Skip to content

Commit acc9f5f

Browse files
JohnDupreyJohnDuprey
committed
fix application copy
1 parent c278676 commit acc9f5f

3 files changed

Lines changed: 76 additions & 47 deletions

File tree

‎Modules/CIPPCore/Public/GraphHelper/Get-CippException.ps1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ function Get-CippException {
88
Message = $Exception.Exception.Message
99
NormalizedError = Get-NormalizedError -message $Exception.Exception.Message
1010
Position = $Exception.InvocationInfo.PositionMessage
11+
StackTrace = ($Exception.ScriptStackTrace | Out-String)
1112
ScriptName = $Exception.InvocationInfo.ScriptName
1213
LineNumber = $Exception.InvocationInfo.ScriptLineNumber
1314
Category = $Exception.CategoryInfo.ToString()

‎Modules/CIPPCore/Public/New-CIPPApplicationCopy.ps1‎

Lines changed: 63 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -4,43 +4,74 @@ function New-CIPPApplicationCopy {
44
$App,
55
$Tenant
66
)
7-
$CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/servicePrincipals?$top=999' -tenantid $env:TenantID -NoAuthCheck $true
8-
try {
9-
$ExistingApp = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/Applications(appId='$($app)')" -tenantid $ENV:TenantID -NoAuthCheck $true
10-
$Type = 'Application'
11-
} catch {
12-
$ExistingApp = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals(appId='$($app)')/oauth2PermissionGrants" -tenantid $ENV:TenantID -NoAuthCheck $true
13-
$ExistingAppRoleAssignments = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals(appId='$($app)')/appRoleAssignments" -tenantid $ENV:TenantID -NoAuthCheck $true
14-
$Type = 'ServicePrincipal'
15-
}
16-
if (!$ExistingApp) {
17-
Write-LogMessage -message "Failed to add $App to tenant. This app does not exist." -tenant $tenant -API 'Application Copy' -sev error
18-
continue
7+
8+
Write-Information "Copying application $($App) to tenant $Tenant"
9+
$CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/v1.0/servicePrincipals?$top=999' -tenantid $env:TenantID -NoAuthCheck $true -AsApp $true
10+
11+
if ($CurrentInfo.appId -notcontains $App) {
12+
Write-Information "Application $($App) not found in partner tenant. Cannot copy permissions."
13+
throw 'We cannot copy permissions for this application because is not registered in the partner tenant.'
1914
}
20-
if ($Type -eq 'Application') {
21-
$DelegateResourceAccess = $Existingapp.requiredResourceAccess
22-
$ApplicationResourceAccess = $Existingapp.requiredResourceAccess
23-
$NoTranslateRequired = $false
24-
} else {
25-
$DelegateResourceAccess = $ExistingApp | Group-Object -Property resourceId | ForEach-Object {
26-
[pscustomobject]@{ resourceAppId = ($CurrentInfo | Where-Object -Property id -EQ $_.Name).appId; resourceAccess = @($_.Group | ForEach-Object { [pscustomobject]@{ id = $_.scope; type = 'Scope' } } )
15+
16+
try {
17+
try {
18+
$ExistingApp = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/applications(appId='$($app)')" -tenantid $ENV:TenantID -NoAuthCheck $true -AsApp $true
19+
$Type = 'Application'
20+
} catch {
21+
$ExistingApp = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals(appId='$($app)')/oauth2PermissionGrants" -tenantid $ENV:TenantID -NoAuthCheck $true -AsApp $true
22+
$ExistingAppRoleAssignments = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals(appId='$($app)')/appRoleAssignments" -tenantid $ENV:TenantID -NoAuthCheck $true -AsApp $true
23+
$Type = 'ServicePrincipal'
24+
}
25+
if (!$ExistingApp) {
26+
Write-LogMessage -message "Failed to add $App to tenant. This app does not exist." -tenant $tenant -API 'Application Copy' -sev error
27+
continue
28+
}
29+
if ($Type -eq 'Application') {
30+
Write-Information 'App type: Application'
31+
$DelegateResourceAccess = $Existingapp.requiredResourceAccess
32+
$ApplicationResourceAccess = $Existingapp.requiredResourceAccess
33+
$NoTranslateRequired = $false
34+
} else {
35+
Write-Information 'App type: ServicePrincipal'
36+
$DelegateResourceAccess = $ExistingApp | Group-Object -Property resourceId | ForEach-Object {
37+
[pscustomobject]@{ resourceAppId = ($CurrentInfo | Where-Object -Property id -EQ $_.Name).appId; resourceAccess = @($_.Group | ForEach-Object { [pscustomobject]@{ id = $_.scope; type = 'Scope' } } )
38+
}
2739
}
40+
$ApplicationResourceAccess = $ExistingappRoleAssignments | Group-Object -Property ResourceId | ForEach-Object {
41+
[pscustomobject]@{ resourceAppId = ($CurrentInfo | Where-Object -Property id -EQ $_.Name).appId; resourceAccess = @($_.Group | ForEach-Object { [pscustomobject]@{ id = $_.appRoleId; type = 'Role' } } )
42+
}
43+
}
44+
$NoTranslateRequired = $true
2845
}
29-
$ApplicationResourceAccess = $ExistingappRoleAssignments | Group-Object -Property ResourceId | ForEach-Object {
30-
[pscustomobject]@{ resourceAppId = ($CurrentInfo | Where-Object -Property id -EQ $_.Name).appId; resourceAccess = @($_.Group | ForEach-Object { [pscustomobject]@{ id = $_.appRoleId; type = 'Role' } } )
46+
$TenantInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/servicePrincipals?$top=999' -tenantid $Tenant -NoAuthCheck $true -AsApp $true
47+
48+
if ($App -Notin $TenantInfo.appId) {
49+
Write-Information "Creating service principal with ID: $($App)"
50+
$Body = @{
51+
appId = $App
3152
}
53+
$Body = $Body | ConvertTo-Json -Compress
54+
Write-Information ($Body | ConvertTo-Json -Depth 10)
55+
$null = New-GraphPostRequest 'https://graph.microsoft.com/v1.0/servicePrincipals' -type POST -tenantid $Tenant -body $Body -AsApp $true
56+
Write-LogMessage -message "Added $App as a service principal" -tenant $tenant -API 'Application Copy' -sev Info
57+
58+
} else {
59+
Write-Information "Service principal with ID: $($App) already exists in tenant $Tenant"
3260
}
33-
$NoTranslateRequired = $true
34-
}
35-
$TenantInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/servicePrincipals?$top=999' -tenantid $Tenant -NoAuthCheck $true
3661

37-
if ($App -Notin $TenantInfo.appId) {
38-
$null = New-GraphPostRequest 'https://graph.microsoft.com/beta/servicePrincipals' -type POST -tenantid $Tenant -body "{ `"appId`": `"$($App)`" }"
39-
Write-LogMessage -message "Added $App as a service principal" -tenant $tenant -API 'Application Copy' -sev Info
40-
}
41-
Add-CIPPApplicationPermission -RequiredResourceAccess $ApplicationResourceAccess -ApplicationId $App -Tenantfilter $Tenant
42-
Add-CIPPDelegatedPermission -RequiredResourceAccess $DelegateResourceAccess -ApplicationId $App -Tenantfilter $Tenant -NoTranslateRequired $NoTranslateRequired
43-
Write-LogMessage -message "Added permissions to $app" -tenant $tenant -API 'Application Copy' -sev Info
62+
if ($DelegateResourceAccess) {
63+
Add-CIPPDelegatedPermission -RequiredResourceAccess $ApplicationResourceAccess -ApplicationId $App -Tenantfilter $Tenant
64+
}
65+
if ($ApplicationResourceAccess) {
66+
Add-CIPPApplicationPermission -RequiredResourceAccess $ApplicationResourceAccess -ApplicationId $App -Tenantfilter $Tenant
67+
}
68+
Write-LogMessage -message "Added permissions to $app" -tenant $tenant -API 'Application Copy' -sev Info
4469

45-
return $Results
70+
return $Results
71+
} catch {
72+
Write-Warning "Failed to copy application $($App) to tenant $Tenant. Error: $($_.Exception.Message)"
73+
Write-Information $_.InvocationInfo.PositionMessage
74+
Write-Information ($_.ScriptStackTrace | Out-String)
75+
throw $_.Exception.Message
76+
}
4677
}

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1‎

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -30,33 +30,30 @@ function Invoke-CIPPStandardAppDeploy {
3030

3131
param($Tenant, $Settings)
3232
$AppsToAdd = $Settings.appids -split ','
33+
$AppExists = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals?$top=999' -tenantid $Tenant
3334

34-
If ($Settings.remediate -eq $true) {
35-
##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'AppDeploy'
36-
if ($Rerun -eq $true) {
37-
exit 0
38-
}
35+
if ($Settings.remediate -eq $true) {
3936
foreach ($App In $AppsToAdd) {
37+
$App = $App.Trim()
38+
if (!$App) {
39+
continue
40+
}
41+
$Application = $AppExists | Where-Object -Property appId -EQ $App
4042
try {
4143
New-CIPPApplicationCopy -App $App -Tenant $Tenant
42-
Write-LogMessage -API 'Standards' -tenant $tenant -message "Added $App to $Tenant and update it's permissions" -sev Info
44+
Write-LogMessage -API 'Standards' -tenant $tenant -message "Added application $($Application.displayName) ($App) to $Tenant and updated it's permissions" -sev Info
4345
} catch {
4446
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
45-
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to add app $App. Error: $ErrorMessage" -sev Error
47+
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to add app $($Application.displayName) ($App). Error: $ErrorMessage" -sev Error
4648
}
4749
}
4850
}
4951

5052
if ($Settings.alert) {
51-
$AppExists = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals?$top=999' -tenantid $Tenant
53+
5254
$MissingApps = foreach ($App in $AppsToAdd) {
53-
try {
54-
if ($App -notin $AppExists.appId) {
55-
$App
56-
}
57-
} catch {
58-
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
59-
Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to check app $App. Error: $ErrorMessage" -sev Error
55+
if ($App -notin $AppExists.appId) {
56+
$App
6057
}
6158
}
6259

0 commit comments

Comments
 (0)