')
$IntroText = $IntroText + "The (potential) location information for this IP is as follows:
$LocationTable"
}
- $ButtonUrl = "$CIPPPURL/identity/administration/users?customerId=$($data.OrganizationId)"
+ $ButtonUrl = "$CIPPURL/identity/administration/users?customerId=$($data.OrganizationId)"
$ButtonText = 'User Management'
$AfterButtonText = 'If this is incorrect, use the user management screen to unblock the users sign-in
'
@@ -145,7 +146,7 @@ function New-CIPPAlertTemplate {
$IntroText = $IntroText + "The (potential) location information for this IP is as follows:
$LocationTable"
}
$IntroText = "$($data.ObjectId) has been added by $($data.UserId)."
- $ButtonUrl = "$CIPPPURL/tenant/administration/enterprise-apps?customerId=?customerId=$($data.OrganizationId)"
+ $ButtonUrl = "$CIPPURL/tenant/administration/enterprise-apps?customerId=?customerId=$($data.OrganizationId)"
$ButtonText = 'Enterprise Apps'
}
'Remove service principal.' {
@@ -158,7 +159,7 @@ function New-CIPPAlertTemplate {
$IntroText = $IntroText + "The (potential) location information for this IP is as follows:
$LocationTable"
}
$IntroText = "$($data.ObjectId) has been added by $($data.UserId)."
- $ButtonUrl = "$CIPPPURL/tenant/administration/enterprise-apps?customerId=?customerId=$($data.OrganizationId)"
+ $ButtonUrl = "$CIPPURL/tenant/administration/enterprise-apps?customerId=?customerId=$($data.OrganizationId)"
$ButtonText = 'Enterprise Apps'
}
'UserLoggedIn' {
@@ -171,7 +172,7 @@ function New-CIPPAlertTemplate {
$LocationTable = ($LocationInfo | ConvertTo-Html -Fragment -As List | Out-String).Replace('', ' ')
$IntroText = $IntroText + "The (potential) location information for this IP is as follows:
$LocationTable"
}
- $ButtonUrl = "$CIPPPURL/identity/administration/ViewBec?userId=$($data.ObjectId)&tenantDomain=$($data.OrganizationId)"
+ $ButtonUrl = "$CIPPURL/identity/administration/ViewBec?userId=$($data.ObjectId)&tenantDomain=$($data.OrganizationId)"
$ButtonText = 'User Management'
$AfterButtonText = 'If this is incorrect, use the user management screen to block the user and revoke the sessions
'
}
@@ -184,7 +185,7 @@ function New-CIPPAlertTemplate {
$LocationTable = ($LocationInfo | ConvertTo-Html -Fragment -As List | Out-String).Replace('', ' ')
$IntroText = $IntroText + "The (potential) location information for this IP is as follows:
$LocationTable"
}
- $ButtonUrl = "$CIPPPURL/identity/administration/users?customerId=$($data.OrganizationId)"
+ $ButtonUrl = "$CIPPURL/identity/administration/users?customerId=$($data.OrganizationId)"
$ButtonText = 'User Management'
}
}
@@ -196,8 +197,9 @@ function New-CIPPAlertTemplate {
}
} elseif ($Format -eq 'json') {
return [pscustomobject]@{
- title = $Title
- buttonurl = $ButtonUrl
+ title = $Title
+ buttonurl = $ButtonUrl
+ buttontext = $ButtonText
}
}
}
diff --git a/Modules/CIPPCore/Public/New-CIPPBackup.ps1 b/Modules/CIPPCore/Public/New-CIPPBackup.ps1
new file mode 100644
index 000000000000..3c9acd37e9cd
--- /dev/null
+++ b/Modules/CIPPCore/Public/New-CIPPBackup.ps1
@@ -0,0 +1,89 @@
+function New-CIPPBackup {
+ [CmdletBinding()]
+ param (
+ $backupType,
+ $StorageOutput = 'default',
+ $TenantFilter,
+ $APIName = 'CIPP Backup',
+ $ExecutingUser
+ )
+
+ $BackupData = switch ($backupType) {
+ #If backup type is CIPP, create CIPP backup.
+ 'CIPP' {
+ try {
+ $BackupTables = @(
+ 'bpa'
+ 'Config'
+ 'Domains'
+ 'ExcludedLicenses'
+ 'templates'
+ 'standards'
+ 'SchedulerConfig'
+ )
+ $CSVfile = foreach ($CSVTable in $BackupTables) {
+ $Table = Get-CippTable -tablename $CSVTable
+ Get-CIPPAzDataTableEntity @Table
+ }
+ Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message 'Created backup' -Sev 'Debug'
+ $CSVfile
+ $RowKey = 'CIPPBackup' + '_' + (Get-Date).ToString('yyyy-MM-dd-HHmm')
+ $entity = [PSCustomObject]@{
+ PartitionKey = 'CIPPBackup'
+ RowKey = $RowKey
+ TenantFilter = 'CIPPBackup'
+ Backup = [string]($CSVfile | ConvertTo-Json -Compress -Depth 100)
+ }
+ $Table = Get-CippTable -tablename 'CIPPBackup'
+ try {
+ $Result = Add-CIPPAzDataTableEntity @Table -entity $entity -Force
+ Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message 'Created CIPP Backup' -Sev 'Debug'
+ } catch {
+ Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message "Failed to create backup for CIPP: $($_.Exception.Message)" -Sev 'Error'
+ [pscustomobject]@{'Results' = "Backup Creation failed: $($_.Exception.Message)" }
+ }
+
+ } catch {
+ Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message "Failed to create backup: $($_.Exception.Message)" -Sev 'Error'
+ [pscustomobject]@{'Results' = "Backup Creation failed: $($_.Exception.Message)" }
+ }
+ }
+
+ #If Backup type is ConditionalAccess, create Conditional Access backup.
+ 'ConditionalAccess' {
+ $ConditionalAccessPolicyOutput = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies' -tenantid $tenantfilter
+ $AllNamedLocations = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/namedLocations' -tenantid $tenantfilter
+ switch ($StorageOutput) {
+ 'default' {
+ [PSCustomObject]@{
+ ConditionalAccessPolicies = $ConditionalAccessPolicyOutput
+ NamedLocations = $AllNamedLocations
+ }
+ }
+ 'table' {
+ #Store output in tablestorage for Recovery
+ $RowKey = $TenantFilter + '_' + (Get-Date).ToString('yyyy-MM-dd-HHmm')
+ $entity = [PSCustomObject]@{
+ PartitionKey = 'ConditionalAccessBackup'
+ RowKey = $RowKey
+ TenantFilter = $TenantFilter
+ Policies = [string]($ConditionalAccessPolicyOutput | ConvertTo-Json -Compress -Depth 10)
+ NamedLocations = [string]($AllNamedLocations | ConvertTo-Json -Compress -Depth 10)
+ }
+ $Table = Get-CippTable -tablename 'ConditionalAccessBackup'
+ try {
+ $Result = Add-CIPPAzDataTableEntity @Table -entity $entity -Force
+ Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message 'Created backup for Conditional Access Policies' -Sev 'Debug'
+ $Result
+ } catch {
+ Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message "Failed to create backup for Conditional Access Policies: $($_.Exception.Message)" -Sev 'Error'
+ [pscustomobject]@{'Results' = "Backup Creation failed: $($_.Exception.Message)" }
+ }
+ }
+ }
+ }
+
+ }
+ return $BackupData
+}
+
diff --git a/Modules/CIPPCore/Public/New-CIPPGraphSubscription.ps1 b/Modules/CIPPCore/Public/New-CIPPGraphSubscription.ps1
index f7d0eb366389..535156115d0b 100644
--- a/Modules/CIPPCore/Public/New-CIPPGraphSubscription.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPGraphSubscription.ps1
@@ -55,12 +55,12 @@ function New-CIPPGraphSubscription {
return @{ success = $true; message = "Webhook exists for $($TenantFilter) for the log $($EventType)" }
Write-LogMessage -user $ExecutingUser -API $APIName -message "Webhook subscription for $($TenantFilter) already exists" -Sev 'Info' -tenant $TenantFilter
} else {
- Remove-AzDataTableEntity @WebhookTable -Entity @{ PartitionKey = $TenantFilter; RowKey = $CIPPID } | Out-Null
+ Remove-AzDataTableEntity @WebhookTable -Entity @{ PartitionKey = $TenantFilter; RowKey = [string]$CIPPID } | Out-Null
Write-LogMessage -user $ExecutingUser -API $APIName -message "Failed to create Webhook Subscription for $($TenantFilter): $($_.Exception.Message)" -Sev 'Error' -tenant $TenantFilter
return @{ success = $false; message = "Failed to create Webhook Subscription for $($TenantFilter): $($_.Exception.Message)" }
}
}
-
+
} elseif ($PartnerCenter.IsPresent) {
$WebhookFilter = "PartitionKey eq '$($env:TenantId)'"
$ExistingWebhooks = Get-CIPPAzDataTableEntity @WebhookTable -Filter $WebhookFilter
diff --git a/Modules/CIPPCore/Public/SAMManifest.json b/Modules/CIPPCore/Public/SAMManifest.json
index 4fce3279465c..b6b291da57b4 100644
--- a/Modules/CIPPCore/Public/SAMManifest.json
+++ b/Modules/CIPPCore/Public/SAMManifest.json
@@ -155,9 +155,11 @@
{ "id": "84bccea3-f856-4a8a-967b-dbe0a3d53a64", "type": "Scope" },
{ "id": "280b3b69-0437-44b1-bc20-3b2fca1ee3e9", "type": "Scope" },
{ "id": "885f682f-a990-4bad-a642-36736a74b0c7", "type": "Scope" },
- { "id": "913b9306-0ce1-42b8-9137-6a7df690a760", "type": "Role"},
- { "id": "cb8f45a0-5c2e-4ea1-b803-84b870a7d7ec", "type": "Scope"},
- { "id": "4c06a06a-098a-4063-868e-5dfee3827264", "type": "Scope"}
+ { "id": "913b9306-0ce1-42b8-9137-6a7df690a760", "type": "Role" },
+ { "id": "cb8f45a0-5c2e-4ea1-b803-84b870a7d7ec", "type": "Scope" },
+ { "id": "4c06a06a-098a-4063-868e-5dfee3827264", "type": "Scope" },
+ { "id": "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9", "type": "Role" },
+ { "id": "e67e6727-c080-415e-b521-e3f35d5248e9", "type": "Scope" }
]
},
{
diff --git a/Modules/CIPPCore/Public/Send-CIPPAlert.ps1 b/Modules/CIPPCore/Public/Send-CIPPAlert.ps1
index 59395211a55a..8fc9e31f7bdf 100644
--- a/Modules/CIPPCore/Public/Send-CIPPAlert.ps1
+++ b/Modules/CIPPCore/Public/Send-CIPPAlert.ps1
@@ -53,12 +53,20 @@ function Send-CIPPAlert {
if ($PSCmdlet.ShouldProcess($Config.webhook, 'Sending webhook')) {
switch -wildcard ($config.webhook) {
'*webhook.office.com*' {
- $JSonBody = "{`"text`": `"You've setup your alert policies to be alerted whenever specific events happen. We've found some of these events in the log.
$JSONContent`"}"
+ $JSONBody = "{`"text`": `"You've setup your alert policies to be alerted whenever specific events happen. We've found some of these events in the log.
$JSONContent`"}"
Invoke-RestMethod -Uri $config.webhook -Method POST -ContentType 'Application/json' -Body $JSONBody
}
-
'*discord.com*' {
- $JSonBody = "{`"content`": `"You've setup your alert policies to be alerted whenever specific events happen. We've found some of these events in the log. $JSONContent`"}"
+ $JSONBody = "{`"content`": `"You've setup your alert policies to be alerted whenever specific events happen. We've found some of these events in the log. $JSONContent`"}"
+ Invoke-RestMethod -Uri $config.webhook -Method POST -ContentType 'Application/json' -Body $JSONBody
+ }
+ '*slack.com*' {
+ $SlackBlocks = Get-SlackAlertBlocks -JSONBody $JSONContent
+ if ($SlackBlocks.blocks) {
+ $JSONBody = $SlackBlocks | ConvertTo-Json -Depth 10 -Compress
+ } else {
+ $JSONBody = "{`"text`": `"You've setup your alert policies to be alerted whenever specific events happen. We've found some of these events in the log. $JSONContent`"}"
+ }
Invoke-RestMethod -Uri $config.webhook -Method POST -ContentType 'Application/json' -Body $JSONBody
}
default {
diff --git a/Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1
index 1aabf9920b17..15ecab0ea749 100644
--- a/Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1
@@ -5,6 +5,7 @@ function Set-CIPPAssignedPolicy {
$PolicyId,
$Type,
$TenantFilter,
+ $PlatformType = 'deviceManagement',
$APIName = 'Assign Policy',
$ExecutingUser
)
@@ -69,12 +70,12 @@ function Set-CIPPAssignedPolicy {
assignments = @($assignmentsObject)
}
if ($PSCmdlet.ShouldProcess($GroupName, "Assigning policy $PolicyId")) {
- $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$Type('$($PolicyId)')/assign" -tenantid $tenantFilter -type POST -body ($assignmentsObject | ConvertTo-Json -Depth 10)
+ $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/$($PlatformType)/$Type('$($PolicyId)')/assign" -tenantid $tenantFilter -type POST -body ($assignmentsObject | ConvertTo-Json -Depth 10)
Write-LogMessage -user $ExecutingUser -API $APIName -message "Assigned Policy to $($GroupName)" -Sev 'Info' -tenant $TenantFilter
}
- return "Assigned policy to $($GroupName)"
+ return "Assigned policy to $($GroupName) Policy ID is $($PolicyId)."
} catch {
- Write-LogMessage -user $ExecutingUser -API $APIName -message "Failed to assign Policy to $GroupName" -Sev 'Error' -tenant $TenantFilter -LogData (Get-CippException -Exception $_)
- return "Could not assign policy to $GroupName. Error: $($_.Exception.Message)"
+ Write-LogMessage -user $ExecutingUser -API $APIName -message "Failed to assign Policy to $GroupName. Policy ID is $($PolicyId)." -Sev 'Error' -tenant $TenantFilter -LogData (Get-CippException -Exception $_)
+ return "Could not assign policy to $GroupName. Policy ID is $($PolicyId). Error: $($_.Exception.Message)"
}
}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1 b/Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1
index d953ee938285..07f2646a7243 100644
--- a/Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1
@@ -15,6 +15,7 @@ function Set-CIPPDefaultAPDeploymentProfile {
$hideTerms,
$Autokeyboard,
$ExecutingUser,
+ $Language = 'os-default',
$APIName = 'Add Default Enrollment Status Page'
)
try {
@@ -23,7 +24,7 @@ function Set-CIPPDefaultAPDeploymentProfile {
'displayName' = "$($displayname)"
'description' = "$($description)"
'deviceNameTemplate' = "$($DeviceNameTemplate)"
- 'language' = 'os-default'
+ 'language' = "$($Language)"
'enableWhiteGlove' = $([bool]($allowWhiteGlove))
'deviceType' = 'windowsPc'
'extractHardwareHash' = $([bool]($CollectHash))
diff --git a/Modules/CIPPCore/Public/Set-CIPPDefaultAPEnrollment.ps1 b/Modules/CIPPCore/Public/Set-CIPPDefaultAPEnrollment.ps1
index 5d75e787f233..798dfdb71553 100644
--- a/Modules/CIPPCore/Public/Set-CIPPDefaultAPEnrollment.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPDefaultAPEnrollment.ps1
@@ -20,7 +20,7 @@ function Set-CIPPDefaultAPEnrollment {
'displayName' = 'All users and all devices'
'description' = 'This is the default enrollment status screen configuration applied with the lowest priority to all users and all devices regardless of group membership.'
'showInstallationProgress' = [bool]$ShowProgress
- 'blockDeviceSetupRetryByUser' = [bool]$blockDevice
+ 'blockDeviceSetupRetryByUser' = ![bool]$blockDevice
'allowDeviceResetOnInstallFailure' = [bool]$AllowReset
'allowLogCollectionOnInstallFailure' = [bool]$EnableLog
'customErrorMessage' = "$ErrorMessage"
diff --git a/Modules/CIPPCore/Public/Set-CIPPPerUserMFA.ps1 b/Modules/CIPPCore/Public/Set-CIPPPerUserMFA.ps1
new file mode 100644
index 000000000000..1c92a5e9c5d2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPPerUserMFA.ps1
@@ -0,0 +1,69 @@
+function Set-CIPPPerUserMFA {
+ <#
+ .SYNOPSIS
+ Change Per-User MFA State for a User
+
+ .DESCRIPTION
+ Change the Per-User MFA State for a user via the /users/{id}/authentication/requirements endpoint
+
+ .PARAMETER TenantFilter
+ Tenant where the user resides
+
+ .PARAMETER userId
+ One or more User IDs to set the MFA state for (GUID or UserPrincipalName)
+
+ .PARAMETER State
+ State to set the user to (enabled, disabled, enforced)
+
+ .PARAMETER executingUser
+ User executing the command
+
+ .EXAMPLE
+ Set-CIPPPerUserMFA -TenantFilter 'contoso.onmicrosoft.com' -userId user@contoso.onmicrosoft.com -State 'disabled' -executingUser 'mspuser@partner.com'
+ #>
+ [CmdletBinding()]
+ param(
+ [Parameter(Mandatory = $true)]
+ [string]$TenantFilter,
+ [Parameter(Mandatory = $true)]
+ [string[]]$userId,
+ [ValidateSet('enabled', 'disabled', 'enforced')]
+ $State = 'enabled',
+ [string]$executingUser = 'CIPP'
+ )
+ try {
+ $int = 0
+ $Body = @{
+ perUserMFAstate = $State
+ }
+ $Requests = foreach ($id in $userId) {
+ @{
+ id = $int++
+ method = 'PATCH'
+ url = "users/$id/authentication/requirements"
+ body = $Body
+ 'headers' = @{
+ 'Content-Type' = 'application/json'
+ }
+ }
+ }
+
+
+ $Requests = New-GraphBulkRequest -tenantid $tenantfilter -scope 'https://graph.microsoft.com/.default' -Requests @($Requests) -asapp $true
+ "Successfully set Per user MFA State for $userId"
+
+ $Users = foreach ($id in $userId) {
+ @{
+ userId = $id
+ Properties = @{
+ perUserMfaState = $State
+ }
+ }
+ }
+ Set-CIPPUserSchemaProperties -TenantFilter $TenantFilter -Users $Users
+ Write-LogMessage -user $executingUser -API 'Set-CIPPPerUserMFA' -message "Successfully set Per user MFA State to $State for $id" -Sev 'Info' -tenant $TenantFilter
+ } catch {
+ "Failed to set MFA State for $id : $_"
+ Write-LogMessage -user $executingUser -API 'Set-CIPPPerUserMFA' -message "Failed to set MFA State to $State for $id : $_" -Sev 'Error' -tenant $TenantFilter
+ }
+}
\ No newline at end of file
diff --git a/Modules/CIPPCore/Public/Set-CIPPResetPassword.ps1 b/Modules/CIPPCore/Public/Set-CIPPResetPassword.ps1
index 6128fd2af888..aff8463210be 100644
--- a/Modules/CIPPCore/Public/Set-CIPPResetPassword.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPResetPassword.ps1
@@ -3,26 +3,31 @@ function Set-CIPPResetPassword {
param(
$userid,
$tenantFilter,
- $APIName = "Reset Password",
+ $APIName = 'Reset Password',
$ExecutingUser,
[bool]$forceChangePasswordNextSignIn = $true
)
- try {
+ try {
$password = New-passwordString
$passwordProfile = @{
- "passwordProfile" = @{
- "forceChangePasswordNextSignIn" = $forceChangePasswordNextSignIn
- "password" = $password
+ 'passwordProfile' = @{
+ 'forceChangePasswordNextSignIn' = $forceChangePasswordNextSignIn
+ 'password' = $password
}
} | ConvertTo-Json -Compress
- $GraphRequest = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/users/$($userid)" -tenantid $TenantFilter -type PATCH -body $passwordProfile -verbose
- Write-LogMessage -user $ExecutingUser -API $APIName -message "Reset the password for $($userid). User must change password is set to $forceChangePasswordNextSignIn" -Sev "Info" -tenant $TenantFilter
+ $GraphRequest = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/users/$($userid)" -tenantid $TenantFilter -type PATCH -body $passwordProfile -verbose
+
+ #PWPush
+ $PasswordLink = New-PwPushLink -Payload $password
+ if ($PasswordLink) {
+ $password = $PasswordLink
+ }
+ Write-LogMessage -user $ExecutingUser -API $APIName -message "Reset the password for $($userid). User must change password is set to $forceChangePasswordNextSignIn" -Sev 'Info' -tenant $TenantFilter
return "Reset the password for $($userid). User must change password is set to $forceChangePasswordNextSignIn. The new password is $password"
- }
- catch {
- Write-LogMessage -user $ExecutingUser -API $APIName -message "Could not reset password for $($userid)" -Sev "Error" -tenant $TenantFilter
+ } catch {
+ Write-LogMessage -user $ExecutingUser -API $APIName -message "Could not reset password for $($userid)" -Sev 'Error' -tenant $TenantFilter
return "Could not reset password for $($userid). Error: $($_.Exception.Message)"
}
}
diff --git a/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1 b/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1
new file mode 100644
index 000000000000..692b6c4828ef
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1
@@ -0,0 +1,129 @@
+function Set-CIPPUserJITAdmin {
+ <#
+ .SYNOPSIS
+ Just-in-time admin management
+
+ .DESCRIPTION
+ Just-in-time admin management for CIPP. This function can create users, add roles, remove roles, delete, or disable a user.
+
+ .PARAMETER TenantFilter
+ Tenant to manage for JIT admin
+
+ .PARAMETER User
+ User object to manage JIT admin roles, required property UserPrincipalName - If user is being created we also require FirstName and LastName
+
+ .PARAMETER Roles
+ List of Role GUIDs to add or remove
+
+ .PARAMETER Action
+ Action to perform: Create, AddRoles, RemoveRoles, DeleteUser, DisableUser
+
+ .PARAMETER Expiration
+ DateTime for expiration
+
+ .EXAMPLE
+ Set-CIPPUserJITAdmin -TenantFilter 'contoso.onmicrosoft.com' -User @{UserPrincipalName = 'jit@contoso.onmicrosoft.com'} -Roles @('62e90394-69f5-4237-9190-012177145e10') -Action 'AddRoles' -Expiration (Get-Date).AddDays(1)
+
+ #>
+ [CmdletBinding(SupportsShouldProcess = $true)]
+ Param(
+ [Parameter(Mandatory = $true)]
+ [string]$TenantFilter,
+
+ [Parameter(Mandatory = $true)]
+ [hashtable]$User,
+
+ [string[]]$Roles,
+
+ [Parameter(Mandatory = $true)]
+ [ValidateSet('Create', 'AddRoles', 'RemoveRoles', 'DeleteUser', 'DisableUser')]
+ [string]$Action,
+
+ [datetime]$Expiration
+ )
+
+ if ($PSCmdlet.ShouldProcess("User: $($User.UserPrincipalName)", "Action: $Action")) {
+ if ($Action -ne 'Create') {
+ $UserObj = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/users/$($User.UserPrincipalName)" -tenantid $TenantFilter
+ }
+
+ switch ($Action) {
+ 'Create' {
+ $Password = New-passwordString
+ $Body = @{
+ givenName = $User.FirstName
+ surname = $User.LastName
+ accountEnabled = $true
+ displayName = $User.FirstName + ' ' + $User.LastName
+ userPrincipalName = $User.UserPrincipalName
+ mailNickname = $User.UserPrincipalName.Split('@')[0]
+ passwordProfile = @{
+ forceChangePasswordNextSignIn = $true
+ forceChangePasswordNextSignInWithMfa = $false
+ password = $Password
+ }
+ }
+ $Json = ConvertTo-Json -Depth 5 -InputObject $Body
+ try {
+ $NewUser = New-GraphPOSTRequest -type POST -Uri 'https://graph.microsoft.com/beta/users' -Body $Json -tenantid $TenantFilter
+ #PWPush
+ $PasswordLink = New-PwPushLink -Payload $Password
+ if ($PasswordLink) {
+ $Password = $PasswordLink
+ }
+ [PSCustomObject]@{
+ id = $NewUser.id
+ userPrincipalName = $NewUser.userPrincipalName
+ password = $Password
+ }
+ } catch {
+ Write-Information "Error creating user: $($_.Exception.Message)"
+ throw $_.Exception.Message
+ }
+ }
+ 'AddRoles' {
+ $Roles = $Roles | ForEach-Object {
+ try {
+ $Body = @{
+ '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/$($UserObj.id)"
+ }
+ $Json = ConvertTo-Json -Depth 5 -InputObject $Body
+ $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/directoryRoles(roleTemplateId='$($_)')/members/`$ref" -tenantid $TenantFilter -body $Json -ErrorAction SilentlyContinue
+ } catch {}
+ }
+ Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $UserObj.id -Enabled -Expiration $Expiration | Out-Null
+ return "Added admin roles to user $($UserObj.displayName) ($($UserObj.userPrincipalName))"
+ }
+ 'RemoveRoles' {
+ $Roles = $Roles | ForEach-Object {
+ try {
+ $null = New-GraphPOSTRequest -type DELETE -uri "https://graph.microsoft.com/beta/directoryRoles(roleTemplateId='$($_)')/members/$($UserObj.id)/`$ref" -tenantid $TenantFilter
+ } catch {}
+ }
+ Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $UserObj.id -Clear | Out-Null
+ return "Removed admin roles from user $($UserObj.displayName)"
+ }
+ 'DeleteUser' {
+ try {
+ $null = New-GraphPOSTRequest -type DELETE -uri "https://graph.microsoft.com/beta/users/$($UserObj.id)" -tenantid $TenantFilter
+ return "Deleted user $($UserObj.displayName) ($($UserObj.userPrincipalName)) with id $($UserObj.id)"
+ } catch {
+ return "Error deleting user $($UserObj.displayName) ($($UserObj.userPrincipalName)): $($_.Exception.Message)"
+ }
+ }
+ 'DisableUser' {
+ $Body = @{
+ accountEnabled = $false
+ }
+ $Json = ConvertTo-Json -Depth 5 -InputObject $Body
+ try {
+ New-GraphPOSTRequest -type PATCH -uri "https://graph.microsoft.com/beta/users/$($UserObj.id)" -tenantid $TenantFilter -body $Json
+ Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $UserObj.id -Enabled:$false | Out-Null
+ return "Disabled user $($UserObj.displayName) ($($UserObj.userPrincipalName))"
+ } catch {
+ return "Error disabling user $($UserObj.displayName) ($($UserObj.userPrincipalName)): $($_.Exception.Message)"
+ }
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/Modules/CIPPCore/Public/Set-CIPPUserJITAdminProperties.ps1 b/Modules/CIPPCore/Public/Set-CIPPUserJITAdminProperties.ps1
new file mode 100644
index 000000000000..c6203128f2f9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPUserJITAdminProperties.ps1
@@ -0,0 +1,31 @@
+function Set-CIPPUserJITAdminProperties {
+ [CmdletBinding()]
+ Param(
+ [string]$TenantFilter,
+ [string]$UserId,
+ [switch]$Enabled,
+ $Expiration,
+ [switch]$Clear
+ )
+
+ $Schema = Get-CIPPSchemaExtensions | Where-Object { $_.id -match '_cippUser' }
+ if ($Clear.IsPresent) {
+ $Body = [PSCustomObject]@{
+ "$($Schema.id)" = @{
+ jitAdminEnabled = $null
+ jitAdminExpiration = $null
+ }
+ }
+ } else {
+ $Body = [PSCustomObject]@{
+ "$($Schema.id)" = @{
+ jitAdminEnabled = $Enabled.IsPresent
+ jitAdminExpiration = $Expiration.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+ }
+ }
+ }
+
+ $Json = ConvertTo-Json -Depth 5 -InputObject $Body
+ Write-Information $Json
+ New-GraphPOSTRequest -type PATCH -Uri "https://graph.microsoft.com/beta/users/$UserId" -Body $Json -tenantid $TenantFilter | Out-Null
+}
\ No newline at end of file
diff --git a/Modules/CIPPCore/Public/Set-CIPPUserSchemaProperties.ps1 b/Modules/CIPPCore/Public/Set-CIPPUserSchemaProperties.ps1
new file mode 100644
index 000000000000..b006a27069ef
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPUserSchemaProperties.ps1
@@ -0,0 +1,46 @@
+function Set-CIPPUserSchemaProperties {
+ <#
+ .SYNOPSIS
+ Set Schema Properties for a user
+
+ .DESCRIPTION
+ Uses scheam extensions to set properties for a user
+
+ .PARAMETER TenantFilter
+ Tenant for user
+
+ .PARAMETER UserId
+ One or more user ids to set properties for
+
+ .PARAMETER Properties
+ Hashtable of properties to set
+
+ #>
+ [CmdletBinding(SupportsShouldProcess = $true)]
+ Param(
+ [Parameter(Mandatory = $true)]
+ [string]$TenantFilter,
+ [Parameter(Mandatory = $true)]
+ [object]$Users
+ )
+
+ $Schema = Get-CIPPSchemaExtensions | Where-Object { $_.id -match '_cippUser' }
+ $int = 0
+ $Requests = foreach ($User in $Users) {
+ @{
+ id = $int++
+ method = 'PATCH'
+ url = "users/$($User.userId)"
+ body = @{
+ "$($Schema.id)" = $User.Properties
+ }
+ 'headers' = @{
+ 'Content-Type' = 'application/json'
+ }
+ }
+ }
+
+ if ($PSCmdlet.ShouldProcess("User: $($Users.userId -join ', ')", 'Set Schema Properties')) {
+ $Requests = New-GraphBulkRequest -tenantid $tenantfilter -Requests @($Requests)
+ }
+}
\ No newline at end of file
diff --git a/Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1 b/Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1
index 5b73e19eae98..6e941c7608cd 100644
--- a/Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1
+++ b/Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1
@@ -43,7 +43,7 @@ function Get-CIPPStandards {
if ($StandardsTenant.Standards.OverrideAllTenants.remediate -ne $true) {
#Write-Host 'AllTenant Standards apply to this tenant.'
foreach ($StandardName in $StandardsAllTenants.Standards.PSObject.Properties.Name) {
- $CurrentStandard = $StandardsAllTenants.Standards.$StandardName
+ $CurrentStandard = $StandardsAllTenants.Standards.$StandardName.PSObject.Copy()
#Write-Host ($CurrentStandard | ConvertTo-Json -Depth 10)
if ($CurrentStandard.remediate -eq $true -or $CurrentStandard.alert -eq $true -or $CurrentStandard.report -eq $true) {
#Write-Host "AllTenant Standard $StandardName"
@@ -54,16 +54,16 @@ function Get-CIPPStandards {
foreach ($StandardName in $StandardsTenant.Standards.PSObject.Properties.Name) {
if ($StandardName -eq 'OverrideAllTenants') { continue }
- $CurrentStandard = $StandardsTenant.Standards.$StandardName
+ $CurrentStandard = $StandardsTenant.Standards.$StandardName.PSObject.Copy()
if ($CurrentStandard.remediate -eq $true -or $CurrentStandard.alert -eq $true -or $CurrentStandard.report -eq $true) {
- #Write-Host "`r`nTenant: $StandardName"
+ # Write-Host "`r`nTenant: $StandardName"
if (!$ComputedStandards[$StandardName] ) {
#Write-Host "Applying tenant level $StandardName"
$ComputedStandards[$StandardName] = $CurrentStandard
} else {
foreach ($Setting in $CurrentStandard.PSObject.Properties.Name) {
- #Write-Host "$Setting - Current: $($CurrentStandard.$Setting) | Computed: $($ComputedStandards[$StandardName].$($Setting))"
+ # Write-Host "$Setting - Current: $($CurrentStandard.$Setting) | Computed: $($ComputedStandards[$StandardName].$($Setting))"
if ($CurrentStandard.$Setting -ne $false -and $CurrentStandard.$Setting -ne $ComputedStandards[$StandardName].$($Setting) -and ![string]::IsNullOrEmpty($CurrentStandard.$Setting)) {
#Write-Host "Overriding $Setting for $StandardName at tenant level"
if ($ComputedStandards[$StandardName].PSObject.Properties.Name -contains $Setting) {
@@ -76,12 +76,13 @@ function Get-CIPPStandards {
}
}
}
- }
- foreach ($Standard in $ComputedStandards.Keys) {
- [pscustomobject]@{
- Tenant = $Tenant.defaultDomainName
- Standard = $Standard
- Settings = $ComputedStandards.$Standard
+
+ foreach ($Standard in $ComputedStandards.Keys) {
+ [pscustomobject]@{
+ Tenant = $Tenant.defaultDomainName
+ Standard = $Standard
+ Settings = $ComputedStandards.$Standard
+ }
}
}
}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPConfig.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPConfig.ps1
index 6311c6680421..b6ffea3946d5 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPConfig.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAPConfig.ps1
@@ -12,7 +12,7 @@ function Invoke-CIPPStandardAPConfig {
Write-Host $($settings | ConvertTo-Json -Depth 100)
if ($settings.NotLocalAdmin -eq $true) { $usertype = 'Standard' } else { $usertype = 'Administrator' }
$DeploymentMode = if ($settings.DeploymentMode -eq 'true') { 'shared' } else { 'singleUser' }
- Set-CIPPDefaultAPDeploymentProfile -tenantFilter $tenant -displayname $settings.DisplayName -description $settings.Description -usertype $usertype -DeploymentMode $DeploymentMode -assignto $settings.Assignto -devicenameTemplate $Settings.DeviceNameTemplate -allowWhiteGlove $Settings.allowWhiteGlove -CollectHash $Settings.CollectHash -hideChangeAccount $Settings.HideChangeAccount -hidePrivacy $Settings.HidePrivacy -hideTerms $Settings.HideTerms -Autokeyboard $Settings.Autokeyboard
+ Set-CIPPDefaultAPDeploymentProfile -tenantFilter $tenant -displayname $settings.DisplayName -description $settings.Description -usertype $usertype -DeploymentMode $DeploymentMode -assignto $settings.Assignto -devicenameTemplate $Settings.DeviceNameTemplate -allowWhiteGlove $Settings.allowWhiteGlove -CollectHash $Settings.CollectHash -hideChangeAccount $Settings.HideChangeAccount -hidePrivacy $Settings.HidePrivacy -hideTerms $Settings.HideTerms -Autokeyboard $Settings.Autokeyboard -Language $Settings.languages.value
} catch {
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
#Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create Default Autopilot config: $ErrorMessage" -sev 'Error'
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
index 90d632232fe6..29d1862ecb01 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
@@ -4,41 +4,61 @@ function Invoke-CIPPStandardActivityBasedTimeout {
Internal
#>
param($Tenant, $Settings)
- $State = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies' -tenantid $tenant).id
+
+ if ($Settings.timeout -eq 'Select a value') {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'No value selected for Activity Based Timeout' -sev Error
+ Exit
+ }
+
+ # Backwards compatibility for v5.7.0 and older
+ if ($null -eq $Settings.timeout ) { $Settings.timeout = '01:00:00' }
+
+ $State = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies' -tenantid $tenant
+ $StateIsCorrect = $State.definition -like "*$($Settings.timeout)*"
If ($Settings.remediate -eq $true) {
try {
- if (!$State) {
- $body = @'
-{
- "displayName": "DefaultTimeoutPolicy",
- "isOrganizationDefault": true,
- "definition":["{\"ActivityBasedTimeoutPolicy\":{\"Version\":1,\"ApplicationPolicies\":[{\"ApplicationId\":\"default\",\"WebSessionIdleTimeout\":\"01:00:00\"}]}}"]
-}
-'@
+ if (!$StateIsCorrect) {
+ $PolicyTemplate = @{
+ displayName = 'DefaultTimeoutPolicy'
+ isOrganizationDefault = $true
+ definition = @(
+ "{`"ActivityBasedTimeoutPolicy`":{`"Version`":1,`"ApplicationPolicies`":[{`"ApplicationId`":`"default`",`"WebSessionIdleTimeout`":`"$($Settings.timeout)`"}]}}"
+ )
+ }
+ $body = ConvertTo-Json -InputObject $PolicyTemplate -Depth 10 -Compress
- New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies' -Type POST -Body $body -ContentType 'application/json'
- Write-LogMessage -API 'Standards' -tenant $tenant -message 'Enabled Activity Based Timeout of one hour' -sev Info
+ # Switch between parameter sets if the policy already exists
+ if ($null -eq $State.id) {
+ $RequestType = 'POST'
+ $URI = 'https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies'
+ } else {
+ $RequestType = 'PATCH'
+ $URI = "https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies/$($State.id)"
+ }
+ New-GraphPostRequest -tenantid $tenant -Uri $URI -Type $RequestType -Body $body -ContentType 'application/json'
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Enabled Activity Based Timeout with a value of $($Settings.timeout)" -sev Info
} else {
- Write-LogMessage -API 'Standards' -tenant $tenant -message 'Activity Based Timeout is already enabled' -sev Info
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Activity Based Timeout is already enabled and set to $($Settings.timeout)" -sev Info
}
} catch {
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
- Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to enable Activity Based Timeout $ErrorMessage" -sev Error
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to enable Activity Based Timeout a value of $($Settings.timeout). Error: $ErrorMessage" -sev Error
}
}
if ($Settings.alert -eq $true) {
- if ($State) {
- Write-LogMessage -API 'Standards' -tenant $tenant -message 'Activity Based Timeout is enabled' -sev Info
+ if ($StateIsCorrect) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Activity Based Timeout is enabled and set to $($Settings.timeout)" -sev Info
} else {
- Write-LogMessage -API 'Standards' -tenant $tenant -message 'Activity Based Timeout is not enabled' -sev Alert
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Activity Based Timeout is not set to $($Settings.timeout)" -sev Alert
}
}
if ($Settings.report -eq $true) {
- Add-CIPPBPAField -FieldName 'ActivityBasedTimeout' -FieldValue $state -StoreAs bool -Tenant $tenant
+
+ Add-CIPPBPAField -FieldName 'ActivityBasedTimeout' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
}
}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1
index b4673244d148..d4b8bd35166c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1
@@ -5,7 +5,7 @@ function Invoke-CIPPStandardAddDKIM {
#>
param($Tenant, $Settings)
- $AllDomains = (New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/domains?$top=999' -tenantid $Tenant | Where-Object { $_.supportedServices -contains 'Email' }).id
+ $AllDomains = (New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/domains?$top=999' -tenantid $Tenant | Where-Object { $_.supportedServices -contains 'Email' -or $_.id -like '*mail.onmicrosoft.com' }).id
$DKIM = (New-ExoRequest -tenantid $tenant -cmdlet 'Get-DkimSigningConfig') | Select-Object Domain, Enabled, Status
# List of domains for each way to enable DKIM
@@ -18,6 +18,8 @@ function Invoke-CIPPStandardAddDKIM {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'DKIM is already enabled for all available domains.' -sev Info
} else {
$ErrorCounter = 0
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Trying to enable DKIM for:$($NewDomains -join ', ' ) $($SetDomains.Domain -join ', ')" -sev Info
+
# New-domains
$Request = $NewDomains | ForEach-Object {
@{
@@ -27,8 +29,7 @@ function Invoke-CIPPStandardAddDKIM {
}
}
}
-
- $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray @($Request) -useSystemMailbox $true
+ if ($null -ne $Request) { $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray @($Request) -useSystemMailbox $true }
$BatchResults | ForEach-Object {
if ($_.error) {
$ErrorCounter ++
@@ -36,29 +37,31 @@ function Invoke-CIPPStandardAddDKIM {
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to enable DKIM. Error: $ErrorMessage" -sev Error
}
}
+
# Set-domains
$Request = $SetDomains | ForEach-Object {
@{
CmdletInput = @{
CmdletName = 'Set-DkimSigningConfig'
- Parameters = @{ Identity = $Domain.Domain; Enabled = $true }
+ Parameters = @{ Identity = $_.Domain; Enabled = $true }
}
}
}
-
- $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray @($Request) -useSystemMailbox $true
+ if ($null -ne $Request) { $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray @($Request) -useSystemMailbox $true }
$BatchResults | ForEach-Object {
if ($_.error) {
+ $ErrorCounter ++
$ErrorMessage = Get-NormalizedError -Message $_.error
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to set DKIM. Error: $ErrorMessage" -sev Error
- $ErrorCounter ++
}
+ }
- if ($ErrorCounter -eq 0) {
- Write-LogMessage -API 'Standards' -tenant $tenant -message 'Enabled DKIM for all domains in tenant' -sev Info
- } else {
- Write-LogMessage -API 'Standards' -tenant $tenant -message 'Failed to enable DKIM for all domains in tenant' -sev Error
- }
+ if ($ErrorCounter -eq 0) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'Enabled DKIM for all domains in tenant' -sev Info
+ } elseif ($ErrorCounter -gt 0 -and $ErrorCounter -lt ($NewDomains.Count + $SetDomains.Count)) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'Failed to enable DKIM for some domains in tenant' -sev Error
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'Failed to enable DKIM for all domains in tenant' -sev Error
}
}
}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
index b96e9f47ec89..1eeb304a0768 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
@@ -1,80 +1,119 @@
-function Invoke-CIPPStandardAntiPhishPolicy {
- <#
- .FUNCTIONALITY
- Internal
- #>
-
- param($Tenant, $Settings)
- $PolicyName = 'Default Anti-Phishing Policy'
-
- $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AntiPhishPolicy' |
- Where-Object -Property Name -EQ $PolicyName |
- Select-Object Name, Enabled, PhishThresholdLevel, EnableMailboxIntelligence, EnableMailboxIntelligenceProtection, EnableSpoofIntelligence, EnableFirstContactSafetyTips, EnableSimilarUsersSafetyTips, EnableSimilarDomainsSafetyTips, EnableUnusualCharactersSafetyTips, EnableUnauthenticatedSender, EnableViaTag, MailboxIntelligenceProtectionAction, MailboxIntelligenceQuarantineTag
-
- $StateIsCorrect = ($CurrentState.Name -eq $PolicyName) -and
- ($CurrentState.Enabled -eq $true) -and
- ($CurrentState.PhishThresholdLevel -eq $Settings.PhishThresholdLevel) -and
- ($CurrentState.EnableMailboxIntelligence -eq $true) -and
- ($CurrentState.EnableMailboxIntelligenceProtection -eq $true) -and
- ($CurrentState.EnableSpoofIntelligence -eq $true) -and
- ($CurrentState.EnableFirstContactSafetyTips -eq $Settings.EnableFirstContactSafetyTips) -and
- ($CurrentState.EnableSimilarUsersSafetyTips -eq $Settings.EnableSimilarUsersSafetyTips) -and
- ($CurrentState.EnableSimilarDomainsSafetyTips -eq $Settings.EnableSimilarDomainsSafetyTips) -and
- ($CurrentState.EnableUnusualCharactersSafetyTips -eq $Settings.EnableUnusualCharactersSafetyTips) -and
- ($CurrentState.EnableUnauthenticatedSender -eq $true) -and
- ($CurrentState.EnableViaTag -eq $true) -and
- ($CurrentState.MailboxIntelligenceProtectionAction -eq $Settings.MailboxIntelligenceProtectionAction) -and
- ($CurrentState.MailboxIntelligenceQuarantineTag -eq $Settings.MailboxIntelligenceQuarantineTag)
-
- if ($Settings.remediate -eq $true) {
- if ($StateIsCorrect -eq $true) {
- Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Anti-phishing Policy already correctly configured' -sev Info
- } else {
- $cmdparams = @{
- Enabled = $true
- PhishThresholdLevel = $Settings.PhishThresholdLevel
- EnableMailboxIntelligence = $true
- EnableMailboxIntelligenceProtection = $true
- EnableSpoofIntelligence = $true
- EnableFirstContactSafetyTips = $Settings.EnableFirstContactSafetyTips
- EnableSimilarUsersSafetyTips = $Settings.EnableSimilarUsersSafetyTips
- EnableSimilarDomainsSafetyTips = $Settings.EnableSimilarDomainsSafetyTips
- EnableUnusualCharactersSafetyTips = $Settings.EnableUnusualCharactersSafetyTips
- EnableUnauthenticatedSender = $true
- EnableViaTag = $true
- MailboxIntelligenceProtectionAction = $Settings.MailboxIntelligenceProtectionAction
- MailboxIntelligenceQuarantineTag = $Settings.MailboxIntelligenceQuarantineTag
- }
-
- try {
- if ($CurrentState.Name -eq $PolicyName) {
- $cmdparams.Add('Identity', $PolicyName)
- New-ExoRequest -tenantid $Tenant -cmdlet 'Set-AntiPhishPolicy' -cmdparams $cmdparams
- Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Updated Anti-phishing Policy' -sev Info
- } else {
- $cmdparams.Add('Name', $PolicyName)
- New-ExoRequest -tenantid $Tenant -cmdlet 'New-AntiPhishPolicy' -cmdparams $cmdparams
- Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Created Anti-phishing Policy' -sev Info
- }
- } catch {
- $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
- Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Anti-phishing Policy. Error: $ErrorMessage" -sev Error
- }
- }
- }
-
-
- if ($Settings.alert -eq $true) {
-
- if ($StateIsCorrect -eq $true) {
- Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Anti-phishing Policy is enabled' -sev Info
- } else {
- Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Anti-phishing Policy is not enabled' -sev Alert
- }
- }
-
- if ($Settings.report -eq $true) {
- Add-CIPPBPAField -FieldName 'AntiPhishPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
- }
-
-}
\ No newline at end of file
+function Invoke-CIPPStandardAntiPhishPolicy {
+ <#
+ .FUNCTIONALITY
+ Internal
+ #>
+
+ param($Tenant, $Settings)
+ $PolicyName = 'Default Anti-Phishing Policy'
+
+ $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AntiPhishPolicy' |
+ Where-Object -Property Name -EQ $PolicyName |
+ Select-Object Name, Enabled, PhishThresholdLevel, EnableMailboxIntelligence, EnableMailboxIntelligenceProtection, EnableSpoofIntelligence, EnableFirstContactSafetyTips, EnableSimilarUsersSafetyTips, EnableSimilarDomainsSafetyTips, EnableUnusualCharactersSafetyTips, EnableUnauthenticatedSender, EnableViaTag, MailboxIntelligenceProtectionAction, MailboxIntelligenceQuarantineTag
+
+ $StateIsCorrect = ($CurrentState.Name -eq $PolicyName) -and
+ ($CurrentState.Enabled -eq $true) -and
+ ($CurrentState.PhishThresholdLevel -eq $Settings.PhishThresholdLevel) -and
+ ($CurrentState.EnableMailboxIntelligence -eq $true) -and
+ ($CurrentState.EnableMailboxIntelligenceProtection -eq $true) -and
+ ($CurrentState.EnableSpoofIntelligence -eq $true) -and
+ ($CurrentState.EnableFirstContactSafetyTips -eq $Settings.EnableFirstContactSafetyTips) -and
+ ($CurrentState.EnableSimilarUsersSafetyTips -eq $Settings.EnableSimilarUsersSafetyTips) -and
+ ($CurrentState.EnableSimilarDomainsSafetyTips -eq $Settings.EnableSimilarDomainsSafetyTips) -and
+ ($CurrentState.EnableUnusualCharactersSafetyTips -eq $Settings.EnableUnusualCharactersSafetyTips) -and
+ ($CurrentState.EnableUnauthenticatedSender -eq $true) -and
+ ($CurrentState.EnableViaTag -eq $true) -and
+ ($CurrentState.MailboxIntelligenceProtectionAction -eq $Settings.MailboxIntelligenceProtectionAction) -and
+ ($CurrentState.MailboxIntelligenceQuarantineTag -eq $Settings.MailboxIntelligenceQuarantineTag) -and
+ ($CurrentState.TargetedUserProtectionAction -eq $Settings.TargetedUserProtectionAction) -and
+ ($CurrentState.TargetedDomainProtectionAction -eq $Settings.TargetedDomainProtectionAction) -and
+ ($CurrentState.EnableOrganizationDomainsProtection -eq $true)
+
+ $AcceptedDomains = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AcceptedDomain'
+
+ $RuleState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AntiPhishRule' |
+ Where-Object -Property Name -EQ "CIPP $PolicyName" |
+ Select-Object Name, AntiPhishPolicy, Priority, RecipientDomainIs
+
+ $RuleStateIsCorrect = ($RuleState.Name -eq "CIPP $PolicyName") -and
+ ($RuleState.AntiPhishPolicy -eq $PolicyName) -and
+ ($RuleState.Priority -eq 0) -and
+ (!(Compare-Object -ReferenceObject $RuleState.RecipientDomainIs -DifferenceObject $AcceptedDomains.Name))
+
+ if ($Settings.remediate -eq $true) {
+ if ($StateIsCorrect -eq $true) {
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Anti-phishing Policy already correctly configured' -sev Info
+ } else {
+ $cmdparams = @{
+ Enabled = $true
+ PhishThresholdLevel = $Settings.PhishThresholdLevel
+ EnableMailboxIntelligence = $true
+ EnableMailboxIntelligenceProtection = $true
+ EnableSpoofIntelligence = $true
+ EnableFirstContactSafetyTips = $Settings.EnableFirstContactSafetyTips
+ EnableSimilarUsersSafetyTips = $Settings.EnableSimilarUsersSafetyTips
+ EnableSimilarDomainsSafetyTips = $Settings.EnableSimilarDomainsSafetyTips
+ EnableUnusualCharactersSafetyTips = $Settings.EnableUnusualCharactersSafetyTips
+ EnableUnauthenticatedSender = $true
+ EnableViaTag = $true
+ MailboxIntelligenceProtectionAction = $Settings.MailboxIntelligenceProtectionAction
+ MailboxIntelligenceQuarantineTag = $Settings.MailboxIntelligenceQuarantineTag
+ TargetedUserProtectionAction = $Settings.TargetedUserProtectionAction
+ TargetedDomainProtectionAction = $Settings.TargetedDomainProtectionAction
+ EnableOrganizationDomainsProtection = $true
+ }
+
+ try {
+ if ($CurrentState.Name -eq $PolicyName) {
+ $cmdparams.Add('Identity', $PolicyName)
+ New-ExoRequest -tenantid $Tenant -cmdlet 'Set-AntiPhishPolicy' -cmdparams $cmdparams
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Updated Anti-phishing Policy' -sev Info
+ } else {
+ $cmdparams.Add('Name', $PolicyName)
+ New-ExoRequest -tenantid $Tenant -cmdlet 'New-AntiPhishPolicy' -cmdparams $cmdparams
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Created Anti-phishing Policy' -sev Info
+ }
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Anti-phishing Policy. Error: $ErrorMessage" -sev Error
+ }
+ }
+
+ if ($RuleStateIsCorrect -eq $false) {
+ $cmdparams = @{
+ AntiPhishPolicy = $PolicyName
+ Priority = 0
+ RecipientDomainIs = $AcceptedDomains.Name
+ }
+
+ try {
+ if ($RuleState.Name -eq "CIPP $PolicyName") {
+ $cmdparams.Add('Identity', "CIPP $PolicyName")
+ New-ExoRequest -tenantid $Tenant -cmdlet 'Set-AntiPhishRule' -cmdparams $cmdparams
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Updated AntiPhish Rule' -sev Info
+ } else {
+ $cmdparams.Add('Name', "CIPP $PolicyName")
+ New-ExoRequest -tenantid $Tenant -cmdlet 'New-AntiPhishRule' -cmdparams $cmdparams
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Created AntiPhish Rule' -sev Info
+ }
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create AntiPhish Rule. Error: $ErrorMessage" -sev Error
+ }
+ }
+ }
+
+ if ($Settings.alert -eq $true) {
+
+ if ($StateIsCorrect -eq $true) {
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Anti-phishing Policy is enabled' -sev Info
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Anti-phishing Policy is not enabled' -sev Alert
+ }
+ }
+
+ if ($Settings.report -eq $true) {
+ Add-CIPPBPAField -FieldName 'AntiPhishPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
+ }
+
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1
new file mode 100644
index 000000000000..24d4a7c0ee3b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1
@@ -0,0 +1,48 @@
+function Invoke-CIPPStandardBookings {
+ <#
+ .FUNCTIONALITY
+ Internal
+ #>
+ param($Tenant, $Settings)
+
+ # Input validation
+ if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'BookingsEnabled: Invalid state parameter set' -sev Error
+ Exit
+ }
+
+ $CurrentState = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').BookingsEnabled
+ $WantedState = if ($Settings.state -eq 'true') { $true } else { $false }
+ $StateIsCorrect = if ($CurrentState -eq $WantedState) { $true } else { $false }
+
+ if ($Settings.remediate -eq $true) {
+ Write-Host 'Time to remediate'
+ if ($StateIsCorrect -eq $false) {
+ try {
+ New-ExoRequest -tenantid $Tenant -cmdlet 'Set-OrganizationConfig' -cmdParams @{ BookingsEnabled = $WantedState } -useSystemMailbox $true
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully set the tenant Bookings state to $($Settings.state)" -sev Info
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to set the tenant Bookings state to $($Settings.state). Error: $ErrorMessage" -sev Error
+ }
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "The tenant Bookings state is already set correctly to $($Settings.state)" -sev Info
+ }
+
+ }
+
+ if ($Settings.alert -eq $true) {
+ if ($StateIsCorrect -eq $true) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "The tenant Bookings is set correctly to $($Settings.state)" -sev Info
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "The tenant Bookings is not set correctly to $($Settings.state)" -sev Alert
+ }
+ }
+
+ if ($Settings.report -eq $true) {
+ # Default is not set, not set means it's enabled
+ if ($null -eq $CurrentState ) { $CurrentState = $true }
+ Add-CIPPBPAField -FieldName 'BookingsState' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
+ }
+
+}
\ No newline at end of file
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
new file mode 100644
index 000000000000..4994b6cf91c1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
@@ -0,0 +1,48 @@
+function Invoke-CIPPStandardCloudMessageRecall {
+ <#
+ .FUNCTIONALITY
+ Internal
+ #>
+ param($Tenant, $Settings)
+
+ # Input validation
+ if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'MessageRecallEnabled: Invalid state parameter set' -sev Error
+ Exit
+ }
+
+ $CurrentState = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').MessageRecallEnabled
+ $WantedState = if ($Settings.state -eq 'true') { $true } else { $false }
+ $StateIsCorrect = if ($CurrentState -eq $WantedState) { $true } else { $false }
+
+ if ($Settings.remediate -eq $true) {
+ Write-Host 'Time to remediate'
+ if ($StateIsCorrect -eq $false) {
+ try {
+ New-ExoRequest -tenantid $Tenant -cmdlet 'Set-OrganizationConfig' -cmdParams @{ MessageRecallEnabled = $WantedState } -useSystemMailbox $true
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully set the tenant Message Recall state to $($Settings.state)" -sev Info
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to set the tenant Message Recall state to $($Settings.state). Error: $ErrorMessage" -sev Error
+ }
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "The tenant Message Recall state is already set correctly to $($Settings.state)" -sev Info
+ }
+
+ }
+
+ if ($Settings.alert -eq $true) {
+ if ($StateIsCorrect -eq $true) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "The tenant Message Recall is set correctly to $($Settings.state)" -sev Info
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "The tenant Message Recall is not set correctly to $($Settings.state)" -sev Alert
+ }
+ }
+
+ if ($Settings.report -eq $true) {
+ # Default is not set, not set means it's enabled
+ if ($null -eq $CurrentState ) { $CurrentState = $true }
+ Add-CIPPBPAField -FieldName 'MessageRecall' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
+ }
+
+}
\ No newline at end of file
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
index 0407d9b3555e..b8ee94aafe9b 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
@@ -6,12 +6,13 @@ function Invoke-CIPPStandardDelegateSentItems {
param($Tenant, $Settings)
$Mailboxes = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' -cmdParams @{ RecipientTypeDetails = @('UserMailbox', 'SharedMailbox') } |
Where-Object { $_.MessageCopyForSendOnBehalfEnabled -eq $false -or $_.MessageCopyForSentAsEnabled -eq $false }
-
+ Write-Host "Mailboxes: $($Mailboxes.count)"
If ($Settings.remediate -eq $true) {
+ Write-Host 'Time to remediate'
if ($Mailboxes) {
try {
- $Request = $mailboxes | ForEach-Object {
+ $Request = $Mailboxes | ForEach-Object {
@{
CmdletInput = @{
CmdletName = 'Set-Mailbox'
@@ -19,7 +20,7 @@ function Invoke-CIPPStandardDelegateSentItems {
}
}
}
- $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray $Request
+ $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray @($Request)
$BatchResults | ForEach-Object {
if ($_.error) {
$ErrorMessage = Get-NormalizedError -Message $_.error
@@ -27,6 +28,7 @@ function Invoke-CIPPStandardDelegateSentItems {
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to apply Delegate Sent Items Style to $($_.error.target) Error: $ErrorMessage" -sev Error
}
}
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Delegate Sent Items Style applied for $($Mailboxes.count - $BatchResults.Error.Count) mailboxes" -sev Info
} catch {
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to apply Delegate Sent Items Style. Error: $ErrorMessage" -sev Error
@@ -38,7 +40,7 @@ function Invoke-CIPPStandardDelegateSentItems {
}
if ($Settings.alert -eq $true) {
if ($Mailboxes) {
- Write-LogMessage -API 'Standards' -tenant $tenant -message "Delegate Sent Items Style is not enabled for $($mailboxes.count) mailboxes" -sev Alert
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Delegate Sent Items Style is not enabled for $($Mailboxes.count) mailboxes" -sev Alert
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Delegate Sent Items Style is enabled' -sev Info
}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1
index a7d8bd090172..b5741d27ac4d 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1
@@ -7,6 +7,7 @@ function Invoke-CIPPStandardEnableCustomerLockbox {
$CustomerLockboxStatus = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').CustomerLockboxEnabled
if ($Settings.remediate -eq $true) {
+ Write-Host 'Time to remediate'
try {
if ($CustomerLockboxStatus) {
@@ -17,7 +18,11 @@ function Invoke-CIPPStandardEnableCustomerLockbox {
}
} catch {
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
- Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to enable Customer Lockbox. Error: $ErrorMessage" -sev Error
+ if ($ErrorMessage -match 'Ex5E8EA4') {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to enable Customer Lockbox. E5 license required. Error: $ErrorMessage" -sev Error
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to enable Customer Lockbox. Error: $ErrorMessage" -sev Error
+ }
}
}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
index 516af7e005ed..05ab9cfbd117 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
@@ -14,7 +14,7 @@ function Invoke-CIPPStandardEnableMailTips {
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'All MailTips are already enabled.' -sev Info
} else {
try {
- New-ExoRequest -tenantid $Tenant -cmdlet 'Set-OrganizationConfig' -cmdparams @{ MailTipsAllTipsEnabled = $true; MailTipsExternalRecipientsTipsEnabled = $true; MailTipsGroupMetricsEnabled = $true; MailTipsLargeAudienceThreshold = $Settings.MailTipsLargeAudienceThreshold }
+ New-ExoRequest -useSystemMailbox $true -tenantid $Tenant -cmdlet 'Set-OrganizationConfig' -cmdparams @{ MailTipsAllTipsEnabled = $true; MailTipsExternalRecipientsTipsEnabled = $true; MailTipsGroupMetricsEnabled = $true; MailTipsLargeAudienceThreshold = $Settings.MailTipsLargeAudienceThreshold }
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Enabled all MailTips' -sev Info
} catch {
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
index 460569529242..9181ae888e66 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
@@ -32,7 +32,7 @@ function Invoke-CIPPStandardEnableMailboxAuditing {
}
}
- $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray $Request
+ $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray @($Request)
$BatchResults | ForEach-Object {
if ($_.error) {
$ErrorMessage = Get-NormalizedError -Message $_.error
@@ -53,7 +53,7 @@ function Invoke-CIPPStandardEnableMailboxAuditing {
}
}
- $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray $Request
+ $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray @($Request)
$BatchResults | ForEach-Object {
if ($_.error) {
$ErrorMessage = Get-NormalizedError -Message $_.error
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1
index 92e387dc07ef..3c3dbd004c45 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1
@@ -26,7 +26,7 @@ function Invoke-CIPPStandardEnableOnlineArchiving {
}
}
- $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray $Request
+ $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray @($Request)
$BatchResults | ForEach-Object {
if ($_.error) {
$ErrorMessage = Get-NormalizedError -Message $_.error
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
new file mode 100644
index 000000000000..56d5c8a1815e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
@@ -0,0 +1,52 @@
+function Invoke-CIPPStandardEnablePronouns {
+ <#
+ .FUNCTIONALITY
+ Internal
+ #>
+ param ($Tenant, $Settings)
+
+ $Uri = 'https://graph.microsoft.com/v1.0/admin/people/pronouns'
+ try {
+ $CurrentState = New-GraphGetRequest -Uri $Uri -tenantid $Tenant
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message "Could not get CurrentState for Pronouns. Error: $ErrorMessage" -sev Error
+ Exit
+ }
+ Write-Host $CurrentState
+
+ if ($Settings.remediate -eq $true) {
+ Write-Host 'Time to remediate'
+
+ if ($CurrentState.isEnabledInOrganization -eq $true) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'Pronouns are already enabled.' -sev Info
+ } else {
+ $CurrentState.isEnabledInOrganization = $true
+ try {
+ $Body = ConvertTo-Json -InputObject $CurrentState -Depth 10 -Compress
+ New-GraphPostRequest -Uri $Uri -tenantid $Tenant -Body $Body -type PATCH
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'Enabled pronouns.' -sev Info
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to enable pronouns. Error: $ErrorMessage" -sev Error
+ }
+ }
+ }
+
+ if ($Settings.alert -eq $true) {
+
+ if ($CurrentState.isEnabledInOrganization -eq $true) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'Pronouns are enabled.' -sev Info
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'Pronouns are not enabled.' -sev Alert
+ }
+
+ }
+
+ if ($Settings.report -eq $true) {
+
+ Add-CIPPBPAField -FieldName 'PronounsEnabled' -FieldValue $CurrentState.isEnabledInOrganization -StoreAs bool -Tenant $tenant
+
+ }
+
+}
\ No newline at end of file
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
index 5a78adfa373a..9263b386bb23 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
@@ -60,7 +60,7 @@ function Invoke-CIPPStandardIntuneTemplate {
$DeleteJson.added = @()
$DeleteJson = ConvertTo-Json -Depth 10 -InputObject $DeleteJson
$DeleteRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($existingId.id)')/updateDefinitionValues" -tenantid $tenant -type POST -body $DeleteJson
- $UpdateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($existingId.id)')/updateDefinitionValues" -tenantid $tenant -type POST -body $RawJSON
+ $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL('$($existingId.id)')/updateDefinitionValues" -tenantid $tenant -type POST -body $RawJSON
Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Updated policy $($Displayname) to template defaults" -Sev 'info'
} else {
@@ -98,6 +98,19 @@ function Invoke-CIPPStandardIntuneTemplate {
Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($PolicyName) via template" -Sev 'info'
}
}
+ 'windowsDriverUpdateProfiles' {
+ $TemplateTypeURL = 'windowsDriverUpdateProfiles'
+ $PolicyName = ($RawJSON | ConvertFrom-Json).Name
+ $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant
+ if ($PolicyName -in $CheckExististing.name) {
+ $ExistingID = $CheckExististing | Where-Object -Property Name -EQ $PolicyName
+ $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL/$($ExistingID.Id)" -tenantid $tenant -type PUT -body $RawJSON
+
+ } else {
+ $CreateRequest = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$TemplateTypeURL" -tenantid $tenant -type POST -body $RawJSON
+ Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -tenant $($Tenant) -message "Added policy $($PolicyName) via template" -Sev 'info'
+ }
+ }
}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
index 178c5b048861..d9ae65ac222f 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
@@ -9,11 +9,12 @@ function Invoke-CIPPStandardMalwareFilterPolicy {
$CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-MalwareFilterPolicy' |
Where-Object -Property Name -EQ $PolicyName |
- Select-Object Name, EnableFileFilter, FileTypeAction, ZapEnabled, QuarantineTag, EnableInternalSenderAdminNotifications, InternalSenderAdminAddress, EnableExternalSenderAdminNotifications, ExternalSenderAdminAddress
+ Select-Object Name, EnableFileFilter, FileTypeAction, FileTypes, ZapEnabled, QuarantineTag, EnableInternalSenderAdminNotifications, InternalSenderAdminAddress, EnableExternalSenderAdminNotifications, ExternalSenderAdminAddress
$StateIsCorrect = ($CurrentState.Name -eq $PolicyName) -and
($CurrentState.EnableFileFilter -eq $true) -and
($CurrentState.FileTypeAction -eq $Settings.FileTypeAction) -and
+ ($null -ne $CurrentState.FileTypes) -and
($CurrentState.ZapEnabled -eq $true) -and
($CurrentState.QuarantineTag -eq $Settings.QuarantineTag) -and
($CurrentState.EnableInternalSenderAdminNotifications -eq $Settings.EnableInternalSenderAdminNotifications) -and
@@ -21,6 +22,17 @@ function Invoke-CIPPStandardMalwareFilterPolicy {
($CurrentState.EnableExternalSenderAdminNotifications -eq $Settings.EnableExternalSenderAdminNotifications) -and
(($null -eq $Settings.ExternalSenderAdminAddress) -or ($CurrentState.ExternalSenderAdminAddress -eq $Settings.ExternalSenderAdminAddress))
+ $AcceptedDomains = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AcceptedDomain'
+
+ $RuleState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-MalwareFilterRule' |
+ Where-Object -Property Name -EQ "CIPP $PolicyName" |
+ Select-Object Name, MalwareFilterPolicy, Priority, RecipientDomainIs
+
+ $RuleStateIsCorrect = ($RuleState.Name -eq "CIPP $PolicyName") -and
+ ($RuleState.MalwareFilterPolicy -eq $PolicyName) -and
+ ($RuleState.Priority -eq 0) -and
+ (!(Compare-Object -ReferenceObject $RuleState.RecipientDomainIs -DifferenceObject $AcceptedDomains.Name))
+
if ($Settings.remediate -eq $true) {
if ($StateIsCorrect -eq $true) {
@@ -37,6 +49,12 @@ function Invoke-CIPPStandardMalwareFilterPolicy {
ExternalSenderAdminAddress = $Settings.ExternalSenderAdminAddress
}
+ if ($null -eq $CurrentState.FileTypes) {
+ $cmdparams.Add('FileTypes', @('ace', 'ani', 'apk', 'app', 'appx', 'arj', 'bat', 'cab', 'cmd', 'com', 'deb', 'dex', 'dll', 'docm', 'elf', 'exe', 'hta', 'img', 'iso', 'jar', 'jnlp', 'kext', 'lha', 'lib', 'library', 'lnk', 'lzh', 'macho', 'msc', 'msi', 'msix', 'msp', 'mst', 'pif', 'ppa', 'ppam', 'reg', 'rev', 'scf', 'scr', 'sct', 'sys', 'uif', 'vb', 'vbe', 'vbs', 'vxd', 'wsc', 'wsf', 'wsh', 'xll', 'xz', 'z'))
+ } else {
+ $cmdparams.Add('FileTypes', $CurrentState.FileTypes)
+ }
+
try {
if ($CurrentState.Name -eq $PolicyName) {
$cmdparams.Add('Identity', $PolicyName)
@@ -52,6 +70,29 @@ function Invoke-CIPPStandardMalwareFilterPolicy {
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Malware Filter Policy. Error: $ErrorMessage" -sev Error
}
}
+
+ if ($RuleStateIsCorrect -eq $false) {
+ $cmdparams = @{
+ MalwareFilterPolicy = $PolicyName
+ Priority = 0
+ RecipientDomainIs = $AcceptedDomains.Name
+ }
+
+ try {
+ if ($RuleState.Name -eq "CIPP $PolicyName") {
+ $cmdparams.Add('Identity', "CIPP $PolicyName")
+ New-ExoRequest -tenantid $Tenant -cmdlet 'Set-MalwareFilterRule' -cmdparams $cmdparams
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Updated Malware Filter Rule' -sev Info
+ } else {
+ $cmdparams.Add('Name', "CIPP $PolicyName")
+ New-ExoRequest -tenantid $Tenant -cmdlet 'New-MalwareFilterRule' -cmdparams $cmdparams
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Created Malware Filter Rule' -sev Info
+ }
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Malware Filter Rule. Error: $ErrorMessage" -sev Error
+ }
+ }
}
if ($Settings.alert -eq $true) {
@@ -67,4 +108,4 @@ function Invoke-CIPPStandardMalwareFilterPolicy {
Add-CIPPBPAField -FieldName 'MalwareFilterPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
}
-}
\ No newline at end of file
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
index 473a75ab15c7..e3c7d190e072 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
@@ -8,7 +8,7 @@ function Invoke-CIPPStandardNudgeMFA {
$State = if ($CurrentInfo.registrationEnforcement.authenticationMethodsRegistrationCampaign.state -eq 'enabled') { $true } else { $false }
If ($Settings.remediate -eq $true) {
-
+ $StateName = $Settings.state.Substring(0, 1).ToUpper() + $Settings.state.Substring(1)
if ($Settings.state -ne $CurrentInfo.registrationEnforcement.authenticationMethodsRegistrationCampaign.state -or $Settings.snoozeDurationInDays -ne $CurrentInfo.registrationEnforcement.authenticationMethodsRegistrationCampaign.snoozeDurationInDays) {
try {
$Body = $CurrentInfo
@@ -17,12 +17,12 @@ function Invoke-CIPPStandardNudgeMFA {
$body = ConvertTo-Json -Depth 10 -InputObject ($body | Select-Object registrationEnforcement)
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy' -Type patch -Body $body -ContentType 'application/json'
- Write-LogMessage -API 'Standards' -tenant $tenant -message "$($Settings.state) Authenticator App Nudge with a snooze duration of $($Settings.snoozeDurationInDays)" -sev Info
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "$StateName Authenticator App Nudge with a snooze duration of $($Settings.snoozeDurationInDays)" -sev Info
$CurrentInfo.registrationEnforcement.authenticationMethodsRegistrationCampaign.state = $Settings.state
$CurrentInfo.registrationEnforcement.authenticationMethodsRegistrationCampaign.snoozeDurationInDays = $Settings.snoozeDurationInDays
} catch {
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
- Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to $($Settings.state) Authenticator App Nudge: $ErrorMessage" -sev Error
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to set Authenticator App Nudge to $($Settings.state): $ErrorMessage" -sev Error
}
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message "Authenticator App Nudge is already set to $($Settings.state) with a snooze duration of $($Settings.snoozeDurationInDays)" -sev Info
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
index 235feac18ab3..d62e02a3a223 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
@@ -8,9 +8,9 @@ function Invoke-CIPPStandardOauthConsent {
$StateIsCorrect = if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -eq 'managePermissionGrantsForSelf.cipp-consent-policy') { $true } else { $false }
If ($Settings.remediate -eq $true) {
- $AllowedAppIdsForTenant = $Settings.AllowedApps -split ','
+ $AllowedAppIdsForTenant = $settings.AllowedApps -split ','
try {
- if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -notin @('ManagePermissionGrantsForSelf.cipp-1sent-policy')) {
+ if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -notin @('managePermissionGrantsForSelf.cipp-consent-policy')) {
$Existing = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies/' -tenantid $tenant) | Where-Object -Property id -EQ 'cipp-consent-policy'
if (!$Existing) {
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/permissionGrantPolicies' -Type POST -Body '{ "id":"cipp-consent-policy", "displayName":"Application Consent Policy", "description":"This policy controls the current application consent policies."}' -ContentType 'application/json'
@@ -27,9 +27,7 @@ function Invoke-CIPPStandardOauthConsent {
}
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -Type PATCH -Body '{"permissionGrantPolicyIdsAssignedToDefaultUserRole":["managePermissionGrantsForSelf.cipp-consent-policy"]}' -ContentType 'application/json'
}
- if ($AllowedAppIdsForTenant) {
- }
-
+
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Application Consent Mode has been enabled.' -sev Info
} catch {
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1
new file mode 100644
index 000000000000..c83204529423
--- /dev/null
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1
@@ -0,0 +1,41 @@
+function Invoke-CIPPStandardPerUserMFA {
+ <#
+ .FUNCTIONALITY
+ Internal
+ #>
+ param($Tenant, $Settings)
+
+ $GraphRequest = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$top=999&`$select=UserPrincipalName,accountEnabled" -scope 'https://graph.microsoft.com/.default' -tenantid $Tenant | Where-Object { $_.AccountEnabled -EQ $true }
+ $int = 0
+ $Requests = foreach ($id in $GraphRequest.userPrincipalName) {
+ @{
+ id = $int++
+ method = 'GET'
+ url = "/users/$id/authentication/requirements"
+ }
+ }
+ $UsersWithoutMFA = (New-GraphBulkRequest -tenantid $tenant -scope 'https://graph.microsoft.com/.default' -Requests @($Requests) -asapp $true).body | Where-Object { $_.perUserMfaState -ne 'enforced' } | Select-Object peruserMFAState, @{Name = 'UserPrincipalName'; Expression = { [System.Web.HttpUtility]::UrlDecode($_.'@odata.context'.split("'")[1]) } }
+
+ If ($Settings.remediate -eq $true) {
+ if ($UsersWithoutMFA) {
+ try {
+ $MFAMessage = Set-CIPPPeruserMFA -TenantFilter $Tenant -UserId $UsersWithoutMFA.UserPrincipalName -State 'enforced'
+ Write-LogMessage -API 'Standards' -tenant $tenant -message $MFAMessage -sev Info
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to enforce MFA for all users: $ErrorMessage" -sev Error
+ }
+ }
+ }
+ if ($Settings.alert -eq $true) {
+
+ if ($UsersWithoutMFA) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "The following accounts do not have Legacy MFA Enforced: $($UsersWithoutMFA.UserPrincipalName -join ', ')" -sev Alert
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'No accounts do not have legacy per user MFA Enforced' -sev Info
+ }
+ }
+ if ($Settings.report -eq $true) {
+ Add-CIPPBPAField -FieldName 'LegacyMFAUsers' -FieldValue $UsersWithoutMFA -StoreAs json -Tenant $tenant
+ }
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
index 24d6c424d036..1973cb4efc10 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
@@ -17,6 +17,17 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
($CurrentState.Redirect -eq $Settings.Redirect) -and
(($null -eq $Settings.RedirectAddress) -or ($CurrentState.RedirectAddress -eq $Settings.RedirectAddress))
+ $AcceptedDomains = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AcceptedDomain'
+
+ $RuleState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeAttachmentRule' |
+ Where-Object -Property Name -EQ "CIPP $PolicyName" |
+ Select-Object Name, SafeAttachmentPolicy, Priority, RecipientDomainIs
+
+ $RuleStateIsCorrect = ($RuleState.Name -eq "CIPP $PolicyName") -and
+ ($RuleState.SafeAttachmentPolicy -eq $PolicyName) -and
+ ($RuleState.Priority -eq 0) -and
+ (!(Compare-Object -ReferenceObject $RuleState.RecipientDomainIs -DifferenceObject $AcceptedDomains.Name))
+
if ($Settings.remediate -eq $true) {
if ($StateIsCorrect -eq $true) {
@@ -44,6 +55,29 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create Safe Attachment Policy. Error: $ErrorMessage" -sev Error
}
}
+
+ if ($RuleStateIsCorrect -eq $false) {
+ $cmdparams = @{
+ SafeAttachmentPolicy = $PolicyName
+ Priority = 0
+ RecipientDomainIs = $AcceptedDomains.Name
+ }
+
+ try {
+ if ($RuleState.Name -eq "CIPP $PolicyName") {
+ $cmdparams.Add('Identity', "CIPP $PolicyName")
+ New-ExoRequest -tenantid $Tenant -cmdlet 'Set-SafeAttachmentRule' -cmdparams $cmdparams
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Updated SafeAttachment Rule' -sev Info
+ } else {
+ $cmdparams.Add('Name', "CIPP $PolicyName")
+ New-ExoRequest -tenantid $Tenant -cmdlet 'New-SafeAttachmentRule' -cmdparams $cmdparams
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Created SafeAttachment Rule' -sev Info
+ }
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create SafeAttachment Rule. Error: $ErrorMessage" -sev Error
+ }
+ }
}
if ($Settings.alert -eq $true) {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
index 65471148d7c8..bd353b32e485 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
@@ -23,6 +23,17 @@ function Invoke-CIPPStandardSafeLinksPolicy {
($CurrentState.DisableUrlRewrite -eq $Settings.DisableUrlRewrite) -and
($CurrentState.EnableOrganizationBranding -eq $Settings.EnableOrganizationBranding)
+ $AcceptedDomains = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AcceptedDomain'
+
+ $RuleState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeLinksRule' |
+ Where-Object -Property Name -EQ "CIPP $PolicyName" |
+ Select-Object Name, SafeLinksPolicy, Priority, RecipientDomainIs
+
+ $RuleStateIsCorrect = ($RuleState.Name -eq "CIPP $PolicyName") -and
+ ($RuleState.SafeLinksPolicy -eq $PolicyName) -and
+ ($RuleState.Priority -eq 0) -and
+ (!(Compare-Object -ReferenceObject $RuleState.RecipientDomainIs -DifferenceObject $AcceptedDomains.Name))
+
if ($Settings.remediate -eq $true) {
if ($StateIsCorrect -eq $true) {
@@ -56,6 +67,29 @@ function Invoke-CIPPStandardSafeLinksPolicy {
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create SafeLink Policy. Error: $ErrorMessage" -sev Error
}
}
+
+ if ($RuleStateIsCorrect -eq $false) {
+ $cmdparams = @{
+ SafeLinksPolicy = $PolicyName
+ Priority = 0
+ RecipientDomainIs = $AcceptedDomains.Name
+ }
+
+ try {
+ if ($RuleState.Name -eq "CIPP $PolicyName") {
+ $cmdparams.Add('Identity', "CIPP $PolicyName")
+ New-ExoRequest -tenantid $Tenant -cmdlet 'Set-SafeLinksRule' -cmdparams $cmdparams
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Updated SafeLink Rule' -sev Info
+ } else {
+ $cmdparams.Add('Name', "CIPP $PolicyName")
+ New-ExoRequest -tenantid $Tenant -cmdlet 'New-SafeLinksRule' -cmdparams $cmdparams
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Created SafeLink Rule' -sev Info
+ }
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create SafeLink Rule. Error: $ErrorMessage" -sev Error
+ }
+ }
}
if ($Settings.alert -eq $true) {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1
index 4f01cbc8b55f..d70fe30cef99 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1
@@ -20,7 +20,7 @@ function Invoke-CIPPStandardSafeSendersDisable {
}
}
- $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray $Request
+ $BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray @($Request)
$BatchResults | ForEach-Object {
if ($_.error) {
$ErrorMessage = Get-NormalizedError -Message $_.error
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1
new file mode 100644
index 000000000000..4946b64e8b4b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1
@@ -0,0 +1,57 @@
+function Invoke-CIPPStandardShortenMeetings {
+ <#
+ .FUNCTIONALITY
+ Internal
+ #>
+ param($Tenant, $Settings)
+
+ # Input validation
+ if ([Int32]$Settings.DefaultMinutesToReduceShortEventsBy -lt 0 -or [Int32]$Settings.DefaultMinutesToReduceShortEventsBy -gt 29) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'Invalid shorten meetings settings specified. DefaultMinutesToReduceShortEventsBy must be an integer between 0 and 29' -sev Error
+ Exit
+ }
+ if ([Int32]$Settings.DefaultMinutesToReduceLongEventsBy -lt 0 -or [Int32]$Settings.DefaultMinutesToReduceLongEventsBy -gt 29) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'Invalid shorten meetings settings specified. DefaultMinutesToReduceLongEventsBy must be an integer between 0 and 29' -sev Error
+ Exit
+ }
+
+ $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig' |
+ Select-Object -Property ShortenEventScopeDefault, DefaultMinutesToReduceShortEventsBy, DefaultMinutesToReduceLongEventsBy
+ $CorrectState = if ($CurrentState.ShortenEventScopeDefault -eq $Settings.ShortenEventScopeDefault -and
+ $CurrentState.DefaultMinutesToReduceShortEventsBy -eq $Settings.DefaultMinutesToReduceShortEventsBy -and
+ $CurrentState.DefaultMinutesToReduceLongEventsBy -eq $Settings.DefaultMinutesToReduceLongEventsBy) { $true } else { $false }
+
+ if ($Settings.remediate -eq $true) {
+ Write-Host 'Time to remediate'
+
+ if ($CorrectState -eq $true) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'Shorten meetings settings are already in the correct state. ' -sev Info
+ } else {
+ try {
+ New-ExoRequest -tenantid $Tenant -cmdlet 'Set-OrganizationConfig' -cmdParams @{ShortenEventScopeDefault = $Settings.ShortenEventScopeDefault; DefaultMinutesToReduceShortEventsBy = $Settings.DefaultMinutesToReduceShortEventsBy; DefaultMinutesToReduceLongEventsBy = $Settings.DefaultMinutesToReduceLongEventsBy }
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Shorten meetings settings have been set to the following state. State: $($Settings.ShortenEventScopeDefault), Short:$($Settings.DefaultMinutesToReduceShortEventsBy), Long: $($Settings.DefaultMinutesToReduceLongEventsBy)" -sev Info
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to set shorten meetings settings. Error: $ErrorMessage" -sev Error
+ }
+ }
+ }
+
+ if ($Settings.alert -eq $true) {
+
+ if ($CorrectState -eq $true) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Shorten meetings settings are already in the correct state. Current state: $($CurrentState.ShortenEventScopeDefault), Short:$($CurrentState.DefaultMinutesToReduceShortEventsBy), Long: $($CurrentState.DefaultMinutesToReduceLongEventsBy)" -sev Info
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Shorten meetings settings are not in the correct state. Current state: $($CurrentState.ShortenEventScopeDefault), Short:$($CurrentState.DefaultMinutesToReduceShortEventsBy), Long: $($CurrentState.DefaultMinutesToReduceLongEventsBy)" -sev Alert
+ }
+ }
+
+ if ($Settings.report -eq $true) {
+
+ if ($CorrectState -eq $true) {
+ Add-CIPPBPAField -FieldName 'ShortenMeetings' -FieldValue $CorrectState -StoreAs bool -Tenant $tenant
+ } else {
+ Add-CIPPBPAField -FieldName 'ShortenMeetings' -FieldValue $CurrentState -StoreAs json -Tenant $tenant
+ }
+ }
+}
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
new file mode 100644
index 000000000000..86509c52564b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
@@ -0,0 +1,48 @@
+function Invoke-CIPPStandardTeamsMeetingsByDefault {
+ <#
+ .FUNCTIONALITY
+ Internal
+ #>
+ param($Tenant, $Settings)
+
+ # Input validation
+ if ([string]::isNullOrEmpty($Settings.state) -or $Settings.state -eq 'Select a value') {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message 'TeamsMeetingsByDefault: Invalid state parameter set' -sev Error
+ Exit
+ }
+
+ $CurrentState = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').OnlineMeetingsByDefaultEnabled
+ $WantedState = if ($Settings.state -eq 'true') { $true } else { $false }
+ $StateIsCorrect = if ($CurrentState -eq $WantedState) { $true } else { $false }
+
+ if ($Settings.remediate -eq $true) {
+ Write-Host 'Time to remediate'
+ if ($StateIsCorrect -eq $false) {
+ try {
+ New-ExoRequest -tenantid $Tenant -cmdlet 'Set-OrganizationConfig' -cmdParams @{ OnlineMeetingsByDefaultEnabled = $WantedState } -useSystemMailbox $true
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully set the tenant TeamsMeetingsByDefault state to $($Settings.state)" -sev Info
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to set the tenant TeamsMeetingsByDefault state to $($Settings.state). Error: $ErrorMessage" -sev Error
+ }
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "The tenant TeamsMeetingsByDefault state is already set correctly to $($Settings.state)" -sev Info
+ }
+
+ }
+
+ if ($Settings.alert -eq $true) {
+ if ($StateIsCorrect -eq $true) {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "The tenant TeamsMeetingsByDefault is set correctly to $($Settings.state)" -sev Info
+ } else {
+ Write-LogMessage -API 'Standards' -tenant $tenant -message "The tenant TeamsMeetingsByDefault is not set correctly to $($Settings.state)" -sev Alert
+ }
+ }
+
+ if ($Settings.report -eq $true) {
+ # Default is not set, not set means it's enabled
+ if ($null -eq $CurrentState ) { $CurrentState = $true }
+ Add-CIPPBPAField -FieldName 'TeamsMeetingsByDefault' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
+ }
+
+}
\ No newline at end of file
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1
index 83372682cbac..c0c6e0d17db3 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1
@@ -18,11 +18,11 @@ function Invoke-CIPPStandardTransportRuleTemplate {
if ($Existing) {
Write-Host 'Found existing'
$RequestParams | Add-Member -NotePropertyValue $RequestParams.name -NotePropertyName Identity
- $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications) -useSystemMailbox $true
+ $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications, UseLegacyRegex) -useSystemMailbox $true
Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully set transport rule for $tenant" -sev 'Info'
} else {
Write-Host 'Creating new'
- $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'New-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications) -useSystemMailbox $true
+ $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'New-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications, UseLegacyRegex) -useSystemMailbox $true
Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully created transport rule for $tenant" -sev 'Info'
}
diff --git a/Modules/CIPPCore/Public/Test-CIPPAccessTenant.ps1 b/Modules/CIPPCore/Public/Test-CIPPAccessTenant.ps1
index 014218b3cc16..842b4f4b66aa 100644
--- a/Modules/CIPPCore/Public/Test-CIPPAccessTenant.ps1
+++ b/Modules/CIPPCore/Public/Test-CIPPAccessTenant.ps1
@@ -22,9 +22,6 @@ function Test-CIPPAccessTenant {
$Tenants = ($TenantCSV).split(',')
if (!$Tenants) { $results = 'Could not load the tenants list from cache. Please run permissions check first, or visit the tenants page.' }
$TenantList = Get-Tenants
- $TenantIds = foreach ($Tenant in $Tenants) {
- ($TenantList | Where-Object { $_.defaultDomainName -eq $Tenant }).customerId
- }
$results = foreach ($tenant in $Tenants) {
$AddedText = ''
@@ -32,9 +29,9 @@ function Test-CIPPAccessTenant {
$TenantId = ($TenantList | Where-Object { $_.defaultDomainName -eq $tenant }).customerId
$BulkRequests = $ExpectedRoles | ForEach-Object { @(
@{
- id = "roleManagement_$($_.id)"
+ id = "roleManagement_$($_.Id)"
method = 'GET'
- url = "roleManagement/directory/roleAssignments?`$filter=roleDefinitionId eq '$($_.id)'&`$expand=principal"
+ url = "roleManagement/directory/roleAssignments?`$filter=roleDefinitionId eq '$($_.Id)'&`$expand=principal"
}
)
}
diff --git a/Modules/CippEntrypoints/CippEntrypoints.psm1 b/Modules/CippEntrypoints/CippEntrypoints.psm1
index 800fd3618526..994dab0633bf 100644
--- a/Modules/CippEntrypoints/CippEntrypoints.psm1
+++ b/Modules/CippEntrypoints/CippEntrypoints.psm1
@@ -1,20 +1,44 @@
using namespace System.Net
function Receive-CippHttpTrigger {
- Param($Request, $TriggerMetadata)
- #force path to CIPP-API
- Set-Location (Get-Item $PSScriptRoot).Parent.Parent.FullName
- Write-Information (Get-Item $PSScriptRoot).Parent.Parent.FullName
- $APIName = $TriggerMetadata.FunctionName
+ <#
+ .FUNCTIONALITY
+ Entrypoint
+ #>
+ Param(
+ $Request,
+ $TriggerMetadata
+ )
- $FunctionName = 'Invoke-{0}' -f $APIName
+ Set-Location (Get-Item $PSScriptRoot).Parent.Parent.FullName
+ $FunctionName = 'Invoke-{0}' -f $Request.Params.CIPPEndpoint
+ Write-Host "Function: $($Request.Params.CIPPEndpoint)"
$HttpTrigger = @{
Request = $Request
TriggerMetadata = $TriggerMetadata
}
- & $FunctionName @HttpTrigger
+ if (Get-Command -Name $FunctionName -ErrorAction SilentlyContinue) {
+ try {
+ $Access = Test-CIPPAccess -Request $Request
+ Write-Information "Access: $Access"
+ if ($Access) {
+ & $FunctionName @HttpTrigger
+ }
+ } catch {
+ Write-Information $_.Exception.Message
+ Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
+ StatusCode = [HttpStatusCode]::Forbidden
+ Body = $_.Exception.Message
+ })
+ }
+ } else {
+ Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
+ StatusCode = [HttpStatusCode]::NotFound
+ Body = 'Endpoint not found'
+ })
+ }
}
function Receive-CippQueueTrigger {
diff --git a/Modules/CippExtensions/NinjaOne/Get-NinjaOneOrgMapping.ps1 b/Modules/CippExtensions/NinjaOne/Get-NinjaOneOrgMapping.ps1
index 8f9e3d89936b..a0274cb0d16f 100644
--- a/Modules/CippExtensions/NinjaOne/Get-NinjaOneOrgMapping.ps1
+++ b/Modules/CippExtensions/NinjaOne/Get-NinjaOneOrgMapping.ps1
@@ -13,14 +13,14 @@ function Get-NinjaOneOrgMapping {
$Mappings | Add-Member -NotePropertyName $_.RowKey -NotePropertyValue @{ label = "$($_.NinjaOneName)"; value = "$($_.NinjaOne)" }
}
#Get Available Tenants
-
+
#Get available Ninja clients
$Table = Get-CIPPTable -TableName Extensionsconfig
$Configuration = ((Get-AzDataTableEntity @Table).config | ConvertFrom-Json -ea stop).NinjaOne
-
-
+
+
$Token = Get-NinjaOneToken -configuration $Configuration
-
+
$After = 0
$PageSize = 1000
$NinjaOrgs = do {
@@ -29,16 +29,16 @@ function Get-NinjaOneOrgMapping {
$ResultCount = ($Result.id | Measure-Object -Maximum)
$After = $ResultCount.maximum
- } while ($ResultCount.count -eq $PageSize)
-
+ } while ($ResultCount.count -eq $PageSize)
+
} catch {
$Message = if ($_.ErrorDetails.Message) {
Get-NormalizedError -Message $_.ErrorDetails.Message
} else {
$_.Exception.message
}
-
- $NinjaOrgs = @(@{ name = $Message })
+
+ $NinjaOrgs = @(@{ name = 'Could not get NinjaOne Orgs, check your API credentials and try again.'; value = '-1' })
}
$MappingObj = [PSCustomObject]@{
diff --git a/Modules/CippExtensions/NinjaOne/Invoke-NinjaOneTenantSync.ps1 b/Modules/CippExtensions/NinjaOne/Invoke-NinjaOneTenantSync.ps1
index ebf491cec05a..9828682c6348 100644
--- a/Modules/CippExtensions/NinjaOne/Invoke-NinjaOneTenantSync.ps1
+++ b/Modules/CippExtensions/NinjaOne/Invoke-NinjaOneTenantSync.ps1
@@ -267,7 +267,7 @@ function Invoke-NinjaOneTenantSync {
@{
id = 'Users'
method = 'GET'
- url = '/users'
+ url = '/users?$top=999'
},
@{
id = 'TenantDetails'
@@ -292,7 +292,7 @@ function Invoke-NinjaOneTenantSync {
@{
id = 'Devices'
method = 'GET'
- url = '/deviceManagement/managedDevices'
+ url = '/deviceManagement/managedDevices?$top=999'
},
@{
id = 'DeviceCompliancePolicies'
@@ -317,12 +317,12 @@ function Invoke-NinjaOneTenantSync {
@{
id = 'SecureScore'
method = 'GET'
- url = '/security/secureScores'
+ url = '/security/secureScores?$top=999'
},
@{
id = 'SecureScoreControlProfiles'
method = 'GET'
- url = '/security/secureScoreControlProfiles'
+ url = '/security/secureScoreControlProfiles?$top=999'
},
@{
id = 'Subscriptions'
diff --git a/Modules/CippExtensions/Private/Get-HaloMapping.ps1 b/Modules/CippExtensions/Private/Get-HaloMapping.ps1
index 8391252ae065..fcae99cfd5d1 100644
--- a/Modules/CippExtensions/Private/Get-HaloMapping.ps1
+++ b/Modules/CippExtensions/Private/Get-HaloMapping.ps1
@@ -32,7 +32,7 @@ function Get-HaloMapping {
}
Write-LogMessage -Message "Could not get HaloPSA Clients, error: $Message " -Level Error -tenant 'CIPP' -API 'HaloMapping'
- $RawHaloClients = @(@{name = "Could not get HaloPSA Clients, error: $Message" })
+ $RawHaloClients = @(@{name = "Could not get HaloPSA Clients, error: $Message"; value = '-1' })
}
$HaloClients = $RawHaloClients | ForEach-Object {
[PSCustomObject]@{
diff --git a/Modules/CippExtensions/Private/Set-PwPushConfig.ps1 b/Modules/CippExtensions/Private/Set-PwPushConfig.ps1
new file mode 100644
index 000000000000..d43ffa888575
--- /dev/null
+++ b/Modules/CippExtensions/Private/Set-PwPushConfig.ps1
@@ -0,0 +1,23 @@
+function Set-PwPushConfig {
+ param(
+ $Configuration
+ )
+ $InitParams = @{}
+ if ($Configuration.BaseUrl) {
+ $InitParams.BaseUrl = $Configuration.BaseUrl
+ }
+ if ($Configuration.EmailAddress) {
+ if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true') {
+ $DevSecretsTable = Get-CIPPTable -tablename 'DevSecrets'
+ $ApiKey = (Get-CIPPAzDataTableEntity @DevSecretsTable -Filter "PartitionKey eq 'PWPush' and RowKey eq 'PWPush'").APIKey
+ } else {
+ $null = Connect-AzAccount -Identity
+ $ApiKey = Get-AzKeyVaultSecret -VaultName $ENV:WEBSITE_DEPLOYMENT_ID -Name 'PWPush' -AsPlainText
+ }
+ if ($ApiKey) {
+ $InitParams.APIKey = $ApiKey
+ $InitParams.EmailAddress = $Configuration.EmailAddress
+ }
+ }
+ Initialize-PassPushPosh @InitParams
+}
\ No newline at end of file
diff --git a/Modules/CippExtensions/Public/Get-ExtensionRateLimit.ps1 b/Modules/CippExtensions/Public/Get-ExtensionRateLimit.ps1
index 2a0e718402f4..242d4dd86390 100644
--- a/Modules/CippExtensions/Public/Get-ExtensionRateLimit.ps1
+++ b/Modules/CippExtensions/Public/Get-ExtensionRateLimit.ps1
@@ -24,7 +24,6 @@ function Get-ExtensionRateLimit($ExtensionName, $ExtensionPartitionKey, $RateLim
}
if (($ActiveJobs | Measure-Object).count -ge $RateLimit) {
Write-Host "Rate Limiting. Currently $($ActiveJobs.count) Active Jobs"
- Start-Sleep -Seconds $WaitTime
$CurrentMap = Get-ExtensionRateLimit -ExtensionName $ExtensionName -ExtensionPartitionKey $ExtensionPartitionKey -RateLimit $RateLimit -WaitTime $WaitTime
}
diff --git a/Modules/CippExtensions/Public/New-PwPushLink.ps1 b/Modules/CippExtensions/Public/New-PwPushLink.ps1
new file mode 100644
index 000000000000..a8739f39c9b6
--- /dev/null
+++ b/Modules/CippExtensions/Public/New-PwPushLink.ps1
@@ -0,0 +1,24 @@
+function New-PwPushLink {
+ [CmdletBinding()]
+ Param(
+ $Payload
+ )
+ $Table = Get-CIPPTable -TableName Extensionsconfig
+ $Configuration = ((Get-CIPPAzDataTableEntity @Table).config | ConvertFrom-Json).PWPush
+ if ($Configuration.Enabled) {
+ Set-PwPushConfig -Configuration $Configuration
+ $PushParams = @{
+ Payload = $Payload
+ }
+ if ($Configuration.ExpireAfterDays) { $PushParams.ExpireAfterDays = $Configuration.ExpireAfterDays }
+ if ($Configuration.ExpireAfterViews) { $PushParams.ExpireAfterViews = $Configuration.ExpireAfterViews }
+ if ($Configuration.DeletableByViewer) { $PushParams.DeletableByViewer = $Configuration.DeletableByViewer }
+ $Link = New-Push @PushParams | Select-Object Link, LinkRetrievalStep
+ if ($Configuration.RetrievalStep) {
+ $Link.Link = $Link.LinkRetrievalStep
+ }
+ $Link | Select-Object -ExpandProperty Link
+ } else {
+ return $false
+ }
+}
\ No newline at end of file
diff --git a/Modules/PassPushPosh/0.2.3/PSGetModuleInfo.xml b/Modules/PassPushPosh/0.2.3/PSGetModuleInfo.xml
new file mode 100644
index 000000000000..00cc59d45a7d
--- /dev/null
+++ b/Modules/PassPushPosh/0.2.3/PSGetModuleInfo.xml
@@ -0,0 +1,142 @@
+
+
+
+ Microsoft.PowerShell.Commands.PSRepositoryItemInfo
+ System.Management.Automation.PSCustomObject
+ System.Object
+
+
+ PassPushPosh
+ 0.2.3
+ Module
+ *PassPushPosh* is a PowerShell Module for interfacing with the Password Pusher secure password / string sharing application, primarily through pwpush.com. It supports creating, retrieving, and deleting anonymous and authenticated pushes, links in any supported language, and getting Push and Dashboard data for authenticated users._x000D__x000A__x000D__x000A_Cmdlets provide clear responses to errors, support additional messaging via -Debug and -Verbose, transaction testing via -Whatif and -Confirm, and in general try to be as "Powershell-y" as possible.
+ Adam Burley
+ AdamBurley
+ Adam Burley, 2022
+ 2023-03-05T00:10:36-05:00
+
+
+ https://www.gnu.org/licenses/gpl-3.0.en.html
+ https://github.com/adamburley/PassPushPosh
+
+
+
+ System.Object[]
+ System.Array
+ System.Object
+
+
+ PSEdition_Desktop
+ PSEdition_Core
+ Windows
+ Linux
+ MacOS
+ Password
+ PSModule
+
+
+
+
+ System.Collections.Hashtable
+ System.Object
+
+
+
+ DscResource
+
+
+
+
+
+
+ Cmdlet
+ Function
+
+
+
+ ConvertTo-PasswordPush
+ Get-Dashboard
+ Get-Push
+ Get-PushAuditLog
+ Get-SecretLink
+ Initialize-PassPushPosh
+ New-PasswordPush
+ New-Push
+ Remove-Push
+
+
+
+
+ Workflow
+ RoleCapability
+ Command
+
+
+
+ ConvertTo-PasswordPush
+ Get-Dashboard
+ Get-Push
+ Get-PushAuditLog
+ Get-SecretLink
+ Initialize-PassPushPosh
+ New-PasswordPush
+ New-Push
+ Remove-Push
+
+
+
+
+
+
+ 0.2.3 - Bug fixing in New-Push. See PR #1_x000D__x000A_ 0.2.2 - Fixed issue with Get-Dashboard returning error referencing -JsonIsArray parameter_x000D__x000A_ General - Module is generally functional but has not been extensively bug-tested. Reccomend not implementing into a production environment at this time.
+
+
+
+
+ https://www.powershellgallery.com/api/v2
+ PSGallery
+ NuGet
+
+
+ System.Management.Automation.PSCustomObject
+ System.Object
+
+
+ Adam Burley, 2022
+ *PassPushPosh* is a PowerShell Module for interfacing with the Password Pusher secure password / string sharing application, primarily through pwpush.com. It supports creating, retrieving, and deleting anonymous and authenticated pushes, links in any supported language, and getting Push and Dashboard data for authenticated users._x000D__x000A__x000D__x000A_Cmdlets provide clear responses to errors, support additional messaging via -Debug and -Verbose, transaction testing via -Whatif and -Confirm, and in general try to be as "Powershell-y" as possible.
+ False
+ 0.2.3 - Bug fixing in New-Push. See PR #1_x000D__x000A_ 0.2.2 - Fixed issue with Get-Dashboard returning error referencing -JsonIsArray parameter_x000D__x000A_ General - Module is generally functional but has not been extensively bug-tested. Reccomend not implementing into a production environment at this time.
+ True
+ True
+ 44
+ 76
+ 15168
+ 3/5/2023 12:10:36 AM -05:00
+ 3/5/2023 12:10:36 AM -05:00
+ 5/23/2024 10:57:25 AM -04:00
+ PSEdition_Desktop PSEdition_Core Windows Linux MacOS Password PSModule PSFunction_ConvertTo-PasswordPush PSCommand_ConvertTo-PasswordPush PSFunction_Get-Dashboard PSCommand_Get-Dashboard PSFunction_Get-Push PSCommand_Get-Push PSFunction_Get-PushAuditLog PSCommand_Get-PushAuditLog PSFunction_Get-SecretLink PSCommand_Get-SecretLink PSFunction_Initialize-PassPushPosh PSCommand_Initialize-PassPushPosh PSFunction_New-PasswordPush PSCommand_New-PasswordPush PSFunction_New-Push PSCommand_New-Push PSFunction_Remove-Push PSCommand_Remove-Push PSIncludes_Function
+ False
+ 2024-05-23T10:57:25Z
+ 0.2.3
+ Adam Burley
+ false
+ Module
+ PassPushPosh.nuspec|PassPushPosh.psd1|PassPushPosh.psm1
+ 5d8a1afd-a912-440f-a9b9-e79f42a05f21
+ 5.1
+ Burley.dev
+
+
+ C:\GitHub\CIPP Workspace\CIPP-API\Modules\PassPushPosh\0.2.3
+
+
+
diff --git a/Modules/PassPushPosh/0.2.3/PassPushPosh.psd1 b/Modules/PassPushPosh/0.2.3/PassPushPosh.psd1
new file mode 100644
index 000000000000..1c911df9d9de
--- /dev/null
+++ b/Modules/PassPushPosh/0.2.3/PassPushPosh.psd1
@@ -0,0 +1,140 @@
+#
+# Module manifest for module 'PassPushPosh'
+#
+# Generated by: Adam Burley
+#
+# Generated on: 3/4/2023
+#
+
+@{
+
+# Script module or binary module file associated with this manifest.
+RootModule = 'PassPushPosh.psm1'
+
+# Version number of this module.
+ModuleVersion = '0.2.3'
+
+# Supported PSEditions
+# CompatiblePSEditions = @()
+
+# ID used to uniquely identify this module
+GUID = '5d8a1afd-a912-440f-a9b9-e79f42a05f21'
+
+# Author of this module
+Author = 'Adam Burley'
+
+# Company or vendor of this module
+CompanyName = 'Burley.dev'
+
+# Copyright statement for this module
+Copyright = 'Adam Burley, 2022'
+
+# Description of the functionality provided by this module
+Description = '*PassPushPosh* is a PowerShell Module for interfacing with the Password Pusher secure password / string sharing application, primarily through pwpush.com. It supports creating, retrieving, and deleting anonymous and authenticated pushes, links in any supported language, and getting Push and Dashboard data for authenticated users.
+
+Cmdlets provide clear responses to errors, support additional messaging via -Debug and -Verbose, transaction testing via -Whatif and -Confirm, and in general try to be as "Powershell-y" as possible.'
+
+# Minimum version of the PowerShell engine required by this module
+PowerShellVersion = '5.1'
+
+# Name of the PowerShell host required by this module
+# PowerShellHostName = ''
+
+# Minimum version of the PowerShell host required by this module
+# PowerShellHostVersion = ''
+
+# Minimum version of Microsoft .NET Framework required by this module. This prerequisite is valid for the PowerShell Desktop edition only.
+# DotNetFrameworkVersion = ''
+
+# Minimum version of the common language runtime (CLR) required by this module. This prerequisite is valid for the PowerShell Desktop edition only.
+# ClrVersion = ''
+
+# Processor architecture (None, X86, Amd64) required by this module
+# ProcessorArchitecture = ''
+
+# Modules that must be imported into the global environment prior to importing this module
+# RequiredModules = @()
+
+# Assemblies that must be loaded prior to importing this module
+# RequiredAssemblies = @()
+
+# Script files (.ps1) that are run in the caller's environment prior to importing this module.
+# ScriptsToProcess = @()
+
+# Type files (.ps1xml) to be loaded when importing this module
+# TypesToProcess = @()
+
+# Format files (.ps1xml) to be loaded when importing this module
+# FormatsToProcess = @()
+
+# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
+# NestedModules = @()
+
+# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
+FunctionsToExport = 'ConvertTo-PasswordPush', 'Get-Dashboard', 'Get-Push',
+ 'Get-PushAuditLog', 'Get-SecretLink', 'Initialize-PassPushPosh',
+ 'New-PasswordPush', 'New-Push', 'Remove-Push'
+
+# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
+CmdletsToExport = @()
+
+# Variables to export from this module
+VariablesToExport = '*'
+
+# Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.
+AliasesToExport = 'Get-PushPreview'
+
+# DSC resources to export from this module
+# DscResourcesToExport = @()
+
+# List of all modules packaged with this module
+# ModuleList = @()
+
+# List of all files packaged with this module
+# FileList = @()
+
+# Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.
+PrivateData = @{
+
+ PSData = @{
+
+ # Tags applied to this module. These help with module discovery in online galleries.
+ Tags = 'PSEdition_Desktop','PSEdition_Core','Windows','Linux','MacOS','Password'
+
+ # A URL to the license for this module.
+ LicenseUri = 'https://www.gnu.org/licenses/gpl-3.0.en.html'
+
+ # A URL to the main website for this project.
+ ProjectUri = 'https://github.com/adamburley/PassPushPosh'
+
+ # A URL to an icon representing this module.
+ # IconUri = ''
+
+ # ReleaseNotes of this module
+ ReleaseNotes = @"
+ 0.2.3 - Bug fixing in New-Push. See PR #1
+ 0.2.2 - Fixed issue with Get-Dashboard returning error referencing -JsonIsArray parameter
+ General - Module is generally functional but has not been extensively bug-tested. Reccomend not implementing into a production environment at this time.
+"@
+
+ # Prerelease string of this module
+ # Prerelease = ''
+
+ # Flag to indicate whether the module requires explicit user acceptance for install/update/save
+ # RequireLicenseAcceptance = $false
+
+ # External dependent modules of this module
+ # ExternalModuleDependencies = @()
+
+ } # End of PSData hashtable
+
+ } # End of PrivateData hashtable
+
+# HelpInfo URI of this module
+HelpInfoURI = 'https://github.com/adamburley/PassPushPosh/blob/main/Docs'
+
+# Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
+# DefaultCommandPrefix = ''
+
+}
+
diff --git a/Modules/PassPushPosh/0.2.3/PassPushPosh.psm1 b/Modules/PassPushPosh/0.2.3/PassPushPosh.psm1
new file mode 100644
index 000000000000..e159d6a80d3d
--- /dev/null
+++ b/Modules/PassPushPosh/0.2.3/PassPushPosh.psm1
@@ -0,0 +1,1012 @@
+class PasswordPush {
+ [string]$Payload
+ [string] hidden $__UrlToken
+ [string] hidden $__LinkBase
+ [string]$Language
+ [bool]$RetrievalStep
+ [bool]$IsExpired
+ [bool]$IsDeleted
+ [bool]$IsDeletableByViewer
+ [int]$ExpireAfterDays
+ [int]$DaysRemaining
+ [int]$ExpireAfterViews
+ [int]$ViewsRemaining
+ [DateTime]$DateCreated
+ [DateTime]$DateUpdated
+ [DateTime]$DateExpired
+ # Added by constructors:
+ #[string]$URLToken
+ #[string]$Link
+ #[string]$LinkDirect
+ #[string]$LinkRetrievalStep
+
+ PasswordPush() {
+ # Blank constructor
+ }
+
+ # Constructor to allow casting or explicit import from a PSObject Representing the result of an API call
+ PasswordPush([PSCustomObject]$APIresponseObject) {
+ throw NotImplementedException
+ }
+
+ # Allow casting or explicit import from the raw Content of an API call
+ [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars', '', Scope = 'Function', Justification = 'Global variables are used for module session helpers.')]
+ PasswordPush([string]$JsonResponse) {
+ Write-Debug 'New PasswordPush object instantiated from JsonResponse string'
+ Initialize-PassPushPosh # Initialize the module if not yet done.
+
+ $_j = $JsonResponse | ConvertFrom-Json
+ $this.Payload = $_j.payload
+ $this.IsExpired = $_j.expired
+ $this.IsDeleted = $_j.deleted
+ $this.IsDeletableByViewer = $_j.deletable_by_viewer
+ $this.ExpireAfterDays = $_j.expire_after_days
+ $this.DaysRemaining = $_j.days_remaining
+ $this.ExpireAfterViews = $_j.expire_after_views
+ $this.ViewsRemaining = $_j.views_remaining
+ $this.DateCreated = $_j.created_at
+ $this.DateUpdated = $_j.updated_at
+ $this.DateExpired = if ($_j.expired_on) { $_j.expired_on } else { [DateTime]0 }
+
+ $this.Language = $Global:PPPLanguage
+
+ $this | Add-Member -Name 'UrlToken' -MemberType ScriptProperty -Value {
+ return $this.__UrlToken
+ } -SecondValue {
+ $this.__UrlToken = $_
+ $this.__LinkBase = "$Global:PPPBaseUrl/$($this.Language)/p/$($this.__UrlToken)"
+ }
+ $this.__UrlToken = $_j.url_token
+ $this.__LinkBase = "$Global:PPPBaseUrl/$($this.Language)/p/$($this.__UrlToken)"
+ $this | Add-Member -Name 'LinkDirect' -MemberType ScriptProperty -Value { return $this.__LinkBase } -SecondValue {
+ Write-Warning 'LinkDirect is a read-only calculated member.'
+ Write-Debug 'Link* members are calculated based on the Global BaseUrl and Language and Push Retrieval Step values'
+ }
+ $this | Add-Member -Name 'LinkRetrievalStep' -MemberType ScriptProperty -Value { return "$($this.__LinkBase)/r" } -SecondValue {
+ Write-Warning 'LinkRetrievalStep is a read-only calculated member.'
+ Write-Debug 'Link* members are calculated based on the Global BaseUrl and Language and Push Retrieval Step values'
+ }
+ $this | Add-Member -Name 'Link' -MemberType ScriptProperty -Value {
+ $_Link = if ($this.RetrievalStep) { $this.LinkRetrievalStep } else { $this.LinkDirect }
+ Write-Debug "Presented Link: $_link"
+ return $_Link
+ } -SecondValue {
+ Write-Warning 'Link is a read-only calculated member.'
+ Write-Debug 'Link* members are calculated based on the Global BaseUrl and Language and Push Retrieval Step values'
+ }
+ }
+}
+
+function ConvertTo-PasswordPush {
+ <#
+ .SYNOPSIS
+ Convert API call response to a PasswordPush object
+
+ .DESCRIPTION
+ Accepts a JSON string returned from the Password Pusher API and converts it to a [PasswordPush] object.
+ This allows calculated push retrieval URLs, language enumeration, and a more "PowerShell" experience.
+ Generally you won't need to use this directly, it's automatically invoked within Register-Push and Request-Push.
+
+ .INPUTS
+ [string]
+
+ .OUTPUTS
+ [PasswordPush] for single object
+ [PasswordPush[]] for Json array data
+
+ .EXAMPLE
+ # Common usage - from within the Register-Push cmdlet
+ PS> $myPush = Register-Push -Payload "This is my secret!"
+ PS> $myPush.Link # The link parameter always presents the URL as it would appear with the same settings selected on pwpush.com
+
+ https://pwpush.com/en/p/rz6nryvl-d4
+
+ .EXAMPLE
+ # Manually invoking the API
+ PS> $rawJson = Invoke-WebRequest `
+ -Uri https://pwpush.com/en/p.json `
+ -Method Post `
+ -Body '{"password": { "payload": "This is my secret!"}}' `
+ -ContentType 'application/json' |
+ Select-Object -ExpandProperty Content
+ PS> $rawJson
+ {"expire_after_days":7,"expire_after_views":5,"expired":false,"url_token":"rz6nryvl-d4","created_at":"2022-11-18T14:16:29.821Z","updated_at":"2022-11-18T14:16:29.821Z","deleted":false,"deletable_by_viewer":true,"retrieval_step":false,"expired_on":null,"days_remaining":7,"views_remaining":5}
+ PS> $rawJson | ConvertTo-PasswordPush
+ UrlToken : rz6nryvl-d4
+ LinkDirect : https://pwpush.com/en/p/rz6nryvl-d4
+ LinkRetrievalStep : https://pwpush.com/en/p/rz6nryvl-d4/r
+ Link : https://pwpush.com/en/p/rz6nryvl-d4
+ Payload :
+ Language : en
+ RetrievalStep : False
+ IsExpired : False
+ IsDeleted : False
+ IsDeletableByViewer : True
+ ExpireAfterDays : 7
+ DaysRemaining : 7
+ ExpireAfterViews : 5
+ ViewsRemaining : 5
+ DateCreated : 11/18/2022 2:16:29 PM
+ DateUpdated : 11/18/2022 2:16:29 PM
+ DateExpired : 1/1/0001 12:00:00 AM
+
+ .LINK
+ https://github.com/adamburley/PassPushPosh/blob/main/Docs/ConvertTo-PasswordPush.md
+
+ .NOTES
+ Needs a rewrite / cleanup
+ #>
+ [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '', Scope = 'Function', Justification = 'Creates a new object, no risk of overwriting data.')]
+ [CmdletBinding()]
+ [OutputType([PasswordPush])]
+ param(
+ # The string result of an API call from the Password Pusher application
+ [parameter(Mandatory, ValueFromPipeline)]
+ [ValidateNotNullOrEmpty()]
+ [string]$JsonResponse
+ )
+ process {
+ try {
+ $jsonObject = $JsonResponse | ConvertFrom-Json
+ foreach ($o in $jsonObject) {
+ [PasswordPush]($o | ConvertTo-Json) # TODO fix this mess
+ }
+ }
+ catch {
+ Write-Debug 'Error in ConvertTo-PasswordPush coercing JSON object to PasswordPush object'
+ Write-Debug "JsonResponse parameter value: [[$JsonResponse]]"
+ Write-Error $_
+ }
+ }
+}
+function Get-Dashboard {
+ <#
+ .SYNOPSIS
+ Get a list of active or expired Pushes for an authenticated user
+
+ .DESCRIPTION
+ Retrieves a list of Pushes - active or expired - for an authenticated user.
+ Active and Expired are different endpoints, so to get both you'll need to make
+ two calls.
+
+ .INPUTS
+ [string] 'Active' or 'Expired'
+
+ .OUTPUTS
+ [PasswordPush[]] Array of pushes with data
+ [string] raw response body from API call
+
+ .EXAMPLE
+ Get-Dashboard
+
+ .EXAMPLE
+ Get-Dashboard Active
+
+ .EXAMPLE
+ Get-Dashboard -Dashboard Expired
+
+ .EXAMPLE
+ Get-Dashboard -Raw
+ [{"expire_after_days":1,"expire_after_views":5,"expired":false,"url_token":"xm3q7czvtdpmyg","created_at":"2022-11-19T18:10:42.055Z","updated_at":"2022-11-19T18:10:42.055Z","deleted":false,"deletable_by_viewer":true,"retrieval_step":false,"expired_on":null,"note":null,"days_remaining":1,"views_remaining":3}]
+
+ .LINK
+ https://github.com/adamburley/PassPushPosh/blob/main/Docs/Get-Dashboard.md
+
+ .LINK
+ https://pwpush.com/api/1.0/dashboard.en.html
+
+ .LINK
+ Get-PushAuditLog
+
+ .NOTES
+ TODO update Invoke-Webrequest flow and error-handling to match other functions
+ #>
+ [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars', '', Scope = 'Function', Justification = 'Global variables are used for module session helpers.')]
+ [CmdletBinding()]
+ [OutputType([PasswordPush[]],[string])]
+ param(
+ # URL Token from a secret
+ [parameter(Position=0)]
+ [ValidateSet('Active','Expired')]
+ [ValidateNotNullOrEmpty()]
+ [string]
+ $Dashboard = 'Active',
+
+ # Return content of API call directly
+ [Parameter()]
+ [switch]
+ $Raw
+ )
+ if (-not $Global:PPPHeaders) { Write-Error 'Dashboard access requires authentication. Run Initialize-PassPushPosh and pass your email address and API key before retrying.' -ErrorAction Stop -Category AuthenticationError }
+ try {
+ $uri = "$Global:PPPBaseUrl/d/"
+ if ($Dashboard -eq 'Active') { $uri += 'active.json' }
+ elseif ($Dashboard -eq 'Expired') { $uri += 'expired.json' }
+ Write-Debug "Requesting $uri"
+ $response = Invoke-WebRequest -Uri $uri -Method Get -Headers $Global:PPPHeaders -ErrorAction Stop
+ if ($Raw) { return $response.Content }
+ else {
+ return $response.Content | ConvertTo-PasswordPush
+ }
+ } catch {
+ Write-Verbose "An exception was caught: $($_.Exception.Message)"
+ if ($DebugPreference -eq [System.Management.Automation.ActionPreference]::Continue) {
+ Set-Variable -Scope Global -Name 'PPPLastError' -Value $_
+ Write-Debug -Message 'Response object set to global variable $PPPLastError'
+ }
+ throw # Re-throw the error
+ }
+}
+function Get-Push {
+ <#
+ .SYNOPSIS
+ Retrieve the secret contents of a Push
+
+ .DESCRIPTION
+ Accepts a URL Token string, returns the contents of a Push along with
+ metadata regarding that Push. Note, Get-Push will return data on an expired
+ Push (datestamps, etc) even if it does not return the Push contents.
+
+ .INPUTS
+ [string]
+
+ .OUTPUTS
+ [PasswordPush] or [string]
+
+ .EXAMPLE
+ Get-Push -URLToken gzv65wiiuciy
+
+ .EXAMPLE
+ Get-Push -URLToken gzv65wiiuciy -Raw
+ {"payload":"I am your payload!","expired":false,"deleted":false,"expired_on":"","expire_after_days":1,"expire_after_views":4,"url_token":"bwzehzem_xu-","created_at":"2022-11-21T13:20:08.635Z","updated_at":"2022-11-21T13:23:45.342Z","deletable_by_viewer":true,"retrieval_step":false,"days_remaining":1,"views_remaining":4}
+
+ .LINK
+ https://github.com/adamburley/PassPushPosh/blob/main/Docs/Get-Push.md
+
+ .LINK
+ https://pwpush.com/api/1.0/passwords/show.en.html
+
+ .LINK
+ New-Push
+
+ #>
+ [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars','',Scope='Function',Justification='Global variables are used for module session helpers.')]
+ [CmdletBinding()]
+ [OutputType([PasswordPush])]
+ param(
+ # URL Token for the secret
+ [parameter(Mandatory,ValueFromPipeline,Position=0)]
+ [ValidateNotNullOrEmpty()]
+ [Alias('Token')]
+ $URLToken,
+
+ # Return the raw response body from the API call
+ [Parameter()]
+ [switch]
+ $Raw
+ )
+ begin { Initialize-PassPushPosh -Verbose:$VerbosePreference -Debug:$DebugPreference }
+
+ process {
+ try {
+ $iwrSplat = @{
+ 'Method' = 'Get'
+ 'ContentType' = 'application/json'
+ 'Uri' = "$Global:PPPBaseUrl/p/$URLToken.json"
+ 'UserAgent' = $Global:PPPUserAgent
+ }
+ if ($Global:PPPHeaders) { $iwrSplat['Headers'] = $Global:PPPHeaders }
+ Write-Verbose "Sending HTTP request: $($iwrSplat | Out-String)"
+ $response = Invoke-WebRequest @iwrSplat -ErrorAction Stop
+ if ($DebugPreference -eq [System.Management.Automation.ActionPreference]::Continue) {
+ Set-Variable -Scope Global -Name PPPLastCall -Value $response
+ Write-Debug 'Response to Invoke-WebRequest set to PPPLastCall Global variable'
+ }
+ if ($Raw) {
+ Write-Debug "Returning raw object:`n$($response.Content)"
+ return $response.Content
+ }
+ return $response.Content | ConvertTo-PasswordPush
+ } catch {
+ Write-Verbose "An exception was caught: $($_.Exception.Message)"
+ if ($DebugPreference -eq [System.Management.Automation.ActionPreference]::Continue) {
+ Set-Variable -Scope Global -Name PPPLastError -Value $_
+ Write-Debug -Message 'Response object set to global variable $PPPLastError'
+ }
+ }
+ }
+}
+function Get-PushAuditLog {
+ <#
+ .SYNOPSIS
+ Get the view log of an authenticated Push
+
+ .DESCRIPTION
+ Retrieves the view log of a Push created under an authenticated session.
+ Returns an array of custom objects with view data. If the query is
+ successful but there are no results, it returns an empty array.
+ If there's an error, a single object is returned with information.
+ See "handling errors" under NOTES
+
+ .INPUTS
+ [string]
+
+ .OUTPUTS
+ [PsCustomObject[]] Array of entries.
+ [PsCustomObject] If there's an error in the call, it will be returned an object with a property
+ named 'error'. The value of that member will contain more information
+
+ .EXAMPLE
+ Get-PushAuditLog -URLToken 'mytokenfromapush'
+ ip : 75.202.43.56,102.70.135.200
+ user_agent : Mozilla/5.0 (Macintosh; Darwin 21.6.0 Darwin Kernel Version 21.6.0: Mon Aug 22 20:20:05 PDT 2022; root:xnu-8020.140.49~2/RELEASE_ARM64_T8101;
+ en-US) PowerShell/7.2.7
+ referrer :
+ successful : True
+ created_at : 11/19/2022 6:32:42 PM
+ updated_at : 11/19/2022 6:32:42 PM
+ kind : 0
+
+ .EXAMPLE
+ # If there are no views, an empty array is returned
+ Get-PushAuditLog -URLToken 'mytokenthatsneverbeenseen'
+
+ .LINK
+ https://github.com/adamburley/PassPushPosh/blob/main/Docs/Get-PushAuditLog.md
+
+ .LINK
+ https://pwpush.com/api/1.0/passwords/audit.en.html
+
+ .LINK
+ Get-Dashboard
+
+ .NOTES
+ Handling Errors:
+ The API returns different HTTP status codes and results depending where the
+ call fails.
+
+ | HTTP RESPONSE | Error Reason | Response Body | Sample Object Returned | Note |
+ |------------------|---------------------------------|----------------------------------------------|--------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------|
+ | 401 UNAUTHORIZED | Invalid API key or email | None | @{ 'Error'= 'Authentication error. Verify email address and API key.'; 'ErrorCode'= 401 } | |
+ | 200 OK | Push created by another account | {"error":"That push doesn't belong to you."} | @{ 'Error'= "That Push doesn't belong to you"; 'ErrorCode'= 403 } | Function transforms error code to 403 to allow easier response management |
+ | 404 NOT FOUND | Invalid URL token | None | @{ 'Error'= 'Invalid token. Verify your Push URL token is correct.'; 'ErrorCode'= 404 } | This is different than the response to a delete Push query - in this case it will only return 404 if the token is invalid. |
+
+ #>
+ [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars', '', Scope = 'Function', Justification = 'Global variables are used for module session helpers.')]
+ [CmdletBinding()]
+ [OutputType([PSCustomObject[]],[string])]
+ param(
+ # URL Token from a secret
+ [parameter(ValueFromPipeline)]
+ [ValidateNotNullOrEmpty()]
+ [string]
+ $URLToken,
+
+ # Return content of API call directly
+ [Parameter()]
+ [switch]
+ $Raw
+ )
+ begin {
+ if (-not $Global:PPPHeaders) { Write-Error 'Retrieving audit logs requires authentication. Run Initialize-PassPushPosh and pass your email address and API key before retrying.' -ErrorAction Stop -Category AuthenticationError }
+ }
+ process {
+ try {
+ $uri = "$Global:PPPBaseUrl/p/$URLToken/audit.json"
+ Write-Debug 'Requesting $uri'
+ $response = Invoke-WebRequest -Uri $uri -Method Get -Headers $Global:PPPHeaders -ErrorAction Stop
+ if ([int]$response.StatusCode -eq 200 -and $response.Content -ieq "{`"error`":`"That push doesn't belong to you.`"}") {
+ $result = [PSCustomObject]@{ 'Error' = "That Push doesn't belong to you"; 'ErrorCode' = 403 }
+ Write-Warning $result.Error
+ return $result
+ }
+ if ($Raw) { return $response.Content } else { return $response.Content | ConvertFrom-Json }
+ }
+ catch {
+ Write-Verbose "An exception was caught: $($_.Exception.Message)"
+ if ([int]$_.Exception.Response.StatusCode -eq 401) { # Could be optimized
+ $result = [PSCustomObject]@{ 'Error' = 'Authentication error. Verify email address and API key.'; 'ErrorCode' = 401 }
+ Write-Warning $result.Error
+ return $result
+ } elseif ([int]$_.Exception.Response.StatusCode -eq 404) {
+ $result = [PSCustomObject]@{ 'Error' = 'Invalid token. Verify your Push URL token is correct.'; 'ErrorCode' = 404 }
+ Write-Warning $result.Error
+ return $result
+ }
+ elseif ($DebugPreference -eq [System.Management.Automation.ActionPreference]::Continue) {
+ Set-Variable -Scope Global -Name 'PPPLastError' -Value $_
+ Write-Debug -Message 'Response object set to global variable $PPPLastError'
+ return [PSCustomObject]@{
+ 'Error' = $_.Exception.Message
+ 'ErrorCode' = [int]$_.Exception.Response.StatusCode
+ 'ErrorMessage' = $_.Exception.Response.ReasonPhrase
+ }
+ }
+ }
+ }
+}
+
+# Invalid API key / email - 401
+# Invalid URL Token - 404
+# Valid token but not mine - 200, content = {"error":"That push doesn't belong to you."}
+# Success but no views - 200, content = : {"views":[]}
+# Success with view history {"views":[{"ip":"75.118.137.58,172.70.135.200","user_agent":"Mozilla/5.0 (Macintosh; Darwin 21.6.0 Darwin Kernel Version 21.6.0: Mon Aug 22 20:20:05 PDT 2022; root:xnu-8020.140.49~2/RELEASE_ARM64_T8101; en-US) PowerShell/7.2.7","referrer":"","successful":true,"created_at":"2022-11-19T18:32:42.277Z","updated_at":"2022-11-19T18:32:42.277Z","kind":0}]}
+# Content.Views
+<#
+ip : 75.118.137.58,172.70.135.200
+user_agent : Mozilla/5.0 (Macintosh; Darwin 21.6.0 Darwin Kernel Version 21.6.0: Mon Aug 22 20:20:05 PDT 2022; root:xnu-8020.140.49~2/RELEASE_ARM64_T8101;
+en-US) PowerShell/7.2.7
+referrer :
+successful : True
+created_at : 11/19/2022 6:32:42 PM
+updated_at : 11/19/2022 6:32:42 PM
+kind : 0
+#>
+function Get-SecretLink {
+ <#
+ .SYNOPSIS
+ Returns a fully qualified secret link to a push of given URL Token
+
+ .DESCRIPTION
+ Accepts a string value for a URL Token and retrieves a full URL link to the secret.
+ Returned value is a 1-step retrieval link depending on option selected during Push creation.
+ Returns false if URL Token is invalid, however it will return a URL if the token is valid
+ but the Push is expired or deleted.
+
+ .INPUTS
+ [string] URL Token value
+
+ .OUTPUTS
+ [string] Fully qualified URL
+ [bool] $False if Push URL Token is invalid. Note: Expired or deleted Pushes will still return a link.
+
+ .EXAMPLE
+ Get-SecretLink -URLToken gzv65wiiuciy
+ https://pwpush.com/en/p/gzv65wiiuciy/r
+
+ .EXAMPLE
+ # En France
+ PS > Get-SecretLink -URLToken gzv65wiiuciy -Language fr
+ https://pwpush.com/fr/p/gzv65wiiuciy/r
+
+ .EXAMPLE
+ Get-SecretLink -URLToken gzv65wiiuciy -Raw
+ { "url": "https://pwpush.com/es/p/0fkapnbo_pwp4gi8uy0/r" }
+
+ .LINK
+ https://github.com/adamburley/PassPushPosh/blob/main/Docs/Get-SecretLink.md
+
+ .LINK
+ https://pwpush.com/api/1.0/passwords/preview.en.html
+
+ .NOTES
+ Including this endpoint for completeness - however it is generally unnecessary.
+ The only thing this endpoint does is return a different value depending if "Use 1-click retrieval step"
+ was selected when the Push was created. Since both the 1-click and the direct links are available
+ regardless if that option is selected, the links are calculable and both are included by default in a
+ [PasswordPush] object.
+
+ As it returns false if a Push URL token is not valid you can use it to test if a Push exists without
+ burning a view.
+ #>
+ [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars','',Scope='Function',Justification='Global variables are used for module session helpers.')]
+ [CmdletBinding()]
+ [Alias('Get-PushPreview')]
+ [OutputType('[string]')]
+ param(
+ # URL Token for the secret
+ [parameter(Mandatory, ValueFromPipeline)]
+ [ValidateLength(5, 256)]
+ [string]$URLToken,
+
+ # Language for returned links. Defaults to system language, can be overridden here.
+ [Parameter()]
+ [string]
+ $Language = $Global:PPPLanguage,
+
+ # Return the raw response body from the API call
+ [Parameter()]
+ [switch]
+ $Raw
+ )
+ begin { Initialize-PassPushPosh -Verbose:$VerbosePreference -Debug:$DebugPreference }
+ process {
+ try {
+ if ($Language -ine 'en') { $uri += "?push_locale=$Language" }
+ $iwrSplat = @{
+ 'Method' = 'Get'
+ 'ContentType' = 'application/json'
+ 'Uri' = "$Global:PPPBaseUrl/p/$URLToken/preview.json"
+ 'UserAgent' = $Global:PPPUserAgent
+ }
+ if ($Global:PPPHeaders) { $iwrSplat['Headers'] = $Global:PPPHeaders }
+ Write-Verbose "Sending HTTP request: $($iwrSplat | Out-String)"
+ $responseContent = Invoke-WebRequest @iwrSplat | Select-Object -ExpandProperty Content
+ if ($Raw) { return $responseContent }
+ else { return $responseContent | ConvertFrom-Json | Select-Object -ExpandProperty url }
+ }
+ catch {
+ Write-Verbose "An exception was caught: $($_.Exception.Message)"
+ if ($DebugPreference -eq [System.Management.Automation.ActionPreference]::Continue) {
+ Set-Variable -Scope Global -Name 'PPPLastError' -Value $_
+ Write-Debug -Message 'Response object set to global variable $PPPLastError'
+ }
+ }
+ }
+}
+function Initialize-PassPushPosh {
+ <#
+ .SYNOPSIS
+ Initialize the PassPushPosh module
+
+ .DESCRIPTION
+ Sets global variables to handle the server URL, headers (authentication), and language.
+ Called automatically by module Functions if it is not called explicitly prior, so you don't actually need
+ to call it unless you're going to use the authenticated API or alternate server, etc
+ Default parameters use the pwpush.com domain, anonymous authentication, and whatever language your computer
+ is set to.
+
+ .EXAMPLE
+ # Initialize with default settings
+ PS > Initialize-PassPushPosh
+
+ .EXAMPLE
+ # Initialize with authentication
+ PS > Initialize-PassPushPosh -EmailAddress 'youremail@example.com' -ApiKey '239jf0jsdflskdjf' -Verbose
+
+ VERBOSE: Initializing PassPushPosh. ApiKey: [x-kdjf], BaseUrl: https://pwpush.com
+
+ .EXAMPLE
+ # Initialize with another server with authentication
+ PS > Initialize-PassPushPosh -BaseUrl https://myprivatepwpushinstance.com -EmailAddress 'youremail@example.com' -ApiKey '239jf0jsdflskdjf' -Verbose
+
+ VERBOSE: Initializing PassPushPosh. ApiKey: [x-kdjf], BaseUrl: https://myprivatepwpushinstance.com
+
+ .EXAMPLE
+ # Set a custom User Agent
+ PS > InitializePassPushPosh -UserAgent "I'm a cool dude with a cool script."
+
+ .LINK
+ https://github.com/adamburley/PassPushPosh/blob/main/Docs/Initialize-PassPushPosh.md
+
+ .NOTES
+ All variables set by this function start with PPP.
+ - PPPHeaders
+ - PPPLanguage
+ - PPPUserAgent
+ - PPPBaseUrl
+
+ -WhatIf setting for Set-Variable -Global is disabled, otherwise -WhatIf
+ calls for other functions would return incorrect data in the case this
+ function has not yet run.
+
+ TODO: Review API key pattern for parameter validation
+ #>
+ [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars','',Scope='Function',Justification='Global variables are used for module session helpers.')]
+ [CmdletBinding(DefaultParameterSetName='Anonymous')]
+ param (
+ # Email address to use for authenticated calls.
+ [Parameter(Mandatory,Position=0,ParameterSetName='Authenticated')]
+ [ValidatePattern('.+\@.+\..+')]
+ [string]$EmailAddress,
+
+ # API Key for authenticated calls.
+ [Parameter(Mandatory,Position=1,ParameterSetName='Authenticated')]
+ [ValidateLength(5,256)]
+ [string]$ApiKey,
+
+ # Base URL for API calls. Allows use of module with private instances of Password Pusher
+ # Default: https://pwpush.com
+ [Parameter(Position=0,ParameterSetName='Anonymous')]
+ [Parameter(Position=2,ParameterSetName='Authenticated')]
+ [ValidatePattern('^https?:\/\/[a-zA-Z0-9-_]+.[a-zA-Z0-9]+')]
+ [string]$BaseUrl,
+
+ # Language to render resulting links in. Defaults to host OS language, or English if
+ # host OS language is not available
+ [Parameter()]
+ [string]
+ $Language,
+
+ # Set a specific user agent. Default user agent is a combination of the
+ # module info, what your OS reports itself as, and a hash based on
+ # your username + workstation or domain name. This way the UA can be
+ # semi-consistent across sessions but not identifying.
+ [Parameter()]
+ [ValidateNotNullOrEmpty()]
+ [string]
+ $UserAgent,
+
+ # Force setting new information. If module is already initialized you can use this to
+ # Re-initialize with default settings. Implied if either ApiKey or BaseUrl is provided.
+ [Parameter()][switch]$Force
+ )
+ if ($Global:PPPBaseURL -and $true -inotin $Force, [bool]$ApiKey, [bool]$BaseUrl, [bool]$UserAgent) { Write-Debug -Message 'PassPushPosh is already initialized.' }
+ else {
+ $defaultBaseUrl = 'https://pwpush.com'
+ $apiKeyOutput = if ($ApiKey) { 'x-' + $ApiKey.Substring($ApiKey.Length-4) } else { 'None' }
+
+ if (-not $Global:PPPBaseURL) { # Not initialized
+ if (-not $BaseUrl) { $BaseUrl = $defaultBaseUrl }
+ Write-Verbose "Initializing PassPushPosh. ApiKey: [$apiKeyOutput], BaseUrl: $BaseUrl"
+ } elseif ($Force -or $ApiKey -or $BaseURL) {
+ if (-not $BaseUrl) { $BaseUrl = $defaultBaseUrl }
+ $oldApiKeyOutput = if ($Global:PPPApiKey) { 'x-' + $Global:PPPApiKey.Substring($Global:PPPApiKey.Length-4) } else { 'None' }
+ Write-Verbose "Re-initializing PassPushPosh. Old ApiKey: [$oldApiKeyOutput] New ApiKey: [$apiKeyOutput], Old BaseUrl: $Global:PPPBaseUrl New BaseUrl: $BaseUrl"
+ }
+ if ($PSCmdlet.ParameterSetName -eq 'Authenticated') {
+ Set-Variable -Scope Global -Name PPPHeaders -WhatIf:$false -Value @{
+ 'X-User-Email' = $EmailAddress
+ 'X-User-Token' = $ApiKey
+ }
+ } elseif ($Global:PPPHeaders) { # Remove if present - covers case where module is reinitialized from an authenticated to an anonymous session
+ Remove-Variable -Scope Global -Name PPPHeaders -WhatIf:$false
+ }
+ $availableLanguages = ('en','ca','cs','da','de','es','fi','fr','hu','it','nl','no','pl','pt-BR','sr','sv')
+ if (-not $Language) {
+ $Culture = Get-Culture
+ Write-Debug "Detected Culture: $($Culture.DisplayName)"
+ $matchedLanguage = $Culture.TwoLetterISOLanguageName, $Culture.IetfLanguageTag |
+ Foreach-Object { if ($_ -iin $availableLanguages) { $_ } } |
+ Select-Object -First 1
+ if ($matchedLanguage) {
+ Write-Debug "Language is supported in Password Pusher."
+ $Language = $matchedLanguage
+ } else { Write-Warning "Detected language $($Culture.DisplayName) is not supported in PasswordPusher. Defaulting to English." }
+ } else {
+ if ($Language -iin $availableLanguages) {
+ Write-Debug "Language [$Language] is available in PasswordPusher."
+ } else
+ {
+ Write-Warning "Language [$Language] is not available in PasswordPusher. Defaulting to english."
+ $Language = 'en'
+ }
+ }
+
+ if (-not $UserAgent) {
+ $osVersion = [System.Environment]::OSVersion
+ $userAtDomain = "{0}@{1}" -f [System.Environment]::UserName, [System.Environment]::UserDomainName
+ $uAD64 = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($userAtDomain))
+ Write-Debug "$userAtDomain transformed to $uAD64. First 20 characters $($uAD64.Substring(0,20))"
+ $UserAgent = "PassPushPosh/$((Get-Module -Name PassPushPosh).Version.ToString()) $Language $osVersion/$($uAD64.Substring(0,20))"
+ Write-Verbose "Generated user agent: $UserAgent"
+ } else {
+ Write-Verbose "Using specified user agent: $UserAgent"
+ }
+
+ Set-Variable -WhatIf:$false -Scope Global -Name PPPBaseURL -Value $BaseUrl.TrimEnd('/')
+ Set-Variable -WhatIf:$false -Scope Global -Name PPPLanguage -Value $Language
+ Set-Variable -WhatIf:$false -Scope Global -Name PPPUserAgent -Value $UserAgent
+ }
+}
+function New-PasswordPush {
+ <#
+ .SYNOPSIS
+ Create a new blank Password Push object.
+
+ .DESCRIPTION
+ Creates a blank [PasswordPush].
+ Generally not needed, use ConvertTo-PasswordPush
+ See New-Push if you're trying to create a new secret to send
+
+ .INPUTS
+ None
+
+ .OUTPUTS
+ [PasswordPush]
+
+ .EXAMPLE
+ New-PasswordPush
+
+ .LINK
+ https://github.com/adamburley/PassPushPosh/blob/main/Docs/New-PasswordPush.md
+
+ .NOTES
+ TODO Rewrite - make this work including read-only properties
+ #>
+ [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '', Scope = 'Function', Justification = 'Creates a new object, no risk of overwriting data.')]
+ [CmdletBinding()]
+ param ()
+ return [PasswordPush]::new()
+}
+function New-Push {
+ <#
+ .SYNOPSIS
+ Create a new Password Push
+
+ .DESCRIPTION
+ Create a new Push on the specified Password Pusher instance. The
+ programmatic equivalent of going to pwpush.com and entering info.
+ Returns [PasswordPush] object. Link member is a link created based on
+ 1-step setting and language specified, however both 1-step and direct links
+ are always provided at LinkRetrievalStep and LinkDirect.
+
+ .EXAMPLE
+ $myPush = New-Push "Here's my secret!"
+ PS > $myPush | Select-Object Link, LinkRetrievalStep, LinkDirect
+
+ Link : https://pwpush.com/en/p/gzv65wiiuciy # Requested style
+ LinkRetrievalStep : https://pwpush.com/en/p/gzv65wiiuciy/r # 1-step
+ LinkDirect : https://pwpush.com/en/p/gzv65wiiuciy # Direct
+
+ .EXAMPLE
+ "Super secret secret" | New-Push -RetrievalStep | Select-Object -ExpandProperty Link
+
+ https://pwpush.com/en/p/gzv65wiiuciy/r
+
+
+ .EXAMPLE
+ # "Burn after reading" style Push
+ PS > New-Push -Payload "Still secret text!" -ExpireAfterViews 1 -RetrievalStep
+
+ .INPUTS
+ [string]
+
+ .OUTPUTS
+ [PasswordPush] Push object
+ [string] Raw result of API call
+
+ .LINK
+ https://github.com/adamburley/PassPushPosh/blob/main/Docs/New-Push.md
+
+ .LINK
+ https://pwpush.com/api/1.0/passwords/create.en.html
+
+ .LINK
+ Get-Push
+
+ .NOTES
+ Maximum for -ExpireAfterDays and -ExpireAfterViews is based on the default
+ values for Password Pusher and what's used on the public instance
+ (pwpush.com). If you're using this with a private instance and want to
+ override that value you'll need to fork this module.
+
+ TODO: Support [PasswordPush] input objects, testing
+ #>
+ [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars','',Scope='Function',Justification='Global variables are used for module session helpers.')]
+ [CmdletBinding(SupportsShouldProcess,ConfirmImpact='Low',DefaultParameterSetName='Anonymous')]
+ [OutputType([PasswordPush],[string],[bool])] # Returntype should be [PasswordPush] but I've yet to find a way to add class access to a function on a module...
+ param(
+ # The password or secret text to share.
+ [Parameter(Mandatory=$true,ValueFromPipeline,Position=0)]
+ [Alias('Password')]
+ [ValidateNotNullOrEmpty()]
+ [string]$Payload,
+
+ # Label for this Push (requires Authenticated session)
+ [Parameter(ParameterSetName='RequiresAuthentication')]
+ [ValidateNotNullOrEmpty()]
+ [string]$Note,
+
+ # Expire secret link and delete after this many days.
+ [Parameter()]
+ [ValidateRange(1,90)]
+ [int]
+ $ExpireAfterDays,
+
+ # Expire secret link after this many views.
+ [Parameter()]
+ [ValidateRange(1,100)]
+ [int]
+ $ExpireAfterViews,
+
+ # Allow the recipient of a Push to delete it.
+ [Parameter()]
+ [switch]
+ $DeletableByViewer,
+
+ # Require recipient click an extra link to view Push payload.
+ # Helps to avoid chat systems and URL scanners from eating up views.
+ # Note that the retrieval step URL is always available for a push. This
+ # parameter changes if the 1-click link is used in the Link parameter
+ # and returned from the secret link helper (Get-SecretLink)
+ [Parameter()]
+ [switch]
+ $RetrievalStep,
+
+ # Override Language. Useful if sending to someone who speaks a
+ # different language. You can change this after the fact by changing
+ # the URL by hand or by requesting a link for the given token from the
+ # preview helper endpoint ( See Request-SecretLink )
+ [Parameter()]
+ [string]
+ $Language,
+
+ # Return the raw response body from the API call
+ [Parameter()]
+ [switch]
+ $Raw
+ )
+
+ begin {
+ Initialize-PassPushPosh -Verbose:$VerbosePreference -Debug:$DebugPreference
+ }
+
+ process {
+ if ($PSCmdlet.ParameterSetName -eq 'RequiresAuthentication' -and -not $Global:PPPHeaders.'X-User-Token') { Write-Error -Message 'Setting a note requires an authenticated call.'; return $false }
+
+ $body = @{
+ 'password' = @{
+ 'payload' = $Payload
+ }
+ }
+ $shouldString = 'Submit {0} push with Payload of length {1}' -f $PSCmdlet.ParameterSetName, $Payload.Length
+ if ($Note) {
+ $body.password.note = $note
+ $shouldString += " with note $note"
+ }
+ if ($ExpireAfterDays) {
+ $body.password.expire_after_days = $ExpireAfterDays
+ $shouldString += ', expire after {0} days' -f $ExpireAfterDays
+ }
+ if ($ExpireAfterViews) {
+ $body.password.expire_after_views = $ExpireAfterViews
+ $shouldString += ', expire after {0} views' -f $ExpireAfterViews
+ }
+ $body.password.deletable_by_viewer = if ($DeletableByViewer) {
+ $shouldString += ', deletable by viewer'
+ $true
+ } else {
+ $shouldString += ', NOT deletable by viewer'
+ $false
+ }
+ $body.password.retrieval_step = if ($RetrievalStep) {
+ $shouldString += ', with a 1-click retrieval step'
+ $true
+ } else {
+ $shouldString += ', with a direct link'
+ $false
+ }
+ if (-not $Language) { $Language = $Global:PPPLanguage }
+ $shouldString += ' in language "{0}"' -f $Language
+ if ($VerbosePreference -eq [System.Management.Automation.ActionPreference]::Continue) {
+ # Sanitize input so we're not logging or outputting the payload
+ $vBody = $body.Clone()
+ $vBody.password.payload = "A payload of length $($body.password.payload.Length.ToString())"
+ $vBs = $vBody | ConvertTo-Json | Out-String
+ Write-Verbose "Call Body (sanitized): $vBs"
+ }
+
+ $iwrSplat = @{
+ 'Method' = 'Post'
+ 'ContentType' = 'application/json'
+ 'Body' = ($body | ConvertTo-Json)
+ 'Uri' = "$Global:PPPBaseUrl/$Language/p.json"
+ 'UserAgent' = $Global:PPPUserAgent
+ }
+ if ($Global:PPPHeaders.'X-User-Token') { $iwrSplat['Headers'] = $Global:PPPHeaders }
+ Write-Verbose "Sending HTTP request (minus body): $($iwrSplat | Select-Object Method,ContentType,Uri,UserAgent,Headers | Out-String)"
+ if ($PSCmdlet.ShouldProcess($shouldString, $iwrSplat.Uri, 'Submit new Push')) {
+ try {
+ $response = Invoke-WebRequest @iwrSplat
+ if ($DebugPreference -eq [System.Management.Automation.ActionPreference]::Continue) {
+ Set-Variable -Scope Global -Name PPPLastCall -Value $response
+ Write-Debug 'Response to Invoke-WebRequest set to PPPLastCall Global variable'
+ }
+ if ($Raw) {
+ Write-Debug "Returning raw object: $($response.Content)"
+ return $response.Content
+ }
+ return $response.Content | ConvertTo-PasswordPush
+ } catch {
+ Write-Verbose "An exception was caught: $($_.Exception.Message)"
+ if ($DebugPreference -eq [System.Management.Automation.ActionPreference]::Continue) {
+ Set-Variable -Scope Global -Name PPPLastError -Value $_
+ Write-Debug -Message 'Response object set to global variable $PPPLastError'
+ }
+ }
+ }
+ }
+}
+function Remove-Push {
+ <#
+ .SYNOPSIS
+ Remove a Push
+
+ .DESCRIPTION
+ Remove (invalidate) an active push. Requires the Push be either set as
+ deletable by viewer, or that you are authenticated as the creator of the
+ Push.
+
+ If you have authorization to delete a push (deletable by viewer TRUE or
+ you are the Push owner) the endpoint will always return 200 OK with a Push
+ object, regardless if the Push was previously deleted or expired.
+
+ If the Push URL Token is invalid OR you are not authorized to delete the
+ Push, the endpoint returns 404 and this function returns $false
+
+ .INPUTS
+ [string] URL Token
+ [PasswordPush] representing the Push to remove
+
+ .OUTPUTS
+ [bool] True on success, otherwise False
+
+ .EXAMPLE
+ Remove-Push -URLToken bwzehzem_xu-
+
+ .EXAMPLE
+ Remove-Push -URLToken -Raw
+ {"expired":true,"deleted":true,"expired_on":"2022-11-21T13:23:45.341Z","expire_after_days":1,"expire_after_views":4,"url_token":"bwzehzem_xu-","created_at":"2022-11-21T13:20:08.635Z","updated_at":"2022-11-21T13:23:45.342Z","deletable_by_viewer":true,"retrieval_step":false,"days_remaining":1,"views_remaining":4}
+
+ .LINK
+ https://github.com/adamburley/PassPushPosh/blob/main/Docs/Remove-Push.md
+
+ .LINK
+ https://pwpush.com/api/1.0/passwords/destroy.en.html
+
+ .NOTES
+ TODO testing and debugging
+ #>
+ [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars','',Scope='Function',Justification='Global variables are used for module session helpers.')]
+ [CmdletBinding(SupportsShouldProcess,DefaultParameterSetName='Token')]
+ [OutputType([PasswordPush],[string],[bool])]
+ param(
+ # URL Token for the secret
+ [parameter(ValueFromPipeline,ParameterSetName='Token')]
+ [ValidateNotNullOrEmpty()]
+ [Alias('Token')]
+ [string]
+ $URLToken,
+
+ # PasswordPush object
+ [Parameter(ValueFromPipeline,ParameterSetName='Object')]
+ [PasswordPush]
+ $PushObject,
+
+ # Return the raw response body from the API call
+ [parameter()]
+ [switch]
+ $Raw
+ )
+ process {
+ try {
+ if ($PSCmdlet.ParameterSetName -eq 'Object') {
+ Write-Debug -Message "Remove-Push was passed a PasswordPush object with URLToken: [$($PushObject.URLToken)]"
+ if (-not $PushObject.IsDeletableByViewer -and -not $Global:PPPHeaders) { #Pre-qualify if this will succeed
+ Write-Warning -Message 'Unable to remove Push. Push is not marked as deletable by viewer and you are not authenticated.'
+ return $false
+ }
+ if ($PushObject.IsDeletableByViewer) {
+ Write-Verbose "Push is flagged as deletable by viewer, should be deletable."
+ } else { Write-Verbose "In an authenticated API session. Push will be deletable if it was created by authenticated user." }
+ $URLToken = $PushObject.URLToken
+ } else {
+ Write-Debug -Message "Remove-Push was passed a URLToken: [$URLToken]"
+ }
+ Write-Verbose -Message "Push with URL Token [$URLToken] will be deleted if 'Deletable by viewer' was enabled or you are the creator of the push and are authenticated."
+ $iwrSplat = @{
+ 'Method' = 'Delete'
+ 'ContentType' = 'application/json'
+ 'Uri' = "$Global:PPPBaseUrl/p/$URLToken.json"
+ 'UserAgent' = $Global:PPPUserAgent
+ }
+ if ($Global:PPPHeaders) { $iwrSplat['Headers'] = $Global:PPPHeaders }
+ Write-Verbose "Sending HTTP request: $($iwrSplat | Out-String)"
+ if ($PSCmdlet.ShouldProcess('Delete',"Push with token [$URLToken]")) {
+ $response = Invoke-WebRequest @iwrSplat
+ if ($DebugPreference -eq [System.Management.Automation.ActionPreference]::Continue) {
+ Set-Variable -Scope Global -Name PPPLastCall -Value $response
+ Write-Debug 'Response to Invoke-WebRequest set to PPPLastCall Global variable'
+ }
+ if ($Raw) {
+ Write-Debug "Returning raw object: $($response.Content)"
+ return $response.Content
+ }
+ return $response.Content | ConvertTo-PasswordPush
+ }
+ } catch {
+ if ($_.Exception.Response.StatusCode -eq 404) {
+ Write-Warning "Failed to delete Push. This can indicate an invalid URL Token, that the password was not marked deletable, or that you are not the owner."
+ return $false
+ } else {
+ Write-Verbose "An exception was caught: $($_.Exception.Message)"
+ if ($DebugPreference -eq [System.Management.Automation.ActionPreference]::Continue) {
+ Set-Variable -Scope Global -Name PPPLastError -Value $_
+ Write-Debug -Message 'Response object set to global variable $PPPLastError'
+ }
+ $_
+ }
+ }
+ }
+}
diff --git a/SendStats/run.ps1 b/SendStats/run.ps1
index b4427d230338..2e30b113ab55 100644
--- a/SendStats/run.ps1
+++ b/SendStats/run.ps1
@@ -17,6 +17,7 @@ $SendingObject = [PSCustomObject]@{
SetupComplete = $SetupComplete
RunningVersionAPI = $APIVersion.trim()
CountOfTotalTenants = $tenantcount
+ uid = $env:TenantID
} | ConvertTo-Json
Invoke-RestMethod -Uri 'https://management.cipp.app/api/stats' -Method POST -Body $SendingObject -ContentType 'application/json'
\ No newline at end of file
diff --git a/profile.ps1 b/profile.ps1
index 1aa6a00d98c6..f72dcd0c4c7d 100644
--- a/profile.ps1
+++ b/profile.ps1
@@ -46,6 +46,24 @@ try {
Write-LogMessage -message 'Could not retrieve keys from Keyvault' -LogData (Get-CippException -Exception $_) -Sev 'debug'
}
+Set-Location -Path $PSScriptRoot
+$CurrentVersion = (Get-Content .\version_latest.txt).trim()
+$Table = Get-CippTable -tablename 'Version'
+$LastStartup = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'Version' and RowKey eq 'Version'"
+if ($CurrentVersion -ne $LastStartup.Version) {
+ Write-Host "Version has changed from $($LastStartup.Version) to $CurrentVersion"
+ Clear-CippDurables
+ if ($LastStartup) {
+ $LastStartup.Version = $CurrentVersion
+ } else {
+ $LastStartup = [PSCustomObject]@{
+ PartitionKey = 'Version'
+ RowKey = 'Version'
+ Version = $CurrentVersion
+ }
+ }
+ Update-AzDataTableEntity @Table -Entity $LastStartup
+}
# Uncomment the next line to enable legacy AzureRm alias in Azure PowerShell.
# Enable-AzureRmAlias
diff --git a/version_latest.txt b/version_latest.txt
index 3b867ccd76c3..a94a88fbb889 100644
--- a/version_latest.txt
+++ b/version_latest.txt
@@ -1 +1 @@
-5.7.0
\ No newline at end of file
+5.8.5
\ No newline at end of file