fix(standards): default untoggled Teams switches to $false instead of sending null

Zacgoose · Zacgoose · commit f4dd2a7727ce · 2026-07-20T12:51:12.000+08:00
Untoggled "switch" inputs are omitted from a standard's settings, so
TeamsGlobalMeetingPolicy, TeamsExternalFileSharing, and
TeamsFederationConfiguration serialized null booleans to the Teams
ConfigApi, which rejects the write with 400 "Error converting value
{null} to type 'System.Boolean'". The null also poisoned the
$StateIsCorrect comparison ($CurrentState.X -eq $null is never true),
so affected tenants reported non-compliant and failed remediation on
every run.

Coalesce each switch to $false (the CIS recommended value, matching the
convention in TeamsExternalAccessPolicy/TeamsGuestAccess/
TeamsEmailIntegration) and use the coalesced variable in the state
comparison, remediation payload, and report expected values. In
TeamsExternalFileSharing the existing "?? $false" was dead code because
-eq binds tighter than ??.
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1
@@ -58,23 +58,30 @@ function Invoke-CIPPStandardTeamsExternalFileSharing {
         return
     }
 
-    $StateIsCorrect = ($CurrentState.AllowGoogleDrive -eq $Settings.AllowGoogleDrive ?? $false ) -and
-    ($CurrentState.AllowShareFile -eq $Settings.AllowShareFile ?? $false ) -and
-    ($CurrentState.AllowBox -eq $Settings.AllowBox ?? $false ) -and
-    ($CurrentState.AllowDropBox -eq $Settings.AllowDropBox ?? $false ) -and
-    ($CurrentState.AllowEgnyte -eq $Settings.AllowEgnyte ?? $false )
+    # Untoggled switches are absent from the settings; default them to $false so we never send null to the ConfigApi
+    $AllowGoogleDrive = $Settings.AllowGoogleDrive ?? $false
+    $AllowShareFile = $Settings.AllowShareFile ?? $false
+    $AllowBox = $Settings.AllowBox ?? $false
+    $AllowDropBox = $Settings.AllowDropBox ?? $false
+    $AllowEgnyte = $Settings.AllowEgnyte ?? $false
+
+    $StateIsCorrect = ($CurrentState.AllowGoogleDrive -eq $AllowGoogleDrive) -and
+    ($CurrentState.AllowShareFile -eq $AllowShareFile) -and
+    ($CurrentState.AllowBox -eq $AllowBox) -and
+    ($CurrentState.AllowDropBox -eq $AllowDropBox) -and
+    ($CurrentState.AllowEgnyte -eq $AllowEgnyte)
 
     if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Teams External File Sharing already set.' -sev Info
         } else {
             $cmdParams = @{
                 Identity         = 'Global'
-                AllowGoogleDrive = $Settings.AllowGoogleDrive
-                AllowShareFile   = $Settings.AllowShareFile
-                AllowBox         = $Settings.AllowBox
-                AllowDropBox     = $Settings.AllowDropBox
-                AllowEgnyte      = $Settings.AllowEgnyte
+                AllowGoogleDrive = $AllowGoogleDrive
+                AllowShareFile   = $AllowShareFile
+                AllowBox         = $AllowBox
+                AllowDropBox     = $AllowDropBox
+                AllowEgnyte      = $AllowEgnyte
             }
 
             try {
@@ -107,11 +114,11 @@ function Invoke-CIPPStandardTeamsExternalFileSharing {
             AllowEgnyte      = $CurrentState.AllowEgnyte
         }
         $ExpectedValue = @{
-            AllowGoogleDrive = $Settings.AllowGoogleDrive
-            AllowShareFile   = $Settings.AllowShareFile
-            AllowBox         = $Settings.AllowBox
-            AllowDropBox     = $Settings.AllowDropBox
-            AllowEgnyte      = $Settings.AllowEgnyte
+            AllowGoogleDrive = $AllowGoogleDrive
+            AllowShareFile   = $AllowShareFile
+            AllowBox         = $AllowBox
+            AllowDropBox     = $AllowDropBox
+            AllowEgnyte      = $AllowEgnyte
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.TeamsExternalFileSharing' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1
@@ -58,6 +58,8 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
     #   Allow specific external -> AllowedDomains = @{ AllowList = @(list) }
     #   Block specific external -> AllowedDomains = @{ AllowList = @() } + BlockedDomains = @(list)
     $DomainControl = $Settings.DomainControl.value ?? $Settings.DomainControl
+    # An untoggled switch is absent from the settings; default it to $false so we never send null to the ConfigApi
+    $AllowTeamsConsumer = $Settings.AllowTeamsConsumer ?? $false
     $AllowedDomainsAsAList = @()
     $BlockedDomains = @()
     switch ($DomainControl) {
@@ -137,7 +139,7 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
 
     $ExpectedBlockedDomains = $BlockedDomains ?? @()
 
-    $StateIsCorrect = ($CurrentState.AllowTeamsConsumer -eq $Settings.AllowTeamsConsumer) -and
+    $StateIsCorrect = ($CurrentState.AllowTeamsConsumer -eq $AllowTeamsConsumer) -and
     ($CurrentState.AllowFederatedUsers -eq $AllowFederatedUsers) -and
     $AllowedDomainsMatches -and
     $BlockedDomainsMatches
@@ -148,7 +150,7 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
         } else {
             $cmdParams = @{
                 Identity            = 'Global'
-                AllowTeamsConsumer  = $Settings.AllowTeamsConsumer
+                AllowTeamsConsumer  = $AllowTeamsConsumer
                 AllowFederatedUsers = $AllowFederatedUsers
                 AllowedDomains      = $AllowedDomainsPayload
                 BlockedDomains      = @($BlockedDomains)
@@ -214,7 +216,7 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
             BlockedDomains      = $CurrentBlockedDomainsForReport
         }
         $ExpectedValue = @{
-            AllowTeamsConsumer  = $Settings.AllowTeamsConsumer
+            AllowTeamsConsumer  = $AllowTeamsConsumer
             AllowFederatedUsers = $AllowFederatedUsers
             AllowedDomains      = $ExpectedAllowedDomainsForReport
             BlockedDomains      = $ExpectedBlockedDomainsForReport
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1
@@ -69,14 +69,21 @@ function Invoke-CIPPStandardTeamsGlobalMeetingPolicy {
     $DesignatedPresenterRoleMode = $Settings.DesignatedPresenterRoleMode.value ?? $Settings.DesignatedPresenterRoleMode
     $AutoAdmittedUsers = $Settings.AutoAdmittedUsers.value ?? $Settings.AutoAdmittedUsers ?? $CurrentState.AutoAdmittedUsers # Default to current state if not set, for backward compatibility pre v8.6.0
 
-    $StateIsCorrect = ($CurrentState.AllowAnonymousUsersToJoinMeeting -eq $Settings.AllowAnonymousUsersToJoinMeeting) -and
-    ($CurrentState.AllowAnonymousUsersToStartMeeting -eq $Settings.AllowAnonymousUsersToStartMeeting) -and
+    # Untoggled switches are absent from the settings; default them to $false (the CIS recommended value) so we never send null to the ConfigApi
+    $AllowAnonymousUsersToJoinMeeting = $Settings.AllowAnonymousUsersToJoinMeeting ?? $false
+    $AllowAnonymousUsersToStartMeeting = $Settings.AllowAnonymousUsersToStartMeeting ?? $false
+    $AllowPSTNUsersToBypassLobby = $Settings.AllowPSTNUsersToBypassLobby ?? $false
+    $AllowExternalParticipantGiveRequestControl = $Settings.AllowExternalParticipantGiveRequestControl ?? $false
+    $AllowParticipantGiveRequestControl = $Settings.AllowParticipantGiveRequestControl ?? $false
+
+    $StateIsCorrect = ($CurrentState.AllowAnonymousUsersToJoinMeeting -eq $AllowAnonymousUsersToJoinMeeting) -and
+    ($CurrentState.AllowAnonymousUsersToStartMeeting -eq $AllowAnonymousUsersToStartMeeting) -and
     ($CurrentState.AutoAdmittedUsers -eq $AutoAdmittedUsers) -and
-    ($CurrentState.AllowPSTNUsersToBypassLobby -eq $Settings.AllowPSTNUsersToBypassLobby) -and
+    ($CurrentState.AllowPSTNUsersToBypassLobby -eq $AllowPSTNUsersToBypassLobby) -and
     ($CurrentState.MeetingChatEnabledType -eq $MeetingChatEnabledType) -and
     ($CurrentState.DesignatedPresenterRoleMode -eq $DesignatedPresenterRoleMode) -and
-    ($CurrentState.AllowExternalParticipantGiveRequestControl -eq $Settings.AllowExternalParticipantGiveRequestControl) -and
-    ($CurrentState.AllowParticipantGiveRequestControl -eq $Settings.AllowParticipantGiveRequestControl)
+    ($CurrentState.AllowExternalParticipantGiveRequestControl -eq $AllowExternalParticipantGiveRequestControl) -and
+    ($CurrentState.AllowParticipantGiveRequestControl -eq $AllowParticipantGiveRequestControl)
 
 
     if ($Settings.remediate -eq $true) {
@@ -85,14 +92,14 @@ function Invoke-CIPPStandardTeamsGlobalMeetingPolicy {
         } else {
             $cmdParams = @{
                 Identity                                   = 'Global'
-                AllowAnonymousUsersToJoinMeeting           = $Settings.AllowAnonymousUsersToJoinMeeting
-                AllowAnonymousUsersToStartMeeting          = $Settings.AllowAnonymousUsersToStartMeeting
+                AllowAnonymousUsersToJoinMeeting           = $AllowAnonymousUsersToJoinMeeting
+                AllowAnonymousUsersToStartMeeting          = $AllowAnonymousUsersToStartMeeting
                 AutoAdmittedUsers                          = $AutoAdmittedUsers
-                AllowPSTNUsersToBypassLobby                = $Settings.AllowPSTNUsersToBypassLobby
+                AllowPSTNUsersToBypassLobby                = $AllowPSTNUsersToBypassLobby
                 MeetingChatEnabledType                     = $MeetingChatEnabledType
                 DesignatedPresenterRoleMode                = $DesignatedPresenterRoleMode
-                AllowExternalParticipantGiveRequestControl = $Settings.AllowExternalParticipantGiveRequestControl
-                AllowParticipantGiveRequestControl         = $Settings.AllowParticipantGiveRequestControl
+                AllowExternalParticipantGiveRequestControl = $AllowExternalParticipantGiveRequestControl
+                AllowParticipantGiveRequestControl         = $AllowParticipantGiveRequestControl
             }
 
             try {
@@ -127,14 +134,14 @@ function Invoke-CIPPStandardTeamsGlobalMeetingPolicy {
             AllowParticipantGiveRequestControl         = $CurrentState.AllowParticipantGiveRequestControl
         }
         $ExpectedValue = @{
-            AllowAnonymousUsersToJoinMeeting           = $Settings.AllowAnonymousUsersToJoinMeeting
-            AllowAnonymousUsersToStartMeeting          = $Settings.AllowAnonymousUsersToStartMeeting
+            AllowAnonymousUsersToJoinMeeting           = $AllowAnonymousUsersToJoinMeeting
+            AllowAnonymousUsersToStartMeeting          = $AllowAnonymousUsersToStartMeeting
             AutoAdmittedUsers                          = $AutoAdmittedUsers
-            AllowPSTNUsersToBypassLobby                = $Settings.AllowPSTNUsersToBypassLobby
+            AllowPSTNUsersToBypassLobby                = $AllowPSTNUsersToBypassLobby
             MeetingChatEnabledType                     = $MeetingChatEnabledType
             DesignatedPresenterRoleMode                = $DesignatedPresenterRoleMode
-            AllowExternalParticipantGiveRequestControl = $Settings.AllowExternalParticipantGiveRequestControl
-            AllowParticipantGiveRequestControl         = $Settings.AllowParticipantGiveRequestControl
+            AllowExternalParticipantGiveRequestControl = $AllowExternalParticipantGiveRequestControl
+            AllowParticipantGiveRequestControl         = $AllowParticipantGiveRequestControl
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.TeamsGlobalMeetingPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'TeamsGlobalMeetingPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
