Skip to content

Commit 3aa543f

Browse files
kris6673kris6673
authored
Merge branch 'KelvinTegelaar:dev' into dev
2 parents 546fe28 + a308f03 commit 3aa543f

13 files changed

Lines changed: 380 additions & 165 deletions

File tree

‎Modules/CIPPCore/Public/Add-CIPPApplicationPermission.ps1‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,26 @@ function Add-CIPPApplicationPermission {
1111
}
1212
Set-Location (Get-Item $PSScriptRoot).FullName
1313
if ($RequiredResourceAccess -eq 'CIPPDefaults') {
14-
$RequiredResourceAccess = (Get-Content '.\SAMManifest.json' | ConvertFrom-Json).requiredResourceAccess
14+
#$RequiredResourceAccess = (Get-Content '.\SAMManifest.json' | ConvertFrom-Json).requiredResourceAccess
15+
16+
$Permissions = Get-CippSamPermissions -NoDiff
17+
$RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
18+
19+
foreach ($AppId in $Permissions.Permissions.PSObject.Properties.Name) {
20+
$AppPermissions = @($Permissions.Permissions.$AppId.applicationPermissions)
21+
$Resource = @{
22+
resourceAppId = $AppId
23+
resourceAccess = [System.Collections.Generic.List[object]]::new()
24+
}
25+
foreach ($Permission in $AppPermissions) {
26+
$Resource.ResourceAccess.Add(@{
27+
id = $Permission.id
28+
type = 'Role'
29+
})
30+
}
31+
32+
$RequiredResourceAccess.Add($Resource)
33+
}
1534
}
1635
$ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -skipTokenCache $true -tenantid $Tenantfilter -NoAuthCheck $true
1736
$ourSVCPrincipal = $ServicePrincipalList | Where-Object -Property AppId -EQ $ApplicationId

‎Modules/CIPPCore/Public/Add-CIPPDelegatedPermission.ps1‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,31 @@ function Add-CIPPDelegatedPermission {
1515
}
1616

1717
if ($RequiredResourceAccess -eq 'CIPPDefaults') {
18-
$RequiredResourceAccess = (Get-Content '.\SAMManifest.json' | ConvertFrom-Json).requiredResourceAccess
19-
$AdditionalPermissions = Get-Content '.\AdditionalPermissions.json' | ConvertFrom-Json
18+
$Permissions = Get-CippSamPermissions -NoDiff
19+
$NoTranslateRequired = $Permissions.Type -eq 'Table'
20+
$RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
21+
foreach ($AppId in $Permissions.Permissions.PSObject.Properties.Name) {
22+
$DelegatedPermissions = @($Permissions.Permissions.$AppId.delegatedPermissions)
23+
$ResourceAccess = [System.Collections.Generic.List[object]]::new()
24+
foreach ($Permission in $DelegatedPermissions) {
25+
$ResourceAccess.Add(@{
26+
id = $Permission.value
27+
type = 'Scope'
28+
})
29+
}
30+
$Resource = @{
31+
resourceAppId = $AppId
32+
resourceAccess = @($ResourceAccess)
33+
}
34+
$RequiredResourceAccess.Add($Resource)
35+
}
2036

2137
if ($Tenantfilter -eq $env:TenantID) {
2238
$RequiredResourceAccess = $RequiredResourceAccess + ($AdditionalPermissions | Where-Object { $RequiredResourceAccess.resourceAppId -notcontains $_.resourceAppId })
2339
} else {
2440
# remove the partner center permission if not pushing to partner tenant
2541
$RequiredResourceAccess = $RequiredResourceAccess | Where-Object { $_.resourceAppId -ne 'fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd' }
2642
}
27-
$RequiredResourceAccess = $RequiredResourceAccess + ($AdditionalPermissions | Where-Object { $RequiredResourceAccess.resourceAppId -notcontains $_.resourceAppId })
2843
}
2944
$Translator = Get-Content '.\PermissionsTranslator.json' | ConvertFrom-Json
3045
$ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -tenantid $Tenantfilter -skipTokenCache $true -NoAuthCheck $true
@@ -46,16 +61,22 @@ function Add-CIPPDelegatedPermission {
4661
continue
4762
}
4863
}
49-
$AdditionalScopes = ($AdditionalPermissions | Where-Object -Property resourceAppId -EQ $App.resourceAppId).resourceAccess | Where-Object -Property type -EQ 'Scope'
64+
5065
$DelegatedScopes = $App.resourceAccess | Where-Object -Property type -EQ 'Scope'
51-
if ($AdditionalScopes) {
52-
$NewScope = (@(($Translator | Where-Object { $_.id -in $DelegatedScopes.id }).value) + @($AdditionalScopes.id | Select-Object -Unique)) -join ' '
66+
if ($NoTranslateRequired) {
67+
$NewScope = @($DelegatedScopes | ForEach-Object { $_.id } | Sort-Object -Unique) -join ' '
5368
} else {
54-
if ($NoTranslateRequired) {
55-
$NewScope = @($DelegatedScopes | ForEach-Object { $_.id } | Sort-Object -Unique) -join ' '
56-
} else {
57-
$NewScope = @(($Translator | Where-Object { $_.id -in $DelegatedScopes.id }).value | Sort-Object -Unique) -join ' '
69+
$NewScope = foreach ($Scope in $DelegatedScopes.id) {
70+
if ($Scope -match '^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}$') {
71+
$TranslatedScope = ($Translator | Where-Object -Property id -EQ $Scope).value
72+
if ($TranslatedScope) {
73+
$TranslatedScope
74+
}
75+
} else {
76+
$Scope
77+
}
5878
}
79+
$NewScope = (@($NewScope) | Sort-Object -Unique) -join ' '
5980
}
6081

6182
$OldScope = ($CurrentDelegatedScopes | Where-Object -Property Resourceid -EQ $svcPrincipalId.id)
@@ -83,7 +104,7 @@ function Add-CIPPDelegatedPermission {
83104
# Added permissions
84105
$Added = ($Compare | Where-Object { $_.SideIndicator -eq '=>' }).InputObject -join ' '
85106
$Removed = ($Compare | Where-Object { $_.SideIndicator -eq '<=' }).InputObject -join ' '
86-
$Results.add("Successfully updated permissions for $($svcPrincipalId.displayName). $(if ($Added) { "Added: $Added"}) $(if ($Removed) { "Removed: $Removed"})")
107+
$Results.add("Successfully updated permissions for $($svcPrincipalId.displayName). $(if ($Added) { "Added: $Added"}) $(if ($Removed) { "Removed: $Removed"})")
87108
}
88109
}
89110

‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertHuntressRogueApps.ps1‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
function Get-CIPPAlertHuntressRogueApps {
2+
<#
3+
.SYNOPSIS
4+
Check for rogue apps in a Tenant
5+
.DESCRIPTION
6+
This function checks for rogue apps in the tenant by comparing the service principals in the tenant with a list of known rogue apps provided by Huntress.
7+
.FUNCTIONALITY
8+
Entrypoint
9+
.LINK
10+
https://huntresslabs.github.io/rogueapps/
11+
#>
12+
[CmdletBinding()]
13+
Param (
14+
[Parameter(Mandatory = $false)]
15+
[Alias('input')]
16+
$InputValue,
17+
$TenantFilter
18+
)
19+
20+
try {
21+
$RogueApps = Invoke-RestMethod -Uri 'https://raw.githubusercontent.com/huntresslabs/rogueapps/main/public/rogueapps.json'
22+
$RogueAppFilter = $RogueApps.appId -join "','"
23+
$ServicePrincipals = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$filter=appId in ('$RogueAppFilter')" -tenantid $TenantFilter
24+
25+
if (($ServicePrincipals | Measure-Object).Count -gt 0) {
26+
$AlertData = foreach ($ServicePrincipal in $ServicePrincipals) {
27+
$RogueApp = $RogueApps | Where-Object { $_.appId -eq $ServicePrincipal.appId }
28+
[pscustomobject]@{
29+
'App Name' = $RogueApp.appDisplayName
30+
'App Id' = $RogueApp.appId
31+
'Description' = $RogueApp.description
32+
'Enabled' = $ServicePrincipal.accountEnabled
33+
'Created' = $ServicePrincipal.createdDateTime
34+
'Tags' = $RogueApp.tags -join ', '
35+
'References' = $RogueApp.references -join ', '
36+
'Huntress Added' = $RogueApp.dateAdded
37+
}
38+
}
39+
Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
40+
}
41+
} catch {
42+
#Write-AlertMessage -tenant $($TenantFilter) -message "Failed to check for rogue apps for $($TenantFilter): $(Get-NormalizedError -message $_.Exception.message)"
43+
}
44+
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecServicePrincipals.ps1‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,21 @@ function Invoke-ExecServicePrincipals {
1616
try {
1717
switch ($Request.Query.Action) {
1818
'Create' {
19-
$Body = @{
20-
'appId' = $Request.Query.AppId
21-
} | ConvertTo-Json -Compress
22-
$Results = New-GraphPostRequest -Uri 'https://graph.microsoft.com/beta/servicePrincipals' -tenantid $TenantFilter -type POST -body $Body
19+
$Action = 'Create'
20+
if ($Request.Query.AppId -match '^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$') {
21+
$Body = @{
22+
'appId' = $Request.Query.AppId
23+
} | ConvertTo-Json -Compress
24+
try {
25+
$Results = New-GraphPostRequest -Uri 'https://graph.microsoft.com/beta/servicePrincipals' -tenantid $TenantFilter -type POST -body $Body
26+
} catch {
27+
$Results = "Unable to create service principal: $($_.Exception.Message)"
28+
$Success = $false
29+
}
30+
} else {
31+
$Results = 'Invalid AppId'
32+
$Success = $false
33+
}
2334
}
2435
default {
2536
if ($Request.Query.AppId) {

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1‎

Lines changed: 2 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ function Invoke-ExecSAMAppPermissions {
1515
$Entity = @{
1616
'PartitionKey' = 'CIPP-SAM'
1717
'RowKey' = 'CIPP-SAM'
18-
'Permissions' = [string]($Permissions | ConvertTo-Json -Depth 10 -Compress)
18+
'Permissions' = [string]($Permissions.Permissions | ConvertTo-Json -Depth 10 -Compress)
1919
}
2020
$Table = Get-CIPPTable -TableName 'AppPermissions'
2121
$null = Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
@@ -29,77 +29,7 @@ function Invoke-ExecSAMAppPermissions {
2929
}
3030
}
3131
default {
32-
$ModuleBase = Get-Module -Name CIPPCore | Select-Object -ExpandProperty ModuleBase
33-
$SamManifest = Get-Item "$ModuleBase\Public\SAMManifest.json"
34-
$AdditionalPermissions = Get-Item "$ModuleBase\Public\AdditionalPermissions.json"
35-
36-
$LastWrite = @{
37-
'SAMManifest' = $SamManifest.LastWriteTime
38-
'AdditionalPermissions' = $AdditionalPermissions.LastWriteTime
39-
}
40-
41-
$ServicePrincipals = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/servicePrincipals?$top=999&$select=appId,displayName,appRoles,publishedPermissionScopes' -tenantid $env:TenantID -NoAuthCheck $true
42-
$SAMManifest = Get-Content -Path $SamManifest.FullName | ConvertFrom-Json
43-
$AdditionalPermissions = Get-Content -Path $AdditionalPermissions.FullName | ConvertFrom-Json
44-
45-
$RequiredResources = $SamManifest.requiredResourceAccess
46-
47-
$AppIds = ($RequiredResources.resourceAppId + $AdditionalPermissions.resourceAppId) | Sort-Object -Unique
48-
49-
$Permissions = @{}
50-
foreach ($AppId in $AppIds) {
51-
$ServicePrincipal = $ServicePrincipals | Where-Object -Property appId -EQ $AppId
52-
$AppPermissions = [System.Collections.Generic.List[object]]@()
53-
$ManifestPermissions = ($RequiredResources | Where-Object -Property resourceAppId -EQ $AppId).resourceAccess
54-
$UnpublishedPermissions = ($AdditionalPermissions | Where-Object -Property resourceAppId -EQ $AppId).resourceAccess
55-
56-
foreach ($Permission in $ManifestPermissions) {
57-
$AppPermissions.Add($Permission)
58-
}
59-
if ($UnpublishedPermissions) {
60-
foreach ($Permission in $UnpublishedPermissions) {
61-
$AppPermissions.Add($Permission)
62-
}
63-
}
64-
65-
$ApplicationPermissions = [system.collections.generic.list[object]]@()
66-
$DelegatedPermissions = [system.collections.generic.list[object]]@()
67-
foreach ($Permission in $AppPermissions) {
68-
if ($Permission.id -match '^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}$') {
69-
if ($Permission.type -eq 'Role') {
70-
$PermissionName = ($ServicePrincipal.appRoles | Where-Object -Property id -EQ $Permission.id).value
71-
} else {
72-
$PermissionName = ($ServicePrincipal.publishedPermissionScopes | Where-Object -Property id -EQ $Permission.id).value
73-
}
74-
} else {
75-
$PermissionName = $Permission.id
76-
}
77-
78-
if ($Permission.type -eq 'Role') {
79-
$ApplicationPermissions.Add([PSCustomObject]@{
80-
id = $Permission.id
81-
value = $PermissionName
82-
83-
})
84-
} else {
85-
$DelegatedPermissions.Add([PSCustomObject]@{
86-
id = $Permission.id
87-
value = $PermissionName
88-
})
89-
}
90-
}
91-
92-
$ServicePrincipal = $ServicePrincipals | Where-Object -Property appId -EQ $AppId
93-
$Permissions.$AppId = @{
94-
applicationPermissions = @($ApplicationPermissions | Sort-Object -Property label)
95-
delegatedPermissions = @($DelegatedPermissions | Sort-Object -Property label)
96-
}
97-
}
98-
99-
$Body = @{
100-
'Permissions' = $Permissions
101-
'LastUpdate' = $LastWrite
102-
}
32+
$Body = Get-CippSamPermissions
10333
}
10434
}
10535

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddDefenderDeployment.ps1‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,14 @@ Function Invoke-AddDefenderDeployment {
3535
iosMobileApplicationManagementEnabled = [bool]$Compliance.appSync
3636
microsoftDefenderForEndpointAttachEnabled = [bool]$true
3737
} | ConvertTo-Json -Compress
38-
$SettingsRequest = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/mobileThreatDefenseConnectors/' -tenantid $tenant -type POST -body $SettingsObj -AsApp $true
39-
"$($Tenant): Successfully set Defender Compliance and Reporting settings"
38+
$ExistingSettings = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/mobileThreatDefenseConnectors/fc780465-2017-40d4-a0c5-307022471b92' -tenantid $tenant
39+
if ($ExistingSettings) {
40+
"Defender Intune Configuration already active for $($Tenant). Skipping"
41+
} else {
42+
$SettingsRequest = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/mobileThreatDefenseConnectors/' -tenantid $tenant -type POST -body $SettingsObj -AsApp $true
43+
"$($Tenant): Successfully set Defender Compliance and Reporting settings"
44+
}
45+
4046

4147
$Settings = switch ($PolicySettings) {
4248
{ $_.ScanArchives } {
@@ -210,11 +216,11 @@ Function Invoke-AddDefenderDeployment {
210216
settings = @($EDRSettings)
211217
}
212218
Write-Host ( $EDRbody)
213-
$CheckExististingEDR = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -tenantid $tenant
219+
$CheckExististingEDR = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -tenantid $tenant | Where-Object -Property Name -EQ 'EDR Configuration'
214220
if ('EDR Configuration' -in $CheckExististingEDR.Name) {
215221
"$($Tenant): EDR Policy already exists. Skipping"
216222
} else {
217-
#$EDRRequest = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -tenantid $tenant -type POST -body $EDRbody
223+
$EDRRequest = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -tenantid $tenant -type POST -body $EDRbody
218224
if ($ASR.AssignTo -ne 'none') {
219225
$AssignBody = if ($ASR.AssignTo -ne 'AllDevicesAndUsers') { '{"assignments":[{"id":"","target":{"@odata.type":"#microsoft.graph.' + $($asr.AssignTo) + 'AssignmentTarget"}}]}' } else { '{"assignments":[{"id":"","target":{"@odata.type":"#microsoft.graph.allDevicesAssignmentTarget"}},{"id":"","target":{"@odata.type":"#microsoft.graph.allLicensedUsersAssignmentTarget"}}]}' }
220226
$assign = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($EDRRequest.id)')/assign" -tenantid $tenant -type POST -body $AssignBody

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ Function Invoke-ExecJITAdmin {
136136
}
137137
}
138138

139-
$Parameters = [pscustomobject]@{
139+
$Parameters = @{
140140
TenantFilter = $Request.Body.TenantFilter
141141
User = @{
142142
'UserPrincipalName' = $Username
@@ -153,7 +153,7 @@ Function Invoke-ExecJITAdmin {
153153
value = 'Set-CIPPUserJITAdmin'
154154
label = 'Set-CIPPUserJITAdmin'
155155
}
156-
Parameters = $Parameters
156+
Parameters = [pscustomobject]$Parameters
157157
ScheduledTime = $Request.Body.StartDate
158158
PostExecution = @{
159159
Webhook = [bool]$Request.Body.PostExecution.Webhook

0 commit comments

Comments
 (0)