fix(auditlogs): treat token denial as disable

Detect AADSTS7000229 token-acquisition failures in audit search creation and classify them as `AccessDenied` instead of generic transient errors. Update the webhook flow to handle `AccessDenied` like `AuditingDisabled`: cache the tenant in `AuditLogDisabledTenants` for 24 hours, stop further processing in the cycle, and defer remaining windows with a consistent bail reason.

Author: Zacgoose

Modules/CIPPCore/Public/AuditLogs/New-CippAuditLogSearchV2.ps1

@@ -16,7 +16,7 @@ function New-CippAuditLogSearchV2 {
     .PARAMETER RecordTypeFilters
         Record types to capture. Defaults to the four the V1 pipeline used.
     .OUTPUTS
-        [pscustomobject]@{ Id; Status; Outcome; Message }  Outcome in 'Created','AuditingDisabled','Transient'.
+        [pscustomobject]@{ Id; Status; Outcome; Message }  Outcome in 'Created','AuditingDisabled','AccessDenied','Transient'.
     .FUNCTIONALITY
         Internal
     #>
@@ -50,6 +50,15 @@ function New-CippAuditLogSearchV2 {
             $Raw = $_.Exception.Data['RawErrorBody']
             if (-not $Raw) { $Raw = $_.ErrorDetails.Message }
             if (-not $Raw) { $Raw = $_.Exception.Message }
+
+            # Token-acquisition failures that mean we cannot access the tenant at all (e.g.
+            # AADSTS7000229 = CIPP's service principal is missing from the tenant). These arrive as a
+            # plain "Could not get token: ..." string from Get-GraphToken, not JSON, and won't clear
+            # on retry - the caller disables the tenant for 24h, same as AuditingDisabled.
+            if ([string]$Raw -match 'AADSTS7000229') {
+                return [pscustomobject]@{ Id = $null; Status = 'MissingServicePrincipal'; Outcome = 'AccessDenied'; Message = [string]$Raw; Throttled = $false }
+            }
+
             $Parsed = $null
             if ($Raw) { try { $Parsed = ([string]$Raw) | ConvertFrom-Json -ErrorAction Stop } catch {} }
 

Modules/CIPPCore/Public/Webhooks/Push-AuditLogSearchCreationV2.ps1

@@ -14,7 +14,8 @@ function Push-AuditLogSearchCreationV2 {
            limit, so on a 429 we stop and defer the current window AND all remaining queued windows to
            the next cycle (no Attempts increment - a cap is not a failure, so it never dead-letters).
            Other transient errors (UnknownError, 5xx, gateway) retry the individual window with backoff
-           and dead-letter at MaxAttempts. AuditingDisabled caches the tenant for 24h and stops.
+           and dead-letter at MaxAttempts. AuditingDisabled and AccessDenied (token failure - e.g.
+           AADSTS7000229 missing service principal) cache the tenant as disabled for 24h and stop.
 
         Capping at 6/cycle keeps us well under the ~10 concurrent-search ceiling (they complete within
         the cycle and free slots). Oldest-first means gaps/backlog/reconciliation drain before the
@@ -77,15 +78,17 @@ function Push-AuditLogSearchCreationV2 {
             $Batch = @($Due | Select-Object -First $MaxPerCycle)
         }
 
-        # 3) Create searches (no auto-retry). On 429, defer current + remaining to next cycle.
+        # 3) Create searches (no auto-retry). On 429 or a tenant-level disable, defer current +
+        #    remaining to next cycle.
         $Bail = $false
+        $BailReason = ''
         foreach ($Row in $Batch) {
             if ($Bail) {
                 # Deferred (not attempted): just set NextAttemptUtc, leave Attempts/State as Planned.
                 Add-CIPPAzDataTableEntity @Ledger -Entity @{
                     PartitionKey = $TenantFilter; RowKey = $Row.RowKey; State = 'Planned'
                     NextAttemptUtc = (Get-CippAuditLogNextAttempt -Attempts 1)
-                    ThrottleCount = ([int]$Row.ThrottleCount + 1); LastError = 'Deferred: tenant search cap (429)'; LastErrorUtc = $Now
+                    ThrottleCount = ([int]$Row.ThrottleCount + 1); LastError = $BailReason; LastErrorUtc = $Now
                 } -OperationType UpsertMerge
                 continue
             }
@@ -105,23 +108,29 @@ function Push-AuditLogSearchCreationV2 {
             } elseif ($Result.Throttled) {
                 # 429 = tenant cap full. Defer this window (no Attempts bump - a cap isn't a failure) and bail.
                 $Bail = $true
+                $BailReason = 'Deferred: tenant search cap (429)'
                 Add-CIPPAzDataTableEntity @Ledger -Entity @{
                     PartitionKey = $TenantFilter; RowKey = $Row.RowKey; State = 'Planned'
                     NextAttemptUtc = (Get-CippAuditLogNextAttempt -Attempts 1)
                     ThrottleCount = ([int]$Row.ThrottleCount + 1); LastError = 'Tenant search cap (429)'; LastErrorUtc = $Now
                 } -OperationType UpsertMerge
                 Write-Information "AuditLogV2: 429 for $TenantFilter - deferring this + remaining windows to next cycle"
-            } elseif ($Result.Outcome -eq 'AuditingDisabled') {
+            } elseif ($Result.Outcome -eq 'AuditingDisabled' -or $Result.Outcome -eq 'AccessDenied') {
+                # AuditingDisabled = unified auditing off; AccessDenied = we can't get a token for the
+                # tenant at all (e.g. missing service principal). Either way: disable for 24h and stop.
                 $Bail = $true
+                $BailReason = 'Deferred: tenant audit log collection disabled'
+                $DisableStatus = if ($Result.Outcome -eq 'AccessDenied') { [string]$Result.Status } else { 'AuditingDisabledTenant' }
+                $LedgerError = if ($Result.Message) { [string]$Result.Message } else { $DisableStatus }
                 try {
                     $AuditDisabledTable = Get-CIPPTable -TableName 'AuditLogDisabledTenants'
                     Add-CIPPAzDataTableEntity @AuditDisabledTable -Entity @{
                         PartitionKey = 'AuditDisabledTenant'; RowKey = [string]$TenantFilter; TenantFilter = [string]$TenantFilter
-                        Status = 'AuditingDisabledTenant'; ExpiresAtUnix = [int64]([datetimeoffset]::UtcNow.AddHours(24).ToUnixTimeSeconds())
+                        Status = $DisableStatus; ExpiresAtUnix = [int64]([datetimeoffset]::UtcNow.AddHours(24).ToUnixTimeSeconds())
                     } -Force
                 } catch {}
-                Add-CIPPAzDataTableEntity @Ledger -Entity @{ PartitionKey = $TenantFilter; RowKey = $Row.RowKey; State = 'Skipped'; LastError = 'AuditingDisabledTenant'; LastErrorUtc = $Now } -OperationType UpsertMerge
-                Write-Information "AuditLogV2: auditing disabled for $TenantFilter; skipping"
+                Add-CIPPAzDataTableEntity @Ledger -Entity @{ PartitionKey = $TenantFilter; RowKey = $Row.RowKey; State = 'Skipped'; LastError = $LedgerError; LastErrorUtc = $Now } -OperationType UpsertMerge
+                Write-Information "AuditLogV2: $DisableStatus for $TenantFilter; disabled for 24h"
             } else {
                 # Other transient: retry this window next cycle; dead-letter at cap.
                 $RetryTotal = [int]$Row.RetryCount + 1