Skip to content

Commit ef0a905

Browse files
pull[bot]pull[bot]
authored
Merge pull request #880 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents 6da3071 + f37c9fd commit ef0a905

2 files changed

Lines changed: 130 additions & 27 deletions

File tree

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1‎

Lines changed: 116 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -47,30 +47,49 @@ function Invoke-CIPPStandardOauthConsent {
4747
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the OauthConsent state for $Tenant. Error: $ErrorMessage" -Sev Error
4848
return
4949
}
50+
$AllowedAppIdsForTenant = @($settings.AllowedApps -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ } | Sort-Object -Unique)
51+
$CompareIncludes = @()
52+
$CompareIncludesFetched = $false
53+
try {
54+
$CompareIncludes = @(New-GraphGetRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies/cipp-consent-policy/includes')
55+
$CompareIncludesFetched = $true
56+
} catch {
57+
$CompareIncludes = @()
58+
}
5059
$StateIsCorrect = if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -eq 'ManagePermissionGrantsForSelf.cipp-consent-policy') { $true } else { $false }
5160

5261
if ($Settings.remediate -eq $true) {
53-
$AllowedAppIdsForTenant = $settings.AllowedApps -split ',' | ForEach-Object { $_.Trim() }
62+
$DidRemediationChange = $false
5463
try {
55-
$Existing = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies/' -tenantid $tenant) | Where-Object -Property id -EQ 'cipp-consent-policy'
56-
if (!$Existing) {
57-
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies' -Type POST -Body '{ "id":"cipp-consent-policy", "displayName":"Application Consent Policy", "description":"This policy controls the current application consent policies."}' -ContentType 'application/json'
58-
# Replaced static web app appid with Office 365 Management by Microsoft's recommendation
59-
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies/cipp-consent-policy/includes' -Type POST -Body '{"permissionClassification":"all","permissionType":"delegated","clientApplicationIds":["00b41c95-dab0-4487-9791-b9d2c32c80f2"]}' -ContentType 'application/json'
64+
if (-not $CompareIncludesFetched) {
65+
$Existing = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies/' -tenantid $tenant) | Where-Object -Property id -EQ 'cipp-consent-policy'
66+
if (!$Existing) {
67+
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies' -Type POST -Body '{ "id":"cipp-consent-policy", "displayName":"Application Consent Policy", "description":"This policy controls the current application consent policies."}' -ContentType 'application/json'
68+
# Replaced static web app appid with Office 365 Management by Microsoft's recommendation
69+
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies/cipp-consent-policy/includes' -Type POST -Body '{"permissionClassification":"all","permissionType":"delegated","clientApplicationIds":["00b41c95-dab0-4487-9791-b9d2c32c80f2"]}' -ContentType 'application/json'
70+
$DidRemediationChange = $true
71+
}
6072
}
6173

6274
try {
63-
$ExistingIncludes = New-GraphGetRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies/cipp-consent-policy/includes'
64-
65-
$ExistingAppIds = foreach ($entry in $ExistingIncludes.value) {
66-
$entry.clientApplicationIds
67-
}
68-
$ExistingAppIds = $ExistingAppIds | Sort-Object -Unique
75+
$ExistingIncludesEntries = @($CompareIncludes)
6976

7077
foreach ($AllowedApp in $AllowedAppIdsForTenant) {
71-
if ($AllowedApp -and ($AllowedApp -notin $ExistingAppIds)) {
78+
$HasDelegated = $ExistingIncludesEntries | Where-Object {
79+
$_.permissionType -eq 'delegated' -and $_.clientApplicationIds -contains $AllowedApp
80+
}
81+
$HasApplication = $ExistingIncludesEntries | Where-Object {
82+
$_.permissionType -eq 'application' -and $_.clientApplicationIds -contains $AllowedApp
83+
}
84+
85+
if (-not $HasDelegated) {
7286
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies/cipp-consent-policy/includes' -Type POST -Body ('{"permissionType": "delegated","clientApplicationIds": ["' + $AllowedApp + '"]}') -ContentType 'application/json'
87+
$DidRemediationChange = $true
88+
}
89+
90+
if (-not $HasApplication) {
7391
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies/cipp-consent-policy/includes' -Type POST -Body ('{ "permissionType": "Application", "clientApplicationIds": ["' + $AllowedApp + '"] }') -ContentType 'application/json'
92+
$DidRemediationChange = $true
7493
}
7594
}
7695
} catch {
@@ -79,6 +98,17 @@ function Invoke-CIPPStandardOauthConsent {
7998

8099
if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -notin @('ManagePermissionGrantsForSelf.cipp-consent-policy')) {
81100
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -Type PATCH -Body '{"permissionGrantPolicyIdsAssignedToDefaultUserRole":["ManagePermissionGrantsForSelf.cipp-consent-policy"]}' -ContentType 'application/json'
101+
$DidRemediationChange = $true
102+
}
103+
104+
if ($DidRemediationChange) {
105+
try {
106+
$State = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $tenant
107+
$CompareIncludes = @(New-GraphGetRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies/cipp-consent-policy/includes')
108+
$StateIsCorrect = if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -eq 'ManagePermissionGrantsForSelf.cipp-consent-policy') { $true } else { $false }
109+
} catch {
110+
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Unable to refresh OauthConsent state/includes after remediation.' -sev Warning
111+
}
82112
}
83113

84114
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Application Consent Mode has been enabled.' -sev Info
@@ -98,12 +128,85 @@ function Invoke-CIPPStandardOauthConsent {
98128
}
99129

100130
if ($Settings.report -eq $true) {
131+
$ExpectedIncludeMap = @{
132+
'delegated|00b41c95-dab0-4487-9791-b9d2c32c80f2' = @{
133+
permissionType = 'delegated'
134+
permissionClassification = 'all'
135+
clientApplicationIds = @('00b41c95-dab0-4487-9791-b9d2c32c80f2')
136+
}
137+
}
138+
foreach ($AllowedApp in $AllowedAppIdsForTenant) {
139+
$ExpectedIncludeMap["delegated|$AllowedApp"] = @{
140+
permissionType = 'delegated'
141+
permissionClassification = 'all'
142+
clientApplicationIds = @($AllowedApp)
143+
}
144+
$ExpectedIncludeMap["application|$AllowedApp"] = @{
145+
permissionType = 'application'
146+
permissionClassification = 'all'
147+
clientApplicationIds = @($AllowedApp)
148+
}
149+
}
150+
151+
$CurrentIncludesForCompare = @(
152+
$CompareIncludes | ForEach-Object {
153+
$CurrentPermissionType = "$($_.permissionType)".ToLowerInvariant()
154+
$CurrentClientApplicationIds = @($_.clientApplicationIds)
155+
156+
$IncludeInCurrentConfig = $false
157+
foreach ($CurrentClientApplicationId in $CurrentClientApplicationIds) {
158+
if ($ExpectedIncludeMap.ContainsKey("$CurrentPermissionType|$CurrentClientApplicationId")) {
159+
$IncludeInCurrentConfig = $true
160+
break
161+
}
162+
}
163+
164+
if ($IncludeInCurrentConfig) {
165+
@{
166+
permissionType = $_.permissionType
167+
permissionClassification = $_.permissionClassification
168+
clientApplicationIds = $CurrentClientApplicationIds
169+
}
170+
}
171+
}
172+
)
173+
$CurrentIncludesForCompare = @(
174+
$CurrentIncludesForCompare | Sort-Object permissionType, @{ Expression = { ($_.clientApplicationIds -join ',') } }
175+
)
176+
177+
$ExpectedIncludesForCompare = @(
178+
@($ExpectedIncludeMap.Values) | Sort-Object permissionType, @{ Expression = { ($_.clientApplicationIds -join ',') } }
179+
)
180+
181+
$IncludesAreConfigured = $true
182+
foreach ($ExpectedInclude in $ExpectedIncludesForCompare) {
183+
$ExpectedPermissionType = $ExpectedInclude.permissionType
184+
$ExpectedClientApplicationIds = @($ExpectedInclude.clientApplicationIds)
185+
$ExpectedClassification = $ExpectedInclude.permissionClassification
186+
187+
$MatchingEntry = $CurrentIncludesForCompare | Where-Object {
188+
$_.permissionType -eq $ExpectedPermissionType -and
189+
$_.permissionClassification -eq $ExpectedClassification -and
190+
((@($_.clientApplicationIds) | Sort-Object) -join ',') -eq (($ExpectedClientApplicationIds | Sort-Object) -join ',')
191+
} | Select-Object -First 1
192+
193+
if (-not $MatchingEntry) {
194+
$IncludesAreConfigured = $false
195+
break
196+
}
197+
}
198+
199+
$StateIsCorrect = ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -eq 'ManagePermissionGrantsForSelf.cipp-consent-policy') -and $IncludesAreConfigured
200+
101201
Add-CIPPBPAField -FieldName 'OauthConsent' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
202+
102203
$CurrentValue = @{
103204
permissionGrantPolicyIdsAssignedToDefaultUserRole = $State.permissionGrantPolicyIdsAssignedToDefaultUserRole
205+
includes = $CurrentIncludesForCompare
104206
}
105207
$ExpectedValue = @{
106208
permissionGrantPolicyIdsAssignedToDefaultUserRole = @('ManagePermissionGrantsForSelf.cipp-consent-policy')
209+
includes = $ExpectedIncludesForCompare
107210
}
108211
Set-CIPPStandardsCompareField -FieldName 'standards.OauthConsent' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
109212
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -98,12 +98,12 @@ function Get-NormalizedTemplateList {
9898
param($Settings)
9999

100100
if ($Settings.'standards.SafeLinksTemplatePolicy.TemplateIds') {
101-
return $Settings.'standards.SafeLinksTemplatePolicy.TemplateIds'
101+
return @($Settings.'standards.SafeLinksTemplatePolicy.TemplateIds')
102102
} elseif ($Settings.TemplateIds) {
103-
return $Settings.TemplateIds
103+
return @($Settings.TemplateIds)
104104
}
105105

106-
return $null
106+
return @()
107107
}
108108

109109
function Get-SafeLinksTemplateFromStorage {
@@ -285,8 +285,8 @@ function Invoke-SafeLinksRemediation {
285285
$OverallSuccess = $true
286286
$TemplateResults = @{}
287287

288-
foreach ($TemplateItem in $TemplateList) {
289-
$TemplateId = $TemplateItem.value
288+
foreach ($TemplateItem in @($TemplateList)) {
289+
$TemplateId = if ($TemplateItem -is [string]) { $TemplateItem } else { $TemplateItem.value }
290290

291291
try {
292292
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Processing SafeLinks template with ID: $TemplateId" -sev Info
@@ -371,7 +371,7 @@ function Invoke-SafeLinksRemediation {
371371
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Successfully applied all SafeLinks templates' -sev Info
372372
} else {
373373
$SuccessCount = ($TemplateResults.Values | Where-Object { $_.Success -eq $true }).Count
374-
$TotalCount = $TemplateList.Count
374+
$TotalCount = @($TemplateList).Count
375375
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Applied $SuccessCount out of $TotalCount SafeLinks templates" -sev Info
376376
}
377377
}
@@ -382,8 +382,8 @@ function Invoke-SafeLinksAlert {
382382
$AllTemplatesApplied = $true
383383
$AlertMessages = [System.Collections.Generic.List[string]]::new()
384384

385-
foreach ($TemplateItem in $TemplateList) {
386-
$TemplateId = $TemplateItem.value
385+
foreach ($TemplateItem in @($TemplateList)) {
386+
$TemplateId = if ($TemplateItem -is [string]) { $TemplateItem } else { $TemplateItem.value }
387387

388388
try {
389389
$Template = Get-SafeLinksTemplateFromStorage -TemplateId $TemplateId
@@ -432,8 +432,8 @@ function Invoke-SafeLinksReport {
432432
$AllTemplatesApplied = $true
433433
$ReportResults = @{}
434434

435-
foreach ($TemplateItem in $TemplateList) {
436-
$TemplateId = $TemplateItem.value
435+
foreach ($TemplateItem in @($TemplateList)) {
436+
$TemplateId = if ($TemplateItem -is [string]) { $TemplateItem } else { $TemplateItem.value }
437437

438438
try {
439439
$Template = Get-SafeLinksTemplateFromStorage -TemplateId $TemplateId
@@ -468,14 +468,14 @@ function Invoke-SafeLinksReport {
468468

469469
$CurrentValue = @{
470470
TemplateResults = $ReportResults
471-
ProcessedTemplates = $TemplateList.Count
472-
SuccessfulTemplates = ($ReportResults.Values | Where-Object { $_.Success -eq $true }).Count
471+
ProcessedTemplates = @($TemplateList).Count
472+
SuccessfulTemplates = @($ReportResults.Values | Where-Object { $_.Success -eq $true }).Count
473473
AllTemplatesApplied = $AllTemplatesApplied
474474
}
475475
$ExpectedValue = @{
476476
TemplateResults = $ReportResults
477-
ProcessedTemplates = $TemplateList.Count
478-
SuccessfulTemplates = $TemplateList.Count
477+
ProcessedTemplates = @($TemplateList).Count
478+
SuccessfulTemplates = @($TemplateList).Count
479479
AllTemplatesApplied = $true
480480
}
481481

0 commit comments

Comments
 (0)