.Tenants = $ConfigEntry.Tenants | ConvertFrom-Json
             $ConfigEntry | Add-Member -MemberType NoteProperty -Name 'ExpandedTenants' -Value (Expand-CIPPTenantGroups -TenantFilter ($ConfigEntry.Tenants)).value -Force

Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-UserTasksOrchestrator.ps1

@@ -115,7 +115,14 @@ function Start-UserTasksOrchestrator {
                 }
 
                 if ($task.Tenant -eq 'AllTenants') {
-                    $ExcludedTenants = $task.excludedTenants -split ','
+                    $ExcludedTenants = @($task.excludedTenants -split ',' | Where-Object { $_ })
+                    if ($task.excludedTenantGroups) {
+                        # Expand excluded tenant groups at runtime so membership changes are honored
+                        $ExcludedGroups = $task.excludedTenantGroups | ConvertFrom-Json -ErrorAction SilentlyContinue
+                        if ($ExcludedGroups) {
+                            $ExcludedTenants = @($ExcludedTenants + (Expand-CIPPTenantGroups -TenantFilter $ExcludedGroups).value | Where-Object { $_ })
+                        }
+                    }
                     Write-Host "Excluded Tenants from this task: $ExcludedTenants"
                     $AllTenantCommands = foreach ($Tenant in $TenantList | Where-Object { $_.defaultDomainName -notin $ExcludedTenants }) {
                         $NewParams = $task.Parameters.Clone()
@@ -148,7 +155,14 @@ function Start-UserTasksOrchestrator {
                         # Expand the tenant group to individual tenants
                         $ExpandedTenants = Expand-CIPPTenantGroups -TenantFilter $TenantFilterForExpansion
 
-                        $ExcludedTenants = $task.excludedTenants -split ','
+                        $ExcludedTenants = @($task.excludedTenants -split ',' | Where-Object { $_ })
+                        if ($task.excludedTenantGroups) {
+                            # Expand excluded tenant groups at runtime so membership changes are honored
+                            $ExcludedGroups = $task.excludedTenantGroups | ConvertFrom-Json -ErrorAction SilentlyContinue
+                            if ($ExcludedGroups) {
+                                $ExcludedTenants = @($ExcludedTenants + (Expand-CIPPTenantGroups -TenantFilter $ExcludedGroups).value | Where-Object { $_ })
+                            }
+                        }
                         Write-Host "Excluded Tenants from this task: $ExcludedTenants"
 
                         $GroupTenantCommands = foreach ($ExpandedTenant in $ExpandedTenants | Where-Object { $_.value -notin $ExcludedTenants }) {

Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1

@@ -153,9 +153,14 @@ function Test-CIPPAuditLogRules {
             $ExpandedTenants = Expand-CIPPTenantGroups -TenantFilter $Tenants
             # Check if the TenantFilter matches any tenant in the expanded list or AllTenants
             if ($ExpandedTenants.value -contains $TenantFilter -or $ExpandedTenants.value -contains 'AllTenants') {
+                # Expand tenant groups in exclusions the same way as inclusions
+                $ExcludedTenants = $ConfigEntry.excludedTenants | ConvertFrom-Json -ErrorAction SilentlyContinue
+                if ($ExcludedTenants) {
+                    $ExcludedTenants = @(Expand-CIPPTenantGroups -TenantFilter $ExcludedTenants)
+                }
                 [pscustomobject]@{
                     Tenants       = $Tenants
-                    Excluded      = ($ConfigEntry.excludedTenants | ConvertFrom-Json -ErrorAction SilentlyContinue)
+                    Excluded      = $ExcludedTenants
                     Conditions    = $ConfigEntry.Conditions
                     Actions       = $ConfigEntry.Actions
                     LogType       = $ConfigEntry.Type

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-AddScriptedAlert.ps1

@@ -28,15 +28,19 @@ function Invoke-AddScriptedAlert {
                 $AllTenantsList = Get-Tenants -IncludeErrors
                 $computedExcluded = @($AllTenantsList.defaultDomainName | Where-Object { $_ -notin $targetDomains })
 
-                $existingExcluded = @()
+                $existingEntries = @()
                 if ($Request.Body.PSObject.Properties['excludedTenants'] -and $Request.Body.excludedTenants) {
-                    $existingExcluded = @($Request.Body.excludedTenants | ForEach-Object { $_.value ?? $_ })
+                    $existingEntries = @($Request.Body.excludedTenants)
                 }
+                # Keep user-picked groups as typed objects so Add-CIPPScheduledTask stores them
+                # for runtime expansion instead of flattening them into the domain list
+                $excludedGroupEntries = @($existingEntries | Where-Object { $_.type -eq 'Group' })
+                $existingExcluded = @($existingEntries | Where-Object { $_.type -ne 'Group' } | ForEach-Object { $_.value ?? $_ })
                 $mergedExcluded = @($existingExcluded + $computedExcluded) | Where-Object { $_ } | Select-Object -Unique
 
                 $excludedValue = @($mergedExcluded | ForEach-Object {
                         [PSCustomObject]@{ value = $_; label = $_ }
-                    })
+                    }) + $excludedGroupEntries
                 $Request.Body | Add-Member -MemberType NoteProperty -Name 'excludedTenants' -Value $excludedValue -Force
             }
 

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAlertsQueue.ps1

@@ -89,6 +89,14 @@ function Invoke-ListAlertsQueue {
         } else {
             $ExcludedTenants = @()
         }
+        # Excluded tenant groups are stored separately as JSON — surface them as objects so the
+        # frontend renders a single named chip and can round-trip the group on edit
+        if ($Task.excludedTenantGroups) {
+            $ExcludedGroups = @($Task.excludedTenantGroups | ConvertFrom-Json -ErrorAction SilentlyContinue)
+            if ($ExcludedGroups) {
+                $ExcludedTenants = @($ExcludedTenants + $ExcludedGroups)
+            }
+        }
 
         # Handle tenant display information for alerts
         $TenantsForDisplay = @()