Skip to content

Commit af19f65

Browse files
KelvinTegelaarKelvinTegelaar
authored
Merge pull request KelvinTegelaar#984 from KelvinTegelaar/dev
Dev to special ben hotfix
2 parents c82a76a + 0ca56a5 commit af19f65

99 files changed

Lines changed: 2258 additions & 2778 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,19 +19,19 @@ function Add-CIPPScheduledTask {
1919
$propertiesToCheck = @('Webhook', 'Email', 'PSA')
2020
$PostExecution = ($propertiesToCheck | Where-Object { $task.PostExecution.$_ -eq $true }) -join ','
2121
$Parameters = [System.Collections.Hashtable]@{}
22-
foreach ($Key in $task.Parameters.Keys) {
22+
foreach ($Key in $task.Parameters.PSObject.Properties.Name) {
2323
$Param = $task.Parameters.$Key
24-
if ($Param.Key) {
24+
if ($Param -is [System.Collections.IDictionary]) {
2525
$ht = @{}
26-
foreach ($p in $Param) {
27-
Write-Host $p.Key
26+
foreach ($p in $Param.GetEnumerator()) {
2827
$ht[$p.Key] = $p.Value
2928
}
3029
$Parameters[$Key] = [PSCustomObject]$ht
3130
} else {
3231
$Parameters[$Key] = $Param
3332
}
3433
}
34+
3535
$Parameters = ($Parameters | ConvertTo-Json -Depth 10 -Compress)
3636
$AdditionalProperties = [System.Collections.Hashtable]@{}
3737
foreach ($Prop in $task.AdditionalProperties) {

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecClrImmId.ps1‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ Function Invoke-ExecClrImmId {
2020
Try {
2121
$TenantFilter = $Request.Query.TenantFilter
2222
$UserID = $Request.Query.ID
23-
$Body = [pscustomobject] @{
24-
onPremisesImmutableId = $null
25-
} | ConvertTo-Json
26-
$GraphRequest = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$UserID" -tenantid $TenantFilter -type PATCH -body $Body
23+
$Body = [pscustomobject]@{ onPremisesImmutableId = $null }
24+
$Body = ConvertTo-Json -InputObject $Body -Depth 5 -Compress
25+
$null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$UserID" -tenantid $TenantFilter -type PATCH -body $Body
2726
$Results = [pscustomobject]@{'Results' = 'Successfully Cleared ImmutableId' }
2827
} catch {
29-
$Results = [pscustomobject]@{'Results' = "Failed. $_.Exception.Message"; colour = 'danger' }
28+
$ErrorMessage = Get-NormalizedError -Message $_.Exception
29+
$Results = [pscustomobject]@{'Results' = "Failed. $ErrorMessage"; colour = 'danger' }
3030
$_.Exception
3131
}
3232

@@ -35,5 +35,4 @@ Function Invoke-ExecClrImmId {
3535
StatusCode = [HttpStatusCode]::OK
3636
Body = $Results
3737
})
38-
3938
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ Function Invoke-ExecJITAdmin {
1111
param($Request, $TriggerMetadata)
1212

1313
$APIName = 'ExecJITAdmin'
14-
Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APINAME -message 'Accessed this API' -Sev 'Debug'
14+
$User = $Request.Headers.'x-ms-client-principal'
15+
16+
Write-LogMessage -user $User -API $APINAME -message 'Accessed this API' -Sev 'Debug'
1517

1618
if ($Request.Query.Action -eq 'List') {
1719
$Schema = Get-CIPPSchemaExtensions | Where-Object { $_.id -match '_cippUser' }
@@ -61,14 +63,14 @@ Function Invoke-ExecJITAdmin {
6163
if ($Request.Body.UserId -match '^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}$') {
6264
$Username = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($Request.Body.UserId)" -tenantid $Request.Body.TenantFilter).userPrincipalName
6365
}
64-
Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APINAME -message "Executing JIT Admin for $Username" -Sev 'Info'
66+
Write-LogMessage -user $User -API $APINAME -message "Executing JIT Admin for $Username" -Sev 'Info'
6567

6668
$Start = ([System.DateTimeOffset]::FromUnixTimeSeconds($Request.Body.StartDate)).DateTime.ToLocalTime()
6769
$Expiration = ([System.DateTimeOffset]::FromUnixTimeSeconds($Request.Body.EndDate)).DateTime.ToLocalTime()
6870
$Results = [System.Collections.Generic.List[string]]::new()
6971

70-
if ($Request.Body.useraction -eq 'create') {
71-
Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APINAME -message "Creating JIT Admin user $($Request.Body.UserPrincipalName)" -Sev 'Info'
72+
if ($Request.Body.useraction -eq 'Create') {
73+
Write-LogMessage -user $User -API $APINAME -message "Creating JIT Admin user $($Request.Body.UserPrincipalName)" -Sev 'Info'
7274
Write-Information "Creating JIT Admin user $($Request.Body.UserPrincipalName)"
7375
$JITAdmin = @{
7476
User = @{
@@ -86,7 +88,7 @@ Function Invoke-ExecJITAdmin {
8688
if (!$Request.Body.UseTAP) {
8789
$Results.Add("Password: $($CreateResult.password)")
8890
}
89-
$Results.Add("JIT Expires: $($Expiration)")
91+
$Results.Add("JIT Admin Expires: $($Expiration)")
9092
Start-Sleep -Seconds 1
9193
}
9294

@@ -101,14 +103,27 @@ Function Invoke-ExecJITAdmin {
101103
$TapBody = '{}'
102104
}
103105
Write-Information "https://graph.microsoft.com/beta/users/$Username/authentication/temporaryAccessPassMethods"
104-
$TapRequest = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$($Username)/authentication/temporaryAccessPassMethods" -tenantid $Request.Body.TenantFilter -type POST -body $TapBody
106+
# Retry creating the TAP up to 5 times, since it can fail due to the user not being fully created yet
107+
$Retries = 0
108+
do {
109+
try {
110+
$TapRequest = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$($Username)/authentication/temporaryAccessPassMethods" -tenantid $Request.Body.TenantFilter -type POST -body $TapBody
111+
} catch {
112+
Start-Sleep -Seconds 2
113+
Write-Information 'ERROR: Failed to create TAP, retrying'
114+
Write-Information ( ConvertTo-Json -Depth 5 -InputObject (Get-CippException -Exception $_))
115+
}
116+
$Retries++
117+
} while ( $null -eq $TapRequest.temporaryAccessPass -and $Retries -le 5 )
105118

106119
$TempPass = $TapRequest.temporaryAccessPass
107120
$PasswordExpiration = $TapRequest.LifetimeInMinutes
108121

109122
$PasswordLink = New-PwPushLink -Payload $TempPass
110123
if ($PasswordLink) {
111124
$Password = $PasswordLink
125+
} else {
126+
$Password = $TempPass
112127
}
113128
$Results.Add("Temporary Access Pass: $Password")
114129
$Results.Add("This TAP is usable starting at $($TapRequest.startDateTime) UTC for the next $PasswordExpiration minutes")
@@ -147,7 +162,9 @@ Function Invoke-ExecJITAdmin {
147162
}
148163
}
149164
Add-CIPPScheduledTask -Task $TaskBody -hidden $false
150-
Set-CIPPUserJITAdminProperties -TenantFilter $Request.Body.TenantFilter -UserId $Request.Body.UserId -Expiration $Expiration
165+
if ($Request.Body.useraction -ne 'Create') {
166+
Set-CIPPUserJITAdminProperties -TenantFilter $Request.Body.TenantFilter -UserId $Request.Body.UserId -Expiration $Expiration
167+
}
151168
$Results.Add("Scheduling JIT Admin enable task for $Username")
152169
} else {
153170
$Results.Add("Executing JIT Admin enable task for $Username")
@@ -176,7 +193,7 @@ Function Invoke-ExecJITAdmin {
176193
}
177194
ScheduledTime = $Request.Body.EndDate
178195
}
179-
Add-CIPPScheduledTask -Task $DisableTaskBody -hidden $false
196+
$null = Add-CIPPScheduledTask -Task $DisableTaskBody -hidden $false
180197
$Results.Add("Scheduling JIT Admin $($Request.Body.ExpireAction) task for $Username")
181198
$Body = @{
182199
Results = @($Results)

‎Modules/CIPPCore/Public/Entrypoints/Invoke-ListDomains.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ Function Invoke-ListDomains {
2121
$TenantFilter = $Request.Query.TenantFilter
2222

2323
try {
24-
$GraphRequest = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/domains' -tenantid $TenantFilter | Select-Object id, isdefault, isinitial | Sort-Object isdefault
24+
$GraphRequest = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/domains' -tenantid $TenantFilter | Select-Object id, isdefault, isinitial | Sort-Object isdefault -Descending
2525
$StatusCode = [HttpStatusCode]::OK
2626
} catch {
2727
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message

‎Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ function Set-CIPPUserJITAdmin {
5050
switch ($Action) {
5151
'Create' {
5252
$Password = New-passwordString
53+
$Schema = Get-CIPPSchemaExtensions | Where-Object { $_.id -match '_cippUser' }
54+
5355
$Body = @{
5456
givenName = $User.FirstName
5557
surname = $User.LastName
@@ -62,6 +64,10 @@ function Set-CIPPUserJITAdmin {
6264
forceChangePasswordNextSignInWithMfa = $false
6365
password = $Password
6466
}
67+
$Schema.id = @{
68+
jitAdminEnabled = $false
69+
jitAdminExpiration = $Expiration.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
70+
}
6571
}
6672
$Json = ConvertTo-Json -Depth 5 -InputObject $Body
6773
try {
@@ -135,9 +141,10 @@ function Set-CIPPUserJITAdmin {
135141
Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $User.UserPrincipalName -Clear | Out-Null
136142
return "Disabled user $($UserObj.displayName) ($($UserObj.userPrincipalName))"
137143
} catch {
138-
return "Error disabling user $($UserObj.displayName) ($($UserObj.userPrincipalName)): $($_.Exception.Message)"
144+
$ErrrorMessage = Get-NormalizedError -Message $_.Exception.Message
145+
return "Error disabling user $($UserObj.displayName) ($($UserObj.userPrincipalName)): $ErrrorMessage"
139146
}
140147
}
141148
}
142149
}
143-
}
150+
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1‎

Lines changed: 27 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,35 @@
11
function Invoke-CIPPStandardActivityBasedTimeout {
22
<#
33
.FUNCTIONALITY
4-
Internal
5-
.APINAME
6-
ActivityBasedTimeout
7-
.CAT
8-
Global Standards
9-
.TAG
10-
"mediumimpact"
11-
"CIS"
12-
"spo_idle_session_timeout"
13-
.HELPTEXT
14-
Enables and sets Idle session timeout for Microsoft 365 to 1 hour. This policy affects most M365 web apps
15-
.ADDEDCOMPONENT
16-
{"type":"Select","label":"Select value","name":"standards.ActivityBasedTimeout.timeout","values":[{"label":"1 Hour","value":"01:00:00"},{"label":"3 Hours","value":"03:00:00"},{"label":"6 Hours","value":"06:00:00"},{"label":"12 Hours","value":"12:00:00"},{"label":"24 Hours","value":"1.00:00:00"}]}
17-
.LABEL
18-
Enable Activity based Timeout
19-
.IMPACT
20-
Medium Impact
21-
.POWERSHELLEQUIVALENT
22-
Portal or Graph API
23-
.RECOMMENDEDBY
24-
"CIS"
25-
.DOCSDESCRIPTION
26-
Enables and sets Idle session timeout for Microsoft 365 to 1 hour. This policy affects most M365 web apps
27-
.UPDATECOMMENTBLOCK
28-
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
4+
Internal
5+
.COMPONENT
6+
(APIName) ActivityBasedTimeout
7+
.SYNOPSIS
8+
(Label) Enable Activity based Timeout
9+
.DESCRIPTION
10+
(Helptext) Enables and sets Idle session timeout for Microsoft 365 to 1 hour. This policy affects most M365 web apps
11+
(DocsDescription) Enables and sets Idle session timeout for Microsoft 365 to 1 hour. This policy affects most M365 web apps
12+
.NOTES
13+
CAT
14+
Global Standards
15+
TAG
16+
"mediumimpact"
17+
"CIS"
18+
"spo_idle_session_timeout"
19+
ADDEDCOMPONENT
20+
{"type":"Select","label":"Select value","name":"standards.ActivityBasedTimeout.timeout","values":[{"label":"1 Hour","value":"01:00:00"},{"label":"3 Hours","value":"03:00:00"},{"label":"6 Hours","value":"06:00:00"},{"label":"12 Hours","value":"12:00:00"},{"label":"24 Hours","value":"1.00:00:00"}]}
21+
IMPACT
22+
Medium Impact
23+
POWERSHELLEQUIVALENT
24+
Portal or Graph API
25+
RECOMMENDEDBY
26+
"CIS"
27+
UPDATECOMMENTBLOCK
28+
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
29+
.LINK
30+
https://docs.cipp.app/user-documentation/tenant/standards/edit-standards
2931
#>
3032

31-
32-
33-
3433
param($Tenant, $Settings)
3534

3635
# Input validation
@@ -91,8 +90,3 @@ function Invoke-CIPPStandardActivityBasedTimeout {
9190
}
9291

9392
}
94-
95-
96-
97-
98-

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1‎

Lines changed: 25 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,33 @@
11
function Invoke-CIPPStandardAddDKIM {
22
<#
33
.FUNCTIONALITY
4-
Internal
5-
.APINAME
6-
AddDKIM
7-
.CAT
8-
Exchange Standards
9-
.TAG
10-
"lowimpact"
11-
"CIS"
12-
.HELPTEXT
13-
Enables DKIM for all domains that currently support it
14-
.ADDEDCOMPONENT
15-
.LABEL
16-
Enables DKIM for all domains that currently support it
17-
.IMPACT
18-
Low Impact
19-
.POWERSHELLEQUIVALENT
20-
New-DkimSigningConfig and Set-DkimSigningConfig
21-
.RECOMMENDEDBY
22-
"CIS"
23-
.DOCSDESCRIPTION
24-
Enables DKIM for all domains that currently support it
25-
.UPDATECOMMENTBLOCK
26-
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
4+
Internal
5+
.COMPONENT
6+
(APIName) AddDKIM
7+
.SYNOPSIS
8+
(Label) Enables DKIM for all domains that currently support it
9+
.DESCRIPTION
10+
(Helptext) Enables DKIM for all domains that currently support it
11+
(DocsDescription) Enables DKIM for all domains that currently support it
12+
.NOTES
13+
CAT
14+
Exchange Standards
15+
TAG
16+
"lowimpact"
17+
"CIS"
18+
ADDEDCOMPONENT
19+
IMPACT
20+
Low Impact
21+
POWERSHELLEQUIVALENT
22+
New-DkimSigningConfig and Set-DkimSigningConfig
23+
RECOMMENDEDBY
24+
"CIS"
25+
UPDATECOMMENTBLOCK
26+
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
27+
.LINK
28+
https://docs.cipp.app/user-documentation/tenant/standards/edit-standards
2729
#>
2830

29-
30-
31-
3231
param($Tenant, $Settings)
3332

3433
$AllDomains = (New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/domains?$top=999' -tenantid $Tenant | Where-Object { $_.supportedServices -contains 'Email' -or $_.id -like '*mail.onmicrosoft.com' }).id
@@ -107,7 +106,3 @@ function Invoke-CIPPStandardAddDKIM {
107106
Add-CIPPBPAField -FieldName 'DKIM' -FieldValue $DKIMState -StoreAs bool -Tenant $tenant
108107
}
109108
}
110-
111-
112-
113-

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1‎

Lines changed: 23 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,31 @@
11
function Invoke-CIPPStandardAnonReportDisable {
22
<#
33
.FUNCTIONALITY
4-
Internal
5-
.APINAME
6-
AnonReportDisable
7-
.CAT
8-
Global Standards
9-
.TAG
10-
"lowimpact"
11-
.HELPTEXT
12-
Shows usernames instead of pseudo anonymised names in reports. This standard is required for reporting to work correctly.
13-
.DOCSDESCRIPTION
14-
Microsoft announced some APIs and reports no longer return names, to comply with compliance and legal requirements in specific countries. This proves an issue for a lot of MSPs because those reports are often helpful for engineers. This standard applies a setting that shows usernames in those API calls / reports.
15-
.ADDEDCOMPONENT
16-
.LABEL
17-
Enable Usernames instead of pseudo anonymised names in reports
18-
.IMPACT
19-
Low Impact
20-
.POWERSHELLEQUIVALENT
21-
Update-MgBetaAdminReportSetting -BodyParameter @{displayConcealedNames = $true}
22-
.RECOMMENDEDBY
23-
.DOCSDESCRIPTION
24-
Shows usernames instead of pseudo anonymised names in reports. This standard is required for reporting to work correctly.
25-
.UPDATECOMMENTBLOCK
26-
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
4+
Internal
5+
.COMPONENT
6+
(APIName) AnonReportDisable
7+
.SYNOPSIS
8+
(Label) Enable Usernames instead of pseudo anonymised names in reports
9+
.DESCRIPTION
10+
(Helptext) Shows usernames instead of pseudo anonymised names in reports. This standard is required for reporting to work correctly.
11+
(DocsDescription) Microsoft announced some APIs and reports no longer return names, to comply with compliance and legal requirements in specific countries. This proves an issue for a lot of MSPs because those reports are often helpful for engineers. This standard applies a setting that shows usernames in those API calls / reports.
12+
.NOTES
13+
CAT
14+
Global Standards
15+
TAG
16+
"lowimpact"
17+
ADDEDCOMPONENT
18+
IMPACT
19+
Low Impact
20+
POWERSHELLEQUIVALENT
21+
Update-MgBetaAdminReportSetting -BodyParameter @{displayConcealedNames = $true}
22+
RECOMMENDEDBY
23+
UPDATECOMMENTBLOCK
24+
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
25+
.LINK
26+
https://docs.cipp.app/user-documentation/tenant/standards/edit-standards
2727
#>
2828

29-
30-
31-
3229
param($Tenant, $Settings)
3330
$CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/reportSettings' -tenantid $Tenant -AsApp $true
3431

@@ -58,7 +55,3 @@ function Invoke-CIPPStandardAnonReportDisable {
5855
Add-CIPPBPAField -FieldName 'AnonReport' -FieldValue $CurrentInfo.displayConcealedNames -StoreAs bool -Tenant $tenant
5956
}
6057
}
61-
62-
63-
64-

0 commit comments

Comments
 (0)