Skip to content

Commit

Permalink
Merge pull request #1174 from Ren-Roros-Digital/checkstate
Browse files Browse the repository at this point in the history 
fix: check if $state -eq $true
  • Loading branch information
@JohnDuprey
JohnDuprey authored Nov 11, 2024
2 parents 5b29e33 + cc56064 commit 8fc6150
Show file tree
Hide file tree
Showing 13 changed files with 125 additions and 116 deletions.
19 changes: 9 additions & 10 deletions Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,12 +42,14 @@ function Invoke-CIPPStandardActivityBasedTimeout {
# Backwards compatibility for v5.7.0 and older
if ($null -eq $Settings.timeout ) { $Settings.timeout = '01:00:00' }

$State = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies' -tenantid $tenant
$StateIsCorrect = $State.definition -like "*$($Settings.timeout)*"
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies' -tenantid $tenant
$StateIsCorrect = if ($CurrentState.definition -like "*$($Settings.timeout)*") { $true } else { $false }

If ($Settings.remediate -eq $true) {
try {
if (!$StateIsCorrect) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message "Activity Based Timeout is already enabled and set to $($Settings.timeout)" -sev Info
} else {
$PolicyTemplate = @{
displayName = 'DefaultTimeoutPolicy'
isOrganizationDefault = $true
Expand All @@ -58,27 +60,24 @@ function Invoke-CIPPStandardActivityBasedTimeout {
$body = ConvertTo-Json -InputObject $PolicyTemplate -Depth 10 -Compress

# Switch between parameter sets if the policy already exists
if ($null -eq $State.id) {
if ($null -eq $CurrentState.id) {
$RequestType = 'POST'
$URI = 'https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies'
} else {
$RequestType = 'PATCH'
$URI = "https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies/$($State.id)"
$URI = "https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies/$($CurrentState.id)"
}
New-GraphPostRequest -tenantid $tenant -Uri $URI -Type $RequestType -Body $body -ContentType 'application/json'
Write-LogMessage -API 'Standards' -tenant $tenant -message "Enabled Activity Based Timeout with a value of $($Settings.timeout)" -sev Info
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message "Activity Based Timeout is already enabled and set to $($Settings.timeout)" -sev Info
}
} catch {
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to enable Activity Based Timeout a value of $($Settings.timeout). Error: $ErrorMessage" -sev Error
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to enable Activity Based Timeout a value of $($Settings.timeout)." -sev Error -LogData $_
}
}

if ($Settings.alert -eq $true) {

if ($StateIsCorrect) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message "Activity Based Timeout is enabled and set to $($Settings.timeout)" -sev Info
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message "Activity Based Timeout is not set to $($Settings.timeout)" -sev Alert
Expand Down
14 changes: 7 additions & 7 deletions Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,26 +29,26 @@ function Invoke-CIPPStandardDisableEmail {
param($Tenant, $Settings)
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableEmail'

$CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/Email' -tenantid $Tenant
$State = if ($CurrentInfo.state -eq 'enabled') { $true } else { $false }
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/Email' -tenantid $Tenant
$StateIsCorrect = ($CurrentState.state -eq 'disabled')

If ($Settings.remediate -eq $true) {
if ($State) {
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Email' -Enabled $false
} else {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Email authentication method is already disabled.' -sev Info
} else {
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Email' -Enabled $false
}
}

if ($Settings.alert -eq $true) {
if ($State) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Email authentication method is enabled' -sev Alert
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Email authentication method is not enabled' -sev Info
}
}

if ($Settings.report -eq $true) {
Add-CIPPBPAField -FieldName 'DisableEmail' -FieldValue $State -StoreAs bool -Tenant $tenant
Add-CIPPBPAField -FieldName 'DisableEmail' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
}
}
14 changes: 7 additions & 7 deletions Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,26 +29,26 @@ function Invoke-CIPPStandardDisableSMS {
param($Tenant, $Settings)
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableSMS'

$CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/SMS' -tenantid $Tenant
$State = if ($CurrentInfo.state -eq 'enabled') { $true } else { $false }
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/SMS' -tenantid $Tenant
$StateIsCorrect = ($CurrentState.state -eq 'disabled')

If ($Settings.remediate -eq $true) {
if ($State) {
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'SMS' -Enabled $false
} else {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'SMS authentication method is already disabled.' -sev Info
} else {
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'SMS' -Enabled $false
}
}

if ($Settings.alert -eq $true) {
if ($State) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'SMS authentication method is enabled' -sev Alert
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'SMS authentication method is not enabled' -sev Info
}
}

if ($Settings.report -eq $true) {
Add-CIPPBPAField -FieldName 'DisableSMS' -FieldValue $State -StoreAs bool -Tenant $tenant
Add-CIPPBPAField -FieldName 'DisableSMS' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
}
}
37 changes: 21 additions & 16 deletions Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTenantCreation.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,34 +31,39 @@ function Invoke-CIPPStandardDisableTenantCreation {
param($Tenant, $Settings)
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableTenantCreation'

$CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $Tenant
$State = $CurrentInfo.defaultUserRolePermissions.allowedToCreateTenants
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $Tenant
$StateIsCorrect = ($CurrentState.defaultUserRolePermissions.allowedToCreateTenants -eq $false)

If ($Settings.remediate -eq $true) {

if ($State) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are already disabled from creating tenants.' -sev Info
} else {
try {
$body = '{"defaultUserRolePermissions":{"allowedToCreateTenants":false}}'
New-GraphPostRequest -tenantid $tenant -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -Type patch -Body $body -ContentType 'application/json'
$GraphRequest = @{
tenantid = $tenant
uri = 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy'
AsApp = $false
Type = 'PATCH'
ContentType = 'application/json'
Body = '{"defaultUserRolePermissions":{"allowedToCreateTenants":false}}'
}
New-GraphPostRequest @GraphRequest
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Disabled users from creating tenants.' -sev Info
$State = $false
} catch {
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to disable users from creating tenants: $ErrorMessage" -sev 'Error'
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to disable users from creating tenants" -sev 'Error' -LogData $_
}
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are already disabled from creating tenants.' -sev Info
}
}
if ($Settings.alert -eq $true) {

if ($State) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are allowed to create tenants.' -sev Alert
} else {
if ($Settings.alert -eq $true) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are not allowed to create tenants.' -sev Info
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are allowed to create tenants.' -sev Alert
}
}

if ($Settings.report -eq $true) {
Add-CIPPBPAField -FieldName 'DisableTenantCreation' -FieldValue $State -StoreAs bool -Tenant $tenant
Add-CIPPBPAField -FieldName 'DisableTenantCreation' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
}
}
14 changes: 7 additions & 7 deletions Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,26 +29,26 @@ function Invoke-CIPPStandardDisableVoice {
param($Tenant, $Settings)
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableVoice'

$CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/Voice' -tenantid $Tenant
$State = if ($CurrentInfo.state -eq 'enabled') { $true } else { $false }
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/Voice' -tenantid $Tenant
$StateIsCorrect = ($CurrentState.state -eq 'disabled')

If ($Settings.remediate -eq $true) {
if ($State) {
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Voice' -Enabled $false
} else {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Voice authentication method is already disabled.' -sev Info
} else {
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Voice' -Enabled $false
}
}

if ($Settings.alert -eq $true) {
if ($State) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Voice authentication method is enabled' -sev Alert
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'Voice authentication method is not enabled' -sev Info
}
}

if ($Settings.report -eq $true) {
Add-CIPPBPAField -FieldName 'DisableVoice' -FieldValue $State -StoreAs bool -Tenant $tenant
Add-CIPPBPAField -FieldName 'DisableVoice' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
}
}
14 changes: 7 additions & 7 deletions Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,27 +29,27 @@ function Invoke-CIPPStandardDisablex509Certificate {
param($Tenant, $Settings)
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'Disablex509Certificate'

$CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/x509Certificate' -tenantid $Tenant
$State = if ($CurrentInfo.state -eq 'enabled') { $true } else { $false }
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/x509Certificate' -tenantid $Tenant
$StateIsCorrect = ($CurrentState.state -eq 'disabled')

If ($Settings.remediate -eq $true) {
if ($State) {
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'x509Certificate' -Enabled $false
} else {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'x509Certificate authentication method is already disabled.' -sev Info
} else {
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'x509Certificate' -Enabled $false
}
}

if ($Settings.alert -eq $true) {
if ($State) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'x509Certificate authentication method is enabled' -sev Alert
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'x509Certificate authentication method is not enabled' -sev Info
}
}

if ($Settings.report -eq $true) {
Add-CIPPBPAField -FieldName 'Disablex509Certificate' -FieldValue $State -StoreAs bool -Tenant $tenant
Add-CIPPBPAField -FieldName 'Disablex509Certificate' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
}

}
14 changes: 5 additions & 9 deletions Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,30 +29,26 @@ function Invoke-CIPPStandardEnableFIDO2 {
param($Tenant, $Settings)
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnableFIDO2'

$CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/Fido2' -tenantid $Tenant
$State = if ($CurrentInfo.state -eq 'enabled') { $true } else { $false }
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/Fido2' -tenantid $Tenant
$StateIsCorrect = ($CurrentState.state -eq 'enabled')

If ($Settings.remediate -eq $true) {

if ($State) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'FIDO2 Support is already enabled.' -sev Info
} else {
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'Fido2' -Enabled $true
}
}


if ($Settings.alert -eq $true) {

if ($State) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'FIDO2 Support is enabled' -sev Info
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'FIDO2 Support is not enabled' -sev Alert
}
}

if ($Settings.report -eq $true) {
Add-CIPPBPAField -FieldName 'EnableFIDO2' -FieldValue $State -StoreAs bool -Tenant $tenant
Add-CIPPBPAField -FieldName 'EnableFIDO2' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
}

}
12 changes: 5 additions & 7 deletions Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,28 +29,26 @@ function Invoke-CIPPStandardEnableHardwareOAuth {
param($Tenant, $Settings)
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnableHardwareOAuth'

$CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/HardwareOath' -tenantid $Tenant
$State = if ($CurrentInfo.state -eq 'enabled') { $true } else { $false }
$CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/HardwareOath' -tenantid $Tenant
$StateIsCorrect = ($CurrentState.state -eq 'enabled')

If ($Settings.remediate -eq $true) {

if ($State) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'HardwareOAuth Support is already enabled.' -sev Info
} else {
Set-CIPPAuthenticationPolicy -Tenant $tenant -APIName 'Standards' -AuthenticationMethodId 'HardwareOath' -Enabled $true
}
}

if ($Settings.alert -eq $true) {

if ($State) {
if ($StateIsCorrect -eq $true) {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'HardwareOAuth Support is enabled' -sev Info
} else {
Write-LogMessage -API 'Standards' -tenant $tenant -message 'HardwareOAuth Support is not enabled' -sev Alert
}
}

if ($Settings.report -eq $true) {
Add-CIPPBPAField -FieldName 'EnableHardwareOAuth' -FieldValue $State -StoreAs bool -Tenant $tenant
Add-CIPPBPAField -FieldName 'EnableHardwareOAuth' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
}
}
Loading

0 comments on commit 8fc6150

Please sign in to comment.