fix(autopilot): validate profile names early

Add a shared Autopilot profile name validator and use it in both the HTTP endpoint and default deployment profile flow. This catches unsupported Intune characters before submission so the API returns a clear bad request or logged error instead of an opaque service-side 500.

Author: Zacgoose

Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1

@@ -19,6 +19,13 @@ function Set-CIPPDefaultAPDeploymentProfile {
         $APIName = 'Add Default Autopilot Deployment Profile'
     )
 
+    # Checked before the try so the clean message is thrown as-is rather than wrapped by the catch below.
+    $NameCheck = Test-CIPPAutopilotProfileName -DisplayName $DisplayName
+    if (-not $NameCheck.IsValid) {
+        Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $NameCheck.Message -Sev 'Error'
+        throw $NameCheck.Message
+    }
+
     try {
         # Map language selection to Graph API locale values:
         # 'user-select' -> empty string (lets user choose during OOBE)

Modules/CIPPCore/Public/Test-CIPPAutopilotProfileName.ps1

@@ -0,0 +1,32 @@
+function Test-CIPPAutopilotProfileName {
+    <#
+    .SYNOPSIS
+        Validates an Autopilot deployment profile name against the character set Intune accepts.
+    .DESCRIPTION
+        Intune only accepts letters, numbers, spaces and the special characters : " ? . @ $ & _ [ ] { } | \
+        in a deployment profile name. Anything else (a hyphen being the common one) is rejected by the
+        service with a generic 500 that carries no reason, so we check up front to return a usable error.
+        Leading and trailing spaces are allowed.
+    .OUTPUTS
+        PSCustomObject with IsValid and Message properties. Message is empty when the name is valid.
+    #>
+    [CmdletBinding()]
+    param(
+        [string]$DisplayName
+    )
+
+    $AllowedPattern = '^[\p{L}\p{N} :"?.@$&_\[\]{}|\\]+$'
+
+    if ([string]::IsNullOrWhiteSpace($DisplayName)) {
+        $Message = 'Autopilot profile name is required.'
+    } elseif ($DisplayName -notmatch $AllowedPattern) {
+        $Message = 'Autopilot profile name contains characters Intune does not accept. Only letters, numbers, spaces and : " ? . @ $ & _ [ ] { } | \ are allowed.'
+    } else {
+        $Message = ''
+    }
+
+    return [PSCustomObject]@{
+        IsValid = [string]::IsNullOrEmpty($Message)
+        Message = $Message
+    }
+}

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-AddAutopilotConfig.ps1

@@ -12,6 +12,15 @@ function Invoke-AddAutopilotConfig {
     $Headers = $Request.Headers
     $Tenants = $Request.Body.selectedTenants.value
     $Profbod = [pscustomobject]$Request.Body
+
+    $NameCheck = Test-CIPPAutopilotProfileName -DisplayName $Request.Body.DisplayName
+    if (-not $NameCheck.IsValid) {
+        return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::BadRequest
+                Body       = @{'Results' = $NameCheck.Message }
+            })
+    }
+
     $UserType = if ($Profbod.NotLocalAdmin -eq 'true') { 'standard' } else { 'administrator' }
     $DeploymentMode = if ($Profbod.DeploymentMode -eq 'true') { 'shared' } else { 'singleUser' }