Skip to content

Commit ebf0ca9

Browse files
KelvinTegelaarKelvinTegelaar
authored
Merge pull request KelvinTegelaar#1045 from KelvinTegelaar/dev
Dev to release
2 parents 5cbdf33 + b3c5789 commit ebf0ca9

46 files changed

Lines changed: 1527 additions & 250 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Modules/CIPPCore/Public/Add-CIPPAlias.ps1‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
function Add-CIPPAlias {
2+
[CmdletBinding()]
3+
param (
4+
$user,
5+
$Aliases,
6+
$UserprincipalName,
7+
$TenantFilter,
8+
$APIName = 'Set Manager',
9+
$ExecutingUser
10+
)
11+
12+
try {
13+
foreach ($Alias in $Aliases) {
14+
Write-Host "Adding alias $Alias to $user"
15+
New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$user" -tenantid $TenantFilter -type 'patch' -body "{`"mail`": `"$Alias`"}" -verbose
16+
}
17+
Write-Host "Resetting primary alias to $User"
18+
New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$($user)" -tenantid $TenantFilter -type 'patch' -body "{`"mail`": `"$User`"}" -verbose
19+
Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($TenantFilter) -message "Added alias $($Alias) to $($UserprincipalName)" -Sev 'Info'
20+
return ("Added Aliases: $($Aliases -join ',')")
21+
} catch {
22+
Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($TenantFilter) -message "Failed to set alias. Error:$($_.Exception.Message)" -Sev 'Error'
23+
throw "Failed to set alias: $($_.Exception.Message)"
24+
}
25+
}
26+

‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertDeviceCompliance.ps1‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
2+
function Get-CIPPAlertDeviceCompliance {
3+
<#
4+
.FUNCTIONALITY
5+
Entrypoint
6+
#>
7+
[CmdletBinding()]
8+
param(
9+
[Parameter(Mandatory = $false)]
10+
[Alias('input')]
11+
$InputValue,
12+
$TenantFilter
13+
)
14+
try {
15+
$AlertData = New-GraphGETRequest -uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?`$top=999" -tenantid $TenantFilter | Where-Object -Property complianceState -NE 'compliant' | ForEach-Object {
16+
$_ | Select-Object -Property id, deviceName, deviceType, complianceState, lastReportedDateTime
17+
}
18+
Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
19+
} catch {
20+
Write-AlertMessage -tenant $($TenantFilter) -message "Could not get compliance state for $($TenantFilter): $(Get-NormalizedError -message $_.Exception.message)"
21+
}
22+
}

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserDomain.ps1‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,12 @@ function Push-DomainAnalyserDomain {
217217
if (![string]::IsNullOrEmpty($DomainObject.DkimSelectors)) {
218218
$DkimParams.Selectors = $DomainObject.DkimSelectors | ConvertFrom-Json
219219
}
220+
# Check if its a onmicrosoft.com domain and add special selectors for these
221+
if ($Domain -match 'onmicrosoft.com' -and $Domain -notmatch 'mail.onmicrosoft.com') {
222+
$DKIMSelector1Value = "selector1-$($Domain -replace '\.', '-' )"
223+
$DKIMSelector2Value = "selector2-$($Domain -replace '\.', '-' )"
224+
$DkimParams.Add('Selectors', @("$DKIMSelector1Value", "$DKIMSelector2Value"))
225+
}
220226

221227
$DkimRecord = Read-DkimRecord @DkimParams -ErrorAction Stop
222228

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Graph Requests/Push-ListGraphRequestQueue.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ function Push-ListGraphRequestQueue {
4141
Get-GraphRequestList @GraphRequestParams
4242
} catch {
4343
[PSCustomObject]@{
44-
Tenant = $Item.Tenant
44+
Tenant = $Item.TenantFilter
4545
CippStatus = "Could not connect to tenant. $($_.Exception.message)"
4646
}
4747
}
@@ -62,4 +62,4 @@ function Push-ListGraphRequestQueue {
6262
Write-Information "Queue Error: $($_.Exception.Message)"
6363
throw $_
6464
}
65-
}
65+
}

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ExecOnboardTenantQueue.ps1‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ Function Push-ExecOnboardTenantQueue {
135135
if ($AccessAssignments.id -and !$Invite) {
136136
$MissingRoles = [System.Collections.Generic.List[object]]::new()
137137
$Logs.Add([PSCustomObject]@{ Date = Get-Date -UFormat $DateFormat; Log = 'Relationship has existing access assignments, checking for missing mappings' })
138-
#Write-Host ($AccessAssignments | ConvertTo-Json -Depth 5)
138+
139139
if ($Item.Roles -and $Item.AutoMapRoles -eq $true) {
140140
foreach ($Role in $Item.Roles) {
141141
if ($AccessAssignments.accessContainer.accessContainerid -notcontains $Role.GroupId -and $Relationship.accessDetails.unifiedRoles.roleDefinitionId -contains $Role.roleDefinitionId) {
@@ -161,7 +161,7 @@ Function Push-ExecOnboardTenantQueue {
161161
}
162162
}
163163

164-
if (!$AccessAssignments.id -and !$Invite -and $Item.Roles) {
164+
if (!$AccessAssignments.id -and $Item.Roles) {
165165
$Logs.Add([PSCustomObject]@{ Date = Get-Date -UFormat $DateFormat; Log = 'No access assignments found, using defined role mapping.' })
166166
$MatchingRoles = [System.Collections.Generic.List[object]]::new()
167167
foreach ($Role in $Item.Roles) {
@@ -177,7 +177,7 @@ Function Push-ExecOnboardTenantQueue {
177177
'InviteUrl' = 'https://admin.microsoft.com/AdminPortal/Home#/partners/invitation/granularAdminRelationships/{0}' -f $Id
178178
'RoleMappings' = [string](@($MatchingRoles) | ConvertTo-Json -Depth 10 -Compress)
179179
}
180-
Add-CIPPAzDataTableEntity @InviteTable -Entity $Invite
180+
Add-CIPPAzDataTableEntity @InviteTable -Entity $Invite -Force
181181
$GroupSuccess = $true
182182
} else {
183183
$TenantOnboarding.Status = 'failed'
@@ -292,10 +292,10 @@ Function Push-ExecOnboardTenantQueue {
292292
}
293293
$Logs.Add([PSCustomObject]@{ Date = Get-Date -UFormat $DateFormat; Log = 'Added initial CPV consent permissions' })
294294
} catch {
295-
$Logs.Add([PSCustomObject]@{ Date = Get-Date -UFormat $DateFormat; Log = 'CPV Consent Failed' })
295+
$Logs.Add([PSCustomObject]@{ Date = Get-Date -UFormat $DateFormat; Log = ('CPV Consent Failed, error: {0}' -f $Consent) })
296296
$TenantOnboarding.Status = 'failed'
297297
$OnboardingSteps.Step4.Status = 'failed'
298-
$OnboardingSteps.Step4.Message = 'CPV Consent failed, check the App Registration in your partner tenant for missing admin consent.'
298+
$OnboardingSteps.Step4.Message = 'CPV Consent failed, check the logs for more details.'
299299
$TenantOnboarding.OnboardingSteps = [string](ConvertTo-Json -InputObject $OnboardingSteps -Compress)
300300
$TenantOnboarding.Logs = [string](ConvertTo-Json -InputObject @($Logs) -Compress)
301301
Add-CIPPAzDataTableEntity @OnboardTable -Entity $TenantOnboarding -Force -ErrorAction Stop
@@ -309,13 +309,15 @@ Function Push-ExecOnboardTenantQueue {
309309
$TenantOnboarding.OnboardingSteps = [string](ConvertTo-Json -InputObject $OnboardingSteps -Compress)
310310
$TenantOnboarding.Logs = [string](ConvertTo-Json -InputObject @($Logs) -Compress)
311311
Add-CIPPAzDataTableEntity @OnboardTable -Entity $TenantOnboarding -Force -ErrorAction Stop
312+
$LastCPVError = ''
312313
do {
313314
try {
314315
Add-CIPPApplicationPermission -RequiredResourceAccess 'CippDefaults' -ApplicationId $ENV:ApplicationID -tenantfilter $Relationship.customer.tenantId
315316
Add-CIPPDelegatedPermission -RequiredResourceAccess 'CippDefaults' -ApplicationId $ENV:ApplicationID -tenantfilter $Relationship.customer.tenantId
316317
$CPVSuccess = $true
317318
$Refreshing = $false
318319
} catch {
320+
$LastCPVError = $_.Exception.Message
319321
Start-Sleep -Seconds 30
320322
}
321323
} while ($Refreshing -and (Get-Date) -lt $Start.AddMinutes(8))
@@ -328,10 +330,10 @@ Function Push-ExecOnboardTenantQueue {
328330
$Tenant = Get-Tenants -TriggerRefresh -IncludeAll | Where-Object { $_.customerId -eq $Relationship.customer.tenantId } | Select-Object -First 1
329331
}
330332
} else {
331-
$Logs.Add([PSCustomObject]@{ Date = Get-Date -UFormat $DateFormat; Log = 'CPV permissions failed to refresh' })
333+
$Logs.Add([PSCustomObject]@{ Date = Get-Date -UFormat $DateFormat; Log = 'CPV permissions failed to refresh. {0}' -f $LastCPVError })
332334
$TenantOnboarding.Status = 'failed'
333335
$OnboardingSteps.Step4.Status = 'failed'
334-
$OnboardingSteps.Step4.Message = 'CPV permissions failed to refresh, try again later'
336+
$OnboardingSteps.Step4.Message = 'CPV permissions failed to refresh, check the logs for more details.'
335337
}
336338
} else {
337339
$Logs.Add([PSCustomObject]@{ Date = Get-Date -UFormat $DateFormat; Log = 'Tenant not found' })

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ListMFAUsersQueue.ps1‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ function Push-ListMFAUsersQueue {
99
Write-Host "PowerShell queue trigger function processed work item: $($Item.defaultDomainName)"
1010

1111
try {
12-
Update-CippQueueEntry -RowKey $Item.QueueId -Status 'Running' -Name $Item.displayName
12+
#Update-CippQueueEntry -RowKey $Item.QueueId -Status 'Running' -Name $Item.displayName
1313
$domainName = $Item.defaultDomainName
1414
$Table = Get-CIPPTable -TableName cachemfa
1515
Try {
@@ -29,6 +29,12 @@ function Push-ListMFAUsersQueue {
2929
RowKey = [string]"$domainName"
3030
PartitionKey = 'users'
3131
}
32+
} else {
33+
$GraphRequest = foreach ($Request in $GraphRequest) {
34+
$Request.CAPolicies = try { [string](@($Request.CAPolicies) | ConvertTo-Json -Compress -Depth 5) } catch { [string]$Request.CAPolicies }
35+
$Request.MFAMethods = try { [string](@($Request.MFAMethods) | ConvertTo-Json -Compress -Depth 5) } catch { [string]$Request.MFAMethods }
36+
$Request
37+
}
3238
}
3339
Add-CIPPAzDataTableEntity @Table -Entity $GraphRequest -Force | Out-Null
3440

@@ -47,7 +53,7 @@ function Push-ListMFAUsersQueue {
4753
}
4854
Add-CIPPAzDataTableEntity @Table -Entity $GraphRequest -Force | Out-Null
4955
} finally {
50-
Update-CippQueueEntry -RowKey $QueueItem -Status 'Completed'
56+
#Update-CippQueueEntry -RowKey $QueueItem -Status 'Completed'
5157
}
5258

53-
}
59+
}

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-UpdatePermissionsQueue.ps1‎

Lines changed: 45 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,50 @@ function Push-UpdatePermissionsQueue {
44
Entrypoint
55
#>
66
param($Item)
7-
Write-Host "Applying permissions for $($Item.defaultDomainName)"
8-
$Table = Get-CIPPTable -TableName cpvtenants
9-
$CPVRows = Get-CIPPAzDataTableEntity @Table | Where-Object -Property Tenant -EQ $Item.customerId
10-
if (!$CPVRows -or $ENV:ApplicationID -notin $CPVRows.applicationId) {
11-
Write-LogMessage -tenant $Item.defaultDomainName -tenantId $Item.customerId -message 'A New tenant has been added, or a new CIPP-SAM Application is in use' -Sev 'Warn' -API 'NewTenant'
12-
Write-Host 'Adding CPV permissions'
13-
Set-CIPPCPVConsent -Tenantfilter $Item.customerId
14-
}
157

16-
Add-CIPPApplicationPermission -RequiredResourceAccess 'CippDefaults' -ApplicationId $ENV:ApplicationID -tenantfilter $Item.customerId
17-
Add-CIPPDelegatedPermission -RequiredResourceAccess 'CippDefaults' -ApplicationId $ENV:ApplicationID -tenantfilter $Item.customerId
8+
try {
9+
$DomainRefreshRequired = $false
10+
11+
if (!$Item.defaultDomainName) {
12+
$DomainRefreshRequired = $true
13+
}
14+
15+
Write-Information "Applying permissions for $($Item.displayName)"
16+
$Table = Get-CIPPTable -TableName cpvtenants
17+
$CPVRows = Get-CIPPAzDataTableEntity @Table | Where-Object -Property Tenant -EQ $Item.customerId
18+
19+
if (!$CPVRows -or $ENV:ApplicationID -notin $CPVRows.applicationId) {
20+
Write-LogMessage -tenant $Item.defaultDomainName -tenantId $Item.customerId -message 'A New tenant has been added, or a new CIPP-SAM Application is in use' -Sev 'Warn' -API 'NewTenant'
21+
Write-Information 'Adding CPV permissions'
22+
Set-CIPPCPVConsent -Tenantfilter $Item.customerId
23+
$DomainRefreshRequired = $true
24+
}
25+
Write-Information 'Updating permissions'
26+
Add-CIPPApplicationPermission -RequiredResourceAccess 'CippDefaults' -ApplicationId $ENV:ApplicationID -tenantfilter $Item.customerId
27+
Add-CIPPDelegatedPermission -RequiredResourceAccess 'CippDefaults' -ApplicationId $ENV:ApplicationID -tenantfilter $Item.customerId
28+
Write-LogMessage -tenant $Item.defaultDomainName -tenantId $Item.customerId -message "Updated permissions for $($Item.displayName)" -Sev 'Info' -API 'UpdatePermissionsQueue'
1829

19-
Write-LogMessage -tenant $Item.defaultDomainName -tenantId $Item.customerId -message "Updated permissions for $($Item.displayName)" -Sev 'Info' -API 'UpdatePermissionsQueue'
20-
}
30+
Write-Information 'Pushing CIPP-SAM admin roles'
31+
Set-CIPPSAMAdminRoles -TenantFilter $Item.customerId
32+
33+
$Table = Get-CIPPTable -TableName cpvtenants
34+
$unixtime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
35+
$GraphRequest = @{
36+
LastApply = "$unixtime"
37+
applicationId = "$($ENV:applicationId)"
38+
Tenant = "$($Item.customerId)"
39+
PartitionKey = 'Tenant'
40+
RowKey = "$($Item.customerId)"
41+
}
42+
Add-CIPPAzDataTableEntity @Table -Entity $GraphRequest -Force
43+
44+
if ($DomainRefreshRequired) {
45+
$UpdatedTenant = Get-Tenants -TenantFilter $Item.customerId -TriggerRefresh
46+
if ($UpdatedTenant.defaultDomainName) {
47+
Write-Information "Updated tenant domains $($UpdatedTenant.defaultDomainName)"
48+
}
49+
}
50+
} catch {
51+
Write-Information "Error updating permissions for $($Item.displayName)"
52+
}
53+
}

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Webhooks/Push-AuditLogTenant.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ function Push-AuditLogTenant {
4949
}
5050

5151
if (($NewBundles | Measure-Object).Count -gt 0) {
52-
Add-CIPPAzDataTableEntity @AuditBundleTable -Entity $NewBundles
52+
Add-CIPPAzDataTableEntity @AuditBundleTable -Entity $NewBundles -Force
5353
Write-Information ($NewBundles | ConvertTo-Json -Depth 5 -Compress)
5454

5555
$Batch = $NewBundles | Select-Object @{Name = 'ContentId'; Expression = { $_.RowKey } }, @{Name = 'TenantFilter'; Expression = { $_.PartitionKey } }, @{Name = 'FunctionName'; Expression = { 'AuditLogBundleProcessing' } }
@@ -62,4 +62,4 @@ function Push-AuditLogTenant {
6262
Write-Host "Started orchestration with ID = '$InstanceId'"
6363
}
6464

65-
}
65+
}

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Webhooks/Push-Schedulerwebhookcreation.ps1‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@ function Push-Schedulerwebhookcreation {
2222
if ($Row.tenantid -ne 'AllTenants') {
2323
Remove-AzDataTableEntity @Table -Entity $Row
2424
}
25+
if (($Webhook | Measure-Object).Count -gt 1) {
26+
$Webhook = $Webhook | Select-Object -First 1
27+
$WebhooksToRemove = $ExistingWebhooks | Where-Object { $_.RowKey -ne $Webhook.RowKey }
28+
foreach ($RemoveWebhook in $WebhooksToRemove) {
29+
Remove-AzDataTableEntity @WebhookTable -Entity $RemoveWebhook
30+
}
31+
}
2532
} else {
2633
Write-Information "No existing webhook for $Tenant - $($Row.webhookType) - Time to create."
2734
try {

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,13 @@ Function Invoke-ExecExtensionsConfig {
1919
Write-Information 'PowerShell HTTP trigger function processed a request.'
2020
$results = try {
2121
if ($Request.Body.CIPPAPI.Enabled) {
22-
$APIConfig = New-CIPPAPIConfig -ExecutingUser $Request.Headers.'x-ms-client-principal' -resetpassword $Request.Body.CIPPAPI.ResetPassword
23-
$AddedText = $APIConfig.Results
22+
try {
23+
$APIConfig = New-CIPPAPIConfig -ExecutingUser $Request.Headers.'x-ms-client-principal' -resetpassword $Request.Body.CIPPAPI.ResetPassword
24+
$AddedText = $APIConfig.Results
25+
} catch {
26+
$AddedText = ' Could not enable CIPP-API. Check the CIPP documentation for API requirements.'
27+
$Request.Body = $Request.Body | Select-Object * -ExcludeProperty CIPPAPI
28+
}
2429
}
2530

2631
# Check if NinjaOne URL is set correctly and the instance has at least version 5.6
@@ -31,7 +36,7 @@ Function Invoke-ExecExtensionsConfig {
3136
throw "Failed to connect to NinjaOne check your Instance is set correctly eg 'app.ninjarmmm.com'"
3237
}
3338
if ($Version -lt [version]'5.6.0.0') {
34-
throw 'NinjaOne 5.6.0.0 is required. This will be rolling out regionally between the end of November and mid-December. Please try again at a later date.'
39+
throw 'NinjaOne 5.6.0.0 is required.'
3540
}
3641
}
3742

@@ -84,9 +89,9 @@ Function Invoke-ExecExtensionsConfig {
8489
Add-AzDataTableEntity @ConfigTable -Entity $AddObject -Force
8590

8691
Register-CIPPExtensionScheduledTasks
87-
"Successfully set the configuration. $AddedText"
92+
"Successfully saved the extension configuration. $AddedText"
8893
} catch {
89-
"Failed to set configuration: $($_.Exception.message) Linenumber: $($_.InvocationInfo.ScriptLineNumber)"
94+
"Failed to save the extensions configuration: $($_.Exception.message) Linenumber: $($_.InvocationInfo.ScriptLineNumber)"
9095
}
9196

9297

0 commit comments

Comments
 (0)