Merge pull request #46 from KelvinTegelaar/master

[pull] master from KelvinTegelaar:master
advania · Aug 20, 2024 · 5f1c21c · 5f1c21c
2 parents a47f53e + 2b7fe4c
commit 5f1c21c
Show file tree

Hide file tree

Showing 56 changed files with 961 additions and 644 deletions.
diff --git a/.github/workflows/dev_cippz6s4d.yml → .github/workflows/dev_cipp4i6t3.yml b/.github/workflows/dev_cippz6s4d.yml → .github/workflows/dev_cipp4i6t3.yml
@@ -1,7 +1,7 @@
 # Docs for the Azure Web Apps Deploy action: https://github.com/azure/functions-action
 # More GitHub Actions for Azure: https://github.com/Azure/actions
 
-name: Build and deploy Powershell project to Azure Function App - cippz6s4d
+name: Build and deploy Powershell project to Azure Function App - cipp4i6t3
 
 on:
   push:
@@ -24,7 +24,7 @@ jobs:
         uses: Azure/functions-action@v1
         id: fa
         with:
-          app-name: 'cippz6s4d'
+          app-name: 'cipp4i6t3'
           slot-name: 'Production'
           package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
-          publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_D27E7CF0887F4E4591F3957CCA96F0FD }}
+          publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_9D257A31ACA24925A112AF5FFC2BEAFE }}
diff --git a/.github/workflows/dev_cipphfjdq.yml b/.github/workflows/dev_cipphfjdq.yml
diff --git a/.github/workflows/dev_cippacnqv.yml → .github/workflows/dev_cippkwn4s.yml b/.github/workflows/dev_cippacnqv.yml → .github/workflows/dev_cippkwn4s.yml
@@ -1,7 +1,7 @@
 # Docs for the Azure Web Apps Deploy action: https://github.com/azure/functions-action
 # More GitHub Actions for Azure: https://github.com/Azure/actions
 
-name: Build and deploy Powershell project to Azure Function App - cippacnqv
+name: Build and deploy Powershell project to Azure Function App - cippkwn4s
 
 on:
   push:
@@ -23,17 +23,17 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Login to Azure
-        uses: azure/login@v1
+        uses: azure/login@v2
         with:
-          client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_6085081ED1124B799258E9FF743FF4B9 }}
-          tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_9BDB2DDBFAFA4BC19C20A58B204BFAF3 }}
-          subscription-id: ${{ secrets.AZUREAPPSERVICE_SUBSCRIPTIONID_02B5224812794971B05EDD557AF2B867 }}
+          client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_B6BCC8886F40482FB8B43907FCDA6596 }}
+          tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_0D1C65B9099F48FABDF7F7052EA6887F }}
+          subscription-id: ${{ secrets.AZUREAPPSERVICE_SUBSCRIPTIONID_76518AE5ECB34375A414DEEE1119C161 }}
 
       - name: 'Run Azure Functions Action'
         uses: Azure/functions-action@v1
         id: fa
         with:
-          app-name: 'cippacnqv'
+          app-name: 'cippkwn4s'
           slot-name: 'Production'
           package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
 
diff --git a/.github/workflows/dev_cippckdtz.yml → .github/workflows/dev_cipplwwww.yml b/.github/workflows/dev_cippckdtz.yml → .github/workflows/dev_cipplwwww.yml
@@ -1,7 +1,7 @@
 # Docs for the Azure Web Apps Deploy action: https://github.com/azure/functions-action
 # More GitHub Actions for Azure: https://github.com/Azure/actions
 
-name: Build and deploy Powershell project to Azure Function App - cippckdtz
+name: Build and deploy Powershell project to Azure Function App - cipplwwww
 
 on:
   push:
@@ -24,7 +24,7 @@ jobs:
         uses: Azure/functions-action@v1
         id: fa
         with:
-          app-name: 'cippckdtz'
+          app-name: 'cipplwwww'
           slot-name: 'Production'
           package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
-          publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_726578DA8A7243BF9D82FE123C2F6E7F }}
+          publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_00A9A6DFE9244C2EA8952190FFF10F45 }}
diff --git a/.github/workflows/dev_cippopy3o.yml b/.github/workflows/dev_cippopy3o.yml
diff --git a/.github/workflows/dev_cipppwrro.yml b/.github/workflows/dev_cipppwrro.yml
diff --git a/.github/workflows/ninjaone_cipp426ns.yml b/.github/workflows/ninjaone_cipp426ns.yml
diff --git a/Config/SharePoint.BPATemplate.json b/Config/SharePoint.BPATemplate.json
@@ -31,18 +31,18 @@
         },
         {
           "name": "Resharing by external users",
-          "value": "isResharingByExternalUsersEnabled",
-          "formatter": "reverseBool"
+          "value": "SharepointSettings.isResharingByExternalUsersEnabled",
+          "formatter": "bool"
         },
         {
           "name": "Allow users to sync from unmanaged devices",
           "value": "SharepointSettings.isUnmanagedSyncAppForTenantRestricted",
-          "formatter": "bool"
+          "formatter": "reverseBool"
         },
         {
-          "name": "Site creation by standards users enabled",
+          "name": "Site creation by standard users enabled",
           "value": "SharepointSettings.isSiteCreationEnabled",
-          "formatter": "reverseBool"
+          "formatter": "bool"
         },
         {
           "name": "Deleted user data rention(days)",

diff --git a/Config/standards.json b/Config/standards.json
@@ -2235,7 +2235,7 @@
             "value": "none"
           },
           {
-            "label": "Restirct sharing to specific domains",
+            "label": "Restrict sharing to specific domains",
             "value": "allowList"
           },
           {

diff --git a/Modules/CIPPCore/Public/Add-CIPPApplicationPermission.ps1 b/Modules/CIPPCore/Public/Add-CIPPApplicationPermission.ps1
@@ -11,7 +11,26 @@ function Add-CIPPApplicationPermission {
     }
     Set-Location (Get-Item $PSScriptRoot).FullName
     if ($RequiredResourceAccess -eq 'CIPPDefaults') {
-        $RequiredResourceAccess = (Get-Content '.\SAMManifest.json' | ConvertFrom-Json).requiredResourceAccess
+        #$RequiredResourceAccess = (Get-Content '.\SAMManifest.json' | ConvertFrom-Json).requiredResourceAccess
+
+        $Permissions = Get-CippSamPermissions -NoDiff
+        $RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($AppId in $Permissions.Permissions.PSObject.Properties.Name) {
+            $AppPermissions = @($Permissions.Permissions.$AppId.applicationPermissions)
+            $Resource = @{
+                resourceAppId  = $AppId
+                resourceAccess = [System.Collections.Generic.List[object]]::new()
+            }
+            foreach ($Permission in $AppPermissions) {
+                $Resource.ResourceAccess.Add(@{
+                        id   = $Permission.id
+                        type = 'Role'
+                    })
+            }
+
+            $RequiredResourceAccess.Add($Resource)
+        }
     }
     $ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -skipTokenCache $true -tenantid $Tenantfilter -NoAuthCheck $true
     $ourSVCPrincipal = $ServicePrincipalList | Where-Object -Property AppId -EQ $ApplicationId

diff --git a/Modules/CIPPCore/Public/Add-CIPPDelegatedPermission.ps1 b/Modules/CIPPCore/Public/Add-CIPPDelegatedPermission.ps1
@@ -15,16 +15,31 @@ function Add-CIPPDelegatedPermission {
     }
 
     if ($RequiredResourceAccess -eq 'CIPPDefaults') {
-        $RequiredResourceAccess = (Get-Content '.\SAMManifest.json' | ConvertFrom-Json).requiredResourceAccess
-        $AdditionalPermissions = Get-Content '.\AdditionalPermissions.json' | ConvertFrom-Json
+        $Permissions = Get-CippSamPermissions -NoDiff
+        $NoTranslateRequired = $Permissions.Type -eq 'Table'
+        $RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
+        foreach ($AppId in $Permissions.Permissions.PSObject.Properties.Name) {
+            $DelegatedPermissions = @($Permissions.Permissions.$AppId.delegatedPermissions)
+            $ResourceAccess = [System.Collections.Generic.List[object]]::new()
+            foreach ($Permission in $DelegatedPermissions) {
+                $ResourceAccess.Add(@{
+                        id   = $Permission.value
+                        type = 'Scope'
+                    })
+            }
+            $Resource = @{
+                resourceAppId  = $AppId
+                resourceAccess = @($ResourceAccess)
+            }
+            $RequiredResourceAccess.Add($Resource)
+        }
 
         if ($Tenantfilter -eq $env:TenantID) {
             $RequiredResourceAccess = $RequiredResourceAccess + ($AdditionalPermissions | Where-Object { $RequiredResourceAccess.resourceAppId -notcontains $_.resourceAppId })
         } else {
             # remove the partner center permission if not pushing to partner tenant
             $RequiredResourceAccess = $RequiredResourceAccess | Where-Object { $_.resourceAppId -ne 'fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd' }
         }
-        $RequiredResourceAccess = $RequiredResourceAccess + ($AdditionalPermissions | Where-Object { $RequiredResourceAccess.resourceAppId -notcontains $_.resourceAppId })
     }
     $Translator = Get-Content '.\PermissionsTranslator.json' | ConvertFrom-Json
     $ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -tenantid $Tenantfilter -skipTokenCache $true -NoAuthCheck $true
@@ -46,16 +61,22 @@ function Add-CIPPDelegatedPermission {
                 continue
             }
         }
-        $AdditionalScopes = ($AdditionalPermissions | Where-Object -Property resourceAppId -EQ $App.resourceAppId).resourceAccess | Where-Object -Property type -EQ 'Scope'
+
         $DelegatedScopes = $App.resourceAccess | Where-Object -Property type -EQ 'Scope'
-        if ($AdditionalScopes) {
-            $NewScope = (@(($Translator | Where-Object { $_.id -in $DelegatedScopes.id }).value) + @($AdditionalScopes.id | Select-Object -Unique)) -join ' '
+        if ($NoTranslateRequired) {
+            $NewScope = @($DelegatedScopes | ForEach-Object { $_.id } | Sort-Object -Unique) -join ' '
         } else {
-            if ($NoTranslateRequired) {
-                $NewScope = @($DelegatedScopes | ForEach-Object { $_.id } | Sort-Object -Unique) -join ' '
-            } else {
-                $NewScope = @(($Translator | Where-Object { $_.id -in $DelegatedScopes.id }).value | Sort-Object -Unique) -join ' '
+            $NewScope = foreach ($Scope in $DelegatedScopes.id) {
+                if ($Scope -match '^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}$') {
+                    $TranslatedScope = ($Translator | Where-Object -Property id -EQ $Scope).value
+                    if ($TranslatedScope) {
+                        $TranslatedScope
+                    }
+                } else {
+                    $Scope
+                }
             }
+            $NewScope = (@($NewScope) | Sort-Object -Unique) -join ' '
         }
 
         $OldScope = ($CurrentDelegatedScopes | Where-Object -Property Resourceid -EQ $svcPrincipalId.id)
@@ -83,7 +104,7 @@ function Add-CIPPDelegatedPermission {
             # Added permissions
             $Added = ($Compare | Where-Object { $_.SideIndicator -eq '=>' }).InputObject -join ' '
             $Removed = ($Compare | Where-Object { $_.SideIndicator -eq '<=' }).InputObject -join ' '
-            $Results.add("Successfully updated permissions for $($svcPrincipalId.displayName). $(if ($Added) { "Added: $Added"}) $(if ($Removed) { "Removed: $Removed"})") 
+            $Results.add("Successfully updated permissions for $($svcPrincipalId.displayName). $(if ($Added) { "Added: $Added"}) $(if ($Removed) { "Removed: $Removed"})")
         }
     }
 

diff --git a/Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1 b/Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1
@@ -51,6 +51,10 @@ function Add-CIPPScheduledTask {
         $task.Recurrence.value
     }
 
+    if ([int64]$task.ScheduledTime -eq 0 -or [string]::IsNullOrEmpty($task.ScheduledTime)) {
+        $task.ScheduledTime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
+    }
+
     $entity = @{
         PartitionKey         = [string]'ScheduledTask'
         TaskState            = [string]'Planned'

diff --git a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertHuntressRogueApps.ps1 b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertHuntressRogueApps.ps1
@@ -0,0 +1,44 @@
+function Get-CIPPAlertHuntressRogueApps {
+    <#
+    .SYNOPSIS
+        Check for rogue apps in a Tenant
+    .DESCRIPTION
+        This function checks for rogue apps in the tenant by comparing the service principals in the tenant with a list of known rogue apps provided by Huntress.
+    .FUNCTIONALITY
+        Entrypoint
+    .LINK
+        https://huntresslabs.github.io/rogueapps/
+    #>
+    [CmdletBinding()]
+    Param (
+        [Parameter(Mandatory = $false)]
+        [Alias('input')]
+        $InputValue,
+        $TenantFilter
+    )
+
+    try {
+        $RogueApps = Invoke-RestMethod -Uri 'https://raw.githubusercontent.com/huntresslabs/rogueapps/main/public/rogueapps.json'
+        $RogueAppFilter = $RogueApps.appId -join "','"
+        $ServicePrincipals = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$filter=appId in ('$RogueAppFilter')" -tenantid $TenantFilter
+
+        if (($ServicePrincipals | Measure-Object).Count -gt 0) {
+            $AlertData = foreach ($ServicePrincipal in $ServicePrincipals) {
+                $RogueApp = $RogueApps | Where-Object { $_.appId -eq $ServicePrincipal.appId }
+                [pscustomobject]@{
+                    'App Name'       = $RogueApp.appDisplayName
+                    'App Id'         = $RogueApp.appId
+                    'Description'    = $RogueApp.description
+                    'Enabled'        = $ServicePrincipal.accountEnabled
+                    'Created'        = $ServicePrincipal.createdDateTime
+                    'Tags'           = $RogueApp.tags -join ', '
+                    'References'     = $RogueApp.references -join ', '
+                    'Huntress Added' = $RogueApp.dateAdded
+                }
+            }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
+        }
+    } catch {
+        #Write-AlertMessage -tenant $($TenantFilter) -message "Failed to check for rogue apps for $($TenantFilter): $(Get-NormalizedError -message $_.Exception.message)"
+    }
+}