Skip to content

Commit 8789480

Browse files
KelvinTegelaarKelvinTegelaar
authored
Merge pull request KelvinTegelaar#1240 from KelvinTegelaar/dev
Dev to hf
2 parents fd6c112 + cecd2d5 commit 8789480

18 files changed

+730
-176
lines changed

Diff for: ‎.github/workflows/dev_cippbcaom.yml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Docs for the Azure Web Apps Deploy action: https://github.com/azure/functions-action
2+
# More GitHub Actions for Azure: https://github.com/Azure/actions
3+
4+
name: Build and deploy Powershell project to Azure Function App - cippbcaom
5+
6+
on:
7+
push:
8+
branches:
9+
- dev
10+
workflow_dispatch:
11+
12+
env:
13+
AZURE_FUNCTIONAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root
14+
15+
jobs:
16+
deploy:
17+
runs-on: windows-latest
18+
19+
steps:
20+
- name: 'Checkout GitHub Action'
21+
uses: actions/checkout@v4
22+
23+
- name: 'Run Azure Functions Action'
24+
uses: Azure/functions-action@v1
25+
id: fa
26+
with:
27+
app-name: 'cippbcaom'
28+
slot-name: 'Production'
29+
package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
30+
publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_56AD4FDD49354D0CAB4D9A9E868D2015 }}

Diff for: ‎ConversionTable.csv

+153-34
Large diffs are not rendered by default.

Diff for: ‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertMFAAdmins.ps1

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ function Get-CIPPAlertMFAAdmins {
1818
}
1919
}
2020
if (!$DuoActive) {
21-
$users = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?$top=999&$filter=IsAdmin eq true and userDisplayName ne ''On-Premises Directory Synchronization Service Account''' -tenantid $($TenantFilter) | Where-Object -Property 'isMfaRegistered' -EQ $false
21+
$users = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?`$top=999&filter=IsAdmin eq true and isMfaRegistered eq false and userType eq 'member'&`$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered,IsAdmin" -tenantid $($TenantFilter) | Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' }
2222
if ($users.UserPrincipalName) {
2323
$AlertData = "The following admins do not have MFA registered: $($users.UserPrincipalName -join ', ')"
2424
Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData

Diff for: ‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertMFAAlertUsers.ps1

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ function Get-CIPPAlertMFAAlertUsers {
1212
)
1313
try {
1414

15-
$users = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?$top=999&filter=isMfaRegistered eq false and userType eq ''member'' and userDisplayName ne ''On-Premises Directory Synchronization Service Account''&$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered' -tenantid $($TenantFilter)
15+
$users = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?`$top=999&filter=IsAdmin eq false and isMfaRegistered eq false and userType eq 'member'&`$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered,IsAdmin" -tenantid $($TenantFilter) | Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' }
1616
if ($users.UserPrincipalName) {
1717
$AlertData = "The following $($users.Count) users do not have MFA registered: $($users.UserPrincipalName -join ', ')"
1818
Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData

Diff for: ‎Modules/CIPPCore/Public/ConversionTable.csv

+153-34
Large diffs are not rendered by default.

Diff for: ‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Webhooks/Push-AuditLogTenant.ps1

+9-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,15 @@ function Push-AuditLogTenant {
2626
}
2727
$CIPPURL = $LegacyUrl
2828
} else {
29-
$CIPPURL = 'https://{0}' -f $CippConfig.Value
29+
if (!$CippConfig) {
30+
$CippConfig = @{
31+
PartitionKey = 'InstanceProperties'
32+
RowKey = 'CIPPURL'
33+
Value = [string]([System.Uri]$Request.Headers.'x-ms-original-url').Host
34+
}
35+
Add-AzDataTableEntity @ConfigTable -Entity $CippConfig -Force
36+
$CIPPURL = 'https://{0}' -f $CippConfig.Value
37+
} else { $CIPPURL = 'https://{0}' -f $CippConfig.Value }
3038
}
3139

3240
# Get webhook rules

Diff for: ‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroupTemplate.ps1

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Function Invoke-AddGroupTemplate {
2020
Displayname = $request.body.displayname
2121
Description = $request.body.description
2222
groupType = $request.body.groupType
23-
MembershipRules = $request.body.membershipRule
23+
MembershipRules = $request.body.membershipRules
2424
allowExternal = $request.body.allowExternal
2525
username = $request.body.username
2626
GUID = $GUID

Diff for: ‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSharePointMember.ps1

+12-4
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,21 @@ Function Invoke-ExecSetSharePointMember {
1010
[CmdletBinding()]
1111
param($Request, $TriggerMetadata)
1212

13+
14+
$APIName = $TriggerMetadata.FunctionName
15+
$ExecutingUser = $request.headers.'x-ms-client-principal'
16+
Write-LogMessage -user $ExecutingUser -API $APINAME -message 'Accessed this API' -Sev 'Debug'
17+
$TenantFilter = $Request.body.tenantFilter
18+
19+
20+
1321
if ($Request.body.SharePointType -eq 'Group') {
14-
$GroupId = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=mail eq '$($Request.Body.GroupID)' or proxyAddresses/any(x:endsWith(x,'$($Request.Body.GroupID)'))&`$count=true" -ComplexFilter -tenantid $Request.Body.TenantFilter).id
22+
$GroupId = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=mail eq '$($Request.Body.GroupID)' or proxyAddresses/any(x:endsWith(x,'$($Request.Body.GroupID)'))&`$count=true" -ComplexFilter -tenantid $TenantFilter).id
1523
if ($Request.body.Add -eq $true) {
16-
$Results = Add-CIPPGroupMember -GroupType 'Team' -GroupID $GroupID -Member $Request.Body.user.value -TenantFilter $Request.Body.TenantFilter -ExecutingUser $request.headers.'x-ms-client-principal'
24+
$Results = Add-CIPPGroupMember -GroupType 'Team' -GroupID $GroupID -Member $Request.Body.user.value -TenantFilter $TenantFilter -ExecutingUser $ExecutingUser
1725
} else {
18-
$UserID = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($Request.Body.user.value)" -tenantid $Request.Body.TenantFilter).id
19-
$Results = Remove-CIPPGroupMember -GroupType 'Team' -GroupID $GroupID -Member $UserID -TenantFilter $Request.Body.TenantFilter -ExecutingUser $request.headers.'x-ms-client-principal'
26+
$UserID = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($Request.Body.user.value)" -tenantid $TenantFilter).id
27+
$Results = Remove-CIPPGroupMember -GroupType 'Team' -GroupID $GroupID -Member $UserID -TenantFilter $TenantFilter -ExecutingUser $ExecutingUser
2028
}
2129
} else {
2230
$Results = 'This type of SharePoint site is not supported.'

Diff for: ‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSharePointPerms.ps1

+23-4
Original file line numberDiff line numberDiff line change
@@ -11,17 +11,36 @@ Function Invoke-ExecSharePointPerms {
1111
param($Request, $TriggerMetadata)
1212

1313
$APIName = $TriggerMetadata.FunctionName
14-
$tenantFilter = $Request.Body.TenantFilter
14+
$tenantFilter = $Request.Body.tenantFilter
15+
$ExecutingUser = $Request.Headers.'x-ms-client-principal'
16+
17+
Write-LogMessage -user $ExecutingUser -API $APIName -message 'Accessed this API' -Sev Debug
18+
19+
# The UPN or ID of the users OneDrive we are changing permissions on
20+
$UserId = $Request.body.UPN
21+
# The UPN of the user we are adding or removing permissions for
22+
$OnedriveAccessUser = $Request.body.onedriveAccessUser.value
23+
1524
try {
16-
$State = Set-CIPPSharePointPerms -tenantFilter $tenantFilter -userid $request.body.UPN -OnedriveAccessUser $request.body.input -ExecutingUser $ExecutingUser -APIName $APIName -RemovePermission $request.body.RemovePermission -URL $Request.Body.URL
25+
26+
$State = Set-CIPPSharePointPerms -tenantFilter $tenantFilter `
27+
-UserId $UserId `
28+
-OnedriveAccessUser $OnedriveAccessUser `
29+
-ExecutingUser $ExecutingUser `
30+
-APIName $APIName `
31+
-RemovePermission $Request.body.RemovePermission `
32+
-URL $Request.Body.URL
1733
$Results = [pscustomobject]@{'Results' = "$State" }
34+
$StatusCode = [HttpStatusCode]::OK
1835
} catch {
19-
$Results = [pscustomobject]@{'Results' = "Failed. $($_.Exception.Message)" }
36+
$ErrorMessage = Get-CippException -Exception $_
37+
$Results = [pscustomobject]@{'Results' = "Failed. $($ErrorMessage.NormalizedError)" }
38+
$StatusCode = [HttpStatusCode]::BadRequest
2039
}
2140

2241
# Associate values to output bindings by calling 'Push-OutputBinding'.
2342
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
24-
StatusCode = [HttpStatusCode]::OK
43+
StatusCode = $StatusCode
2544
Body = $Results
2645
})
2746

Diff for: ‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamsVoicePhoneNumberAssignment.ps1

+14-10
Original file line numberDiff line numberDiff line change
@@ -11,26 +11,30 @@ Function Invoke-ExecTeamsVoicePhoneNumberAssignment {
1111
param($Request, $TriggerMetadata)
1212

1313
$APIName = $TriggerMetadata.FunctionName
14-
Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message 'Accessed this API' -Sev 'Debug'
14+
$ExecutingUser = $Request.headers.'x-ms-client-principal'
15+
Write-LogMessage -user $ExecutingUser -API $APINAME -message 'Accessed this API' -Sev 'Debug'
16+
$Identity = $Request.Body.input.value
1517

1618
$tenantFilter = $Request.Body.TenantFilter
1719
try {
1820
if ($Request.Body.locationOnly) {
19-
$null = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsPhoneNumberAssignment' -CmdParams @{LocationId = $Request.Body.input; PhoneNumber = $Request.Body.PhoneNumber; ErrorAction = 'stop'}
20-
$Results = [pscustomobject]@{'Results' = "Successfully assigned emergency location to $($Request.Body.PhoneNumber)"}
21+
$null = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsPhoneNumberAssignment' -CmdParams @{LocationId = $Identity; PhoneNumber = $Request.Body.PhoneNumber; ErrorAction = 'stop' }
22+
$Results = [pscustomobject]@{'Results' = "Successfully assigned emergency location to $($Request.Body.PhoneNumber)" }
2123
} else {
22-
$null = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsPhoneNumberAssignment' -CmdParams @{Identity = $Request.Body.input; PhoneNumber = $Request.Body.PhoneNumber; PhoneNumberType = $Request.Body.PhoneNumberType; ErrorAction = 'stop'}
23-
$Results = [pscustomobject]@{'Results' = "Successfully assigned $($Request.Body.PhoneNumber) to $($Request.Body.input)"}
24+
$null = New-TeamsRequest -TenantFilter $TenantFilter -Cmdlet 'Set-CsPhoneNumberAssignment' -CmdParams @{Identity = $Identity; PhoneNumber = $Request.Body.PhoneNumber; PhoneNumberType = $Request.Body.PhoneNumberType; ErrorAction = 'stop' }
25+
$Results = [pscustomobject]@{'Results' = "Successfully assigned $($Request.Body.PhoneNumber) to $($Identity)" }
2426
}
25-
Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($TenantFilter) -message $($Results.Results) -Sev 'Info'
27+
Write-LogMessage -user $ExecutingUser -API $APINAME -tenant $($TenantFilter) -message $($Results.Results) -Sev Info
28+
$StatusCode = [HttpStatusCode]::OK
2629
} catch {
27-
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
28-
$Results = [pscustomobject]@{'Results' = $ErrorMessage}
29-
Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($TenantFilter) -message $($Results.Results) -Sev 'Error'
30+
$ErrorMessage = Get-CippException -Exception $_
31+
$Results = [pscustomobject]@{'Results' = $ErrorMessage.NormalizedError }
32+
Write-LogMessage -user $ExecutingUser -API $APINAME -tenant $($TenantFilter) -message $($Results.Results) -Sev Error -LogData $ErrorMessage
33+
$StatusCode = [HttpStatusCode]::Forbidden
3034
}
3135
# Associate values to output bindings by calling 'Push-OutputBinding'.
3236
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
33-
StatusCode = [HttpStatusCode]::OK
37+
StatusCode = $StatusCode
3438
Body = $Results
3539
})
3640
}

Diff for: ‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecNamedLocation.ps1

+4-4
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@ Function Invoke-ExecNamedLocation {
1717
# Write to the Azure Functions log stream.
1818
Write-Host 'PowerShell HTTP trigger function processed a request.'
1919

20-
$TenantFilter = $Request.Body.TenantFilter
21-
$NamedLocationId = $Request.Body.NamedLocationId
22-
$change = $Request.Body.change
23-
$content = $Request.Body.input
20+
$TenantFilter = $Request.Body.TenantFilter ?? $Request.Query.TenantFilter
21+
$NamedLocationId = $Request.Body.NamedLocationId ?? $Request.Query.NamedLocationId
22+
$change = $Request.Body.change ?? $Request.Query.change
23+
$content = $Request.Body.input ?? $Request.Query.input
2424

2525
try {
2626
$results = Set-CIPPNamedLocation -NamedLocationId $NamedLocationId -TenantFilter $TenantFilter -change $change -content $content -ExecutingUser $request.headers.'x-ms-client-principal'

Diff for: ‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1

+8-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,14 @@ Function Invoke-listStandardTemplates {
1313
$Table = Get-CippTable -tablename 'templates'
1414
$Filter = "PartitionKey eq 'StandardsTemplateV2'"
1515
$Templates = (Get-CIPPAzDataTableEntity @Table -Filter $Filter) | ForEach-Object {
16-
$data = $_.JSON | ConvertFrom-Json -Depth 100 -ErrorAction SilentlyContinue
16+
$JSON = $_.JSON
17+
try {
18+
$data = $_.JSON | ConvertFrom-Json -Depth 100 -ErrorAction SilentlyContinue
19+
} catch {
20+
Write-Host "Could not load standard template: $($_.Exception.Message). Content of the template is: $($JSON)."
21+
Write-Host "Template GUID: $($_.GUID)"
22+
return
23+
}
1724
$data | Add-Member -NotePropertyName 'GUID' -NotePropertyValue $_.GUID -Force
1825
if ($data.excludedTenants) { $data.excludedTenants = @($data.excludedTenants) }
1926
$data

Diff for: ‎Modules/CIPPCore/Public/Invoke-CIPPOffboardingJob.ps1

+5-5
Original file line numberDiff line numberDiff line change
@@ -35,21 +35,21 @@ function Invoke-CIPPOffboardingJob {
3535
Set-CIPPSignInState -TenantFilter $tenantFilter -userid $username -AccountEnabled $false -ExecutingUser $ExecutingUser -APIName $APIName
3636
}
3737

38-
{ $_.'OnedriveAccess' -ne '' } {
38+
{ $_.'OnedriveAccess' } {
3939
$Options.OnedriveAccess | ForEach-Object { Set-CIPPSharePointPerms -tenantFilter $tenantFilter -userid $username -OnedriveAccessUser $_.value -ExecutingUser $ExecutingUser -APIName $APIName }
4040
}
4141

42-
{ $_.'AccessNoAutomap' -ne '' } {
42+
{ $_.'AccessNoAutomap' } {
4343
$Options.AccessNoAutomap | ForEach-Object { Set-CIPPMailboxAccess -tenantFilter $tenantFilter -userid $username -AccessUser $_.value -Automap $false -AccessRights @('FullAccess') -ExecutingUser $ExecutingUser -APIName $APIName }
4444
}
45-
{ $_.'AccessAutomap' -ne '' } {
45+
{ $_.'AccessAutomap' } {
4646
$Options.AccessAutomap | ForEach-Object { Set-CIPPMailboxAccess -tenantFilter $tenantFilter -userid $username -AccessUser $_.value -Automap $true -AccessRights @('FullAccess') -ExecutingUser $ExecutingUser -APIName $APIName }
4747
}
4848

49-
{ $_.'OOO' -ne '' } {
49+
{ $_.'OOO' } {
5050
Set-CIPPOutOfOffice -tenantFilter $tenantFilter -userid $username -InternalMessage $Options.OOO -ExternalMessage $Options.OOO -ExecutingUser $ExecutingUser -APIName $APIName -state 'Enabled'
5151
}
52-
{ $_.'forward' -ne '' } {
52+
{ $_.'forward' } {
5353
if (!$Options.keepCopy) {
5454
Set-CIPPForwarding -userid $userid -username $username -tenantFilter $Tenantfilter -Forward $Options.forward.value -ExecutingUser $ExecutingUser -APIName $APIName
5555
} else {

Diff for: ‎Modules/CIPPCore/Public/Set-CIPPSharePointPerms.ps1

+8-7
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
function Set-CIPPSharePointPerms {
22
[CmdletBinding()]
33
param (
4-
$userid,
5-
$OnedriveAccessUser,
4+
$UserId, # The UPN or ID of the users OneDrive we are changing permissions on
5+
$OnedriveAccessUser, # The UPN of the user we are adding or removing permissions for
66
$TenantFilter,
77
$APIName = 'Manage SharePoint Owner',
88
$RemovePermission,
@@ -17,6 +17,7 @@ function Set-CIPPSharePointPerms {
1717

1818
try {
1919
if (!$URL) {
20+
Write-Information 'No URL provided, getting URL from Graph'
2021
$URL = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($UserId)/Drives" -asapp $true -tenantid $TenantFilter).WebUrl
2122
}
2223
$tenantName = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/sites/root' -asApp $true -tenantid $TenantFilter).id.Split('.')[0]
@@ -39,19 +40,19 @@ function Set-CIPPSharePointPerms {
3940
</Request>
4041
"@
4142
$request = New-GraphPostRequest -scope "$AdminURL/.default" -tenantid $TenantFilter -Uri "$AdminURL/_vti_bin/client.svc/ProcessQuery" -Type POST -Body $XML -ContentType 'text/xml'
42-
Write-Host $($request)
43+
# Write-Host $($request)
4344
if (!$request.ErrorInfo.ErrorMessage) {
4445
$Message = "$($OnedriveAccessUser) has been $($RemovePermission ? 'removed from' : 'given') access to $URL"
45-
Write-LogMessage -user $ExecutingUser -API $APIName -message $Message -Sev 'Info' -tenant $TenantFilter
46+
Write-LogMessage -user $ExecutingUser -API $APIName -message $Message -Sev Info -tenant $TenantFilter
4647
return $Message
4748
} else {
4849
$message = "Failed to change access: $($request.ErrorInfo.ErrorMessage)"
49-
Write-LogMessage -user $ExecutingUser -API $APIName -message $message -Sev 'Info' -tenant $TenantFilter
50-
return $message
50+
Write-LogMessage -user $ExecutingUser -API $APIName -message $message -Sev Error -tenant $TenantFilter
51+
throw $Message
5152
}
5253
} catch {
5354
$ErrorMessage = Get-CippException -Exception $_
54-
Write-LogMessage -user $ExecutingUser -API $APIName -message "Could not add new owner to $($OnedriveAccessUser) on $URL. Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -tenant $TenantFilter -LogData $ErrorMessage
55+
Write-LogMessage -user $ExecutingUser -API $APIName -message "Could not add new owner to $($OnedriveAccessUser) on $URL. Error: $($ErrorMessage.NormalizedError)" -Sev Error -tenant $TenantFilter -LogData $ErrorMessage
5556
return "Could not add owner for $($URL). Error: $($ErrorMessage.NormalizedError)"
5657
}
5758
}

Diff for: ‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardcalDefault.ps1

+1
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ function Invoke-CIPPStandardcalDefault {
3333
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'calDefault'
3434

3535
# Input validation
36+
$Settings.permissionlevel = $Settings.permissionlevel.value ? $Settings.permissionlevel.value : $Settings.permissionlevel
3637
if ([string]::IsNullOrWhiteSpace($Settings.permissionlevel) -or $Settings.permissionlevel -eq 'Select a value') {
3738
Write-LogMessage -API 'Standards' -tenant $tenant -message 'calDefault: Invalid permissionlevel parameter set' -sev Error
3839
Return

0 commit comments

Comments
 (0)