JohnDuprey
diff --git a/‎.github/workflows/deploy_dev_testing.yml
Lines changed: 0 additions & 30 deletions b/‎.github/workflows/deploy_dev_testing.yml
Lines changed: 0 additions & 30 deletions
diff --git a/‎Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1
Lines changed: 25 additions & 16 deletions b/‎Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1
Lines changed: 25 additions & 16 deletions
diff --git a/‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-AddScheduledItem.ps1
Lines changed: 0 additions & 2 deletions b/‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-AddScheduledItem.ps1
Lines changed: 0 additions & 2 deletions
diff --git a/‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetRetentionHold.ps1
Lines changed: 50 additions & 0 deletions b/‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetRetentionHold.ps1
Lines changed: 50 additions & 0 deletions
diff --git a/‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1
Lines changed: 5 additions & 2 deletions b/‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1
Lines changed: 5 additions & 2 deletions
diff --git a/‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1
Lines changed: 39 additions & 0 deletions b/‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1
Lines changed: 39 additions & 0 deletions
diff --git a/‎Modules/CIPPCore/Public/New-CIPPUserTask.ps1
Lines changed: 33 additions & 27 deletions b/‎Modules/CIPPCore/Public/New-CIPPUserTask.ps1
Lines changed: 33 additions & 27 deletions
diff --git a/‎Modules/CIPPCore/Public/New-CippUser.ps1
Lines changed: 15 additions & 13 deletions b/‎Modules/CIPPCore/Public/New-CippUser.ps1
Lines changed: 15 additions & 13 deletions
@@ -237,16 +237,16 @@ function Test-CIPPAccess {
                 }
                 return $true
                 if ($APIAllowed) {
-                    $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter ?? $env:TenantID
+                    $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter ?? $Request.Query.tenantId ?? $Request.Body.tenantId ?? $env:TenantID
                     # Check tenant level access
                     if (($Role.BlockedTenants | Measure-Object).Count -eq 0 -and $Role.AllowedTenants -contains 'AllTenants') {
                         $TenantAllowed = $true
                     } elseif ($TenantFilter -eq 'AllTenants') {
-                    } elseif ($TenantFilter -eq 'AllTenants') {
+
                         $TenantAllowed = $false
                     } else {
                         $Tenant = ($Tenants | Where-Object { $TenantFilter -eq $_.customerId -or $TenantFilter -eq $_.defaultDomainName }).customerId
-                        $Tenant = ($Tenants | Where-Object { $TenantFilter -eq $_.customerId -or $TenantFilter -eq $_.defaultDomainName }).customerId
+
                         if ($Role.AllowedTenants -contains 'AllTenants') {
                             $AllowedTenants = $Tenants.customerId
                         } else {
@@ -264,22 +264,31 @@ function Test-CIPPAccess {
                 }
             }
 
+            if (!$TenantAllowed -and $Help.Functionality -notmatch 'AnyTenant') {
+
+                if (!$APIAllowed) {
+                    throw "Access to this CIPP API endpoint is not allowed, you do not have the required permission: $APIRole"
+                }
+                if (!$TenantAllowed -and $Help.Functionality -notmatch 'AnyTenant') {
+                    Write-Information "Tenant not allowed: $TenantFilter"
+
+                    throw 'Access to this tenant is not allowed'
+                } else {
+                    return $true
+                }
 
-            if (!$APIAllowed) {
-                throw "Access to this CIPP API endpoint is not allowed, you do not have the required permission: $APIRole"
-                throw "Access to this CIPP API endpoint is not allowed, you do not have the required permission: $APIRole"
             }
-            if (!$TenantAllowed -and $Help.Functionality -notmatch 'AnyTenant') {
-                throw 'Access to this tenant is not allowed'
-            } else {
-                return $true
+        } else {
+            # No permissions found for any roles
+            if ($TenantList.IsPresent) {
+                return @('AllTenants')
             }
+            return $true
         }
-    } else {
-        # No permissions found for any roles
-        if ($TenantList.IsPresent) {
-            return @('AllTenants')
-        }
-        return $true
     }
+
+    if ($TenantList.IsPresent) {
+        return @('AllTenants')
+    }
+    return $true
 }
@@ -14,8 +14,6 @@ function Invoke-AddScheduledItem {
     } else {
         $hidden = $true
     }
-    $Result = Add-CIPPScheduledTask -Task $Request.body -Headers $Request.Headers -hidden $hidden -DisallowDuplicateName $Request.query.DisallowDuplicateName
-    Write-LogMessage -headers $Request.Headers -API $APINAME -message $Result -Sev 'Info'
 
     if ($Request.Body.RunNow -eq $true) {
         try {
 
@@ -0,0 +1,50 @@
+function Invoke-ExecSetRetentionHold {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Exchange.Mailbox.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+    Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message 'Accessed this API' -Sev 'Debug'
+
+    # Interact with the query or body of the request
+    $TenantFilter = $Request.Body.tenantFilter
+    $RetentionHoldState = -not $Request.Body.disable -as [bool]
+    $Identity = $Request.Body.Identity
+    $UserPrincipalName = $Request.Body.UPN
+
+    # Set the parameters for the EXO request
+    $ExoRequest = @{
+        tenantid  = $TenantFilter
+        cmdlet    = 'Set-Mailbox'
+        cmdParams = @{
+            Identity              = $Identity
+            RetentionHoldEnabled = $RetentionHoldState
+        }
+    }
+
+    # Execute the EXO request
+    try {
+        $null = New-ExoRequest @ExoRequest
+        $Results = "Retention hold for $UserPrincipalName with Id $Identity has been set to $RetentionHoldState"
+        
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message $Results -sev Info
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Results = "Could not set retention hold for $UserPrincipalName with Id $Identity to $RetentionHoldState. Error: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    # Associate values to output bindings by calling 'Push-OutputBinding'.
+    Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = @{ Results = $Results }
+        })
+}
@@ -17,7 +17,7 @@ Function Invoke-ListMailboxes {
     # Interact with query parameters or the body of the request.
     $TenantFilter = $Request.Query.tenantFilter
     try {
-        $Select = 'id,ExchangeGuid,ArchiveGuid,UserPrincipalName,DisplayName,PrimarySMTPAddress,RecipientType,RecipientTypeDetails,EmailAddresses,WhenSoftDeleted,IsInactiveMailbox,ForwardingSmtpAddress,DeliverToMailboxAndForward,ForwardingAddress,HiddenFromAddressListsEnabled,ExternalDirectoryObjectId,MessageCopyForSendOnBehalfEnabled,MessageCopyForSentAsEnabled,PersistedCapabilities,LitigationHoldEnabled,LitigationHoldDate,LitigationHoldDuration'
+        $Select = 'id,ExchangeGuid,ArchiveGuid,UserPrincipalName,DisplayName,PrimarySMTPAddress,RecipientType,RecipientTypeDetails,EmailAddresses,WhenSoftDeleted,IsInactiveMailbox,ForwardingSmtpAddress,DeliverToMailboxAndForward,ForwardingAddress,HiddenFromAddressListsEnabled,ExternalDirectoryObjectId,MessageCopyForSendOnBehalfEnabled,MessageCopyForSentAsEnabled,PersistedCapabilities,LitigationHoldEnabled,LitigationHoldDate,LitigationHoldDuration,ComplianceTagHoldApplied,RetentionHoldEnabled,InPlaceHolds'
         $ExoRequest = @{
             tenantid  = $TenantFilter
             cmdlet    = 'Get-Mailbox'
@@ -73,7 +73,10 @@ Function Invoke-ListMailboxes {
         LitigationHoldEnabled,
         LitigationHoldDate,
         LitigationHoldDuration,
-        @{ Name = 'LicensedForLitigationHold'; Expression = { ($_.PersistedCapabilities -contains 'BPOS_S_DlpAddOn' -or $_.PersistedCapabilities -contains 'BPOS_S_Enterprise') } }
+        @{ Name = 'LicensedForLitigationHold'; Expression = { ($_.PersistedCapabilities -contains 'BPOS_S_DlpAddOn' -or $_.PersistedCapabilities -contains 'BPOS_S_Enterprise') } },
+        ComplianceTagHoldApplied,
+        RetentionHoldEnabled,
+        InPlaceHolds,
 
         $StatusCode = [HttpStatusCode]::OK
     } catch {
 
@@ -177,11 +177,50 @@ function Invoke-ListUserMailboxDetails {
         $TotalArchiveItemCount = try { [math]::Round($ArchiveSizeRequest.ItemCount, 2) } catch { 0 }
     }
 
+    # Parse InPlaceHolds to determine hold types if avaliable
+    $InPlaceHold             = $false
+    $EDiscoveryHold          = $false
+    $PurviewRetentionHold    = $false
+    $ExcludedFromOrgWideHold = $false
+
+    # Check if InPlaceHolds property exists and has values
+    if ($MailboxDetailedRequest.InPlaceHolds) {
+        foreach ($hold in $MailboxDetailedRequest.InPlaceHolds) {
+            # eDiscovery hold - starts with UniH
+            if ($hold -like 'UniH*') {
+                $EDiscoveryHold = $true
+            }
+            # In-Place Hold - no prefix or starts with cld
+            # Check if it doesn't match any of the other known prefixes
+            elseif (($hold -like 'cld*' -or 
+                    ($hold -notlike 'UniH*' -and 
+                    $hold -notlike 'mbx*' -and 
+                    $hold -notlike 'skp*' -and 
+                    $hold -notlike '-mbx*'))) {
+                $InPlaceHold = $true
+            }
+            # Microsoft Purview retention policy - starts with mbx or skp
+            elseif ($hold -like 'mbx*' -or $hold -like 'skp*') {
+                $PurviewRetentionHold = $true
+            }
+            # Excluded from organization-wide Microsoft Purview retention policy - starts with -mbx
+            elseif ($hold -like '-mbx*') {
+                $ExcludedFromOrgWideHold = $true
+            }
+        }
+    }
+
     # Build the GraphRequest object
     $GraphRequest = [ordered]@{
         ForwardAndDeliver        = $MailboxDetailedRequest.DeliverToMailboxAndForward
         ForwardingAddress        = $ForwardingAddress
         LitigationHold           = $MailboxDetailedRequest.LitigationHoldEnabled
+        RetentionHold            = $MailboxDetailedRequest.RetentionHoldEnabled
+        ComplianceTagHold        = $MailboxDetailedRequest.ComplianceTagHoldApplied
+        InPlaceHold              = $InPlaceHold
+        EDiscoveryHold           = $EDiscoveryHold
+        PurviewRetentionHold     = $PurviewRetentionHold
+        ExcludedFromOrgWideHold  = $ExcludedFromOrgWideHold
         HiddenFromAddressLists   = $MailboxDetailedRequest.HiddenFromAddressListsEnabled
         EWSEnabled               = $CASRequest.EwsEnabled
         MailboxMAPIEnabled       = $CASRequest.MAPIEnabled
 
@@ -1,52 +1,58 @@
 function New-CIPPUserTask {
     [CmdletBinding()]
     param (
-        $userobj,
+        $UserObj,
         $APIName = 'New User Task',
         $TenantFilter,
         $Headers
     )
     $Results = [System.Collections.Generic.List[string]]::new()
 
     try {
-        $CreationResults = New-CIPPUser -userobj $UserObj -APIName $APINAME -Headers $Headers
-        $results.add('Created New User.')
-        $results.add("Username: $($CreationResults.username)")
-        $results.add("Password: $($CreationResults.password)")
+        $CreationResults = New-CIPPUser -UserObj $UserObj -APIName $APIName -Headers $Headers
+        $Results.Add('Created New User.')
+        $Results.Add("Username: $($CreationResults.Username)")
+        $Results.Add("Password: $($CreationResults.Password)")
+        $Results.Add("$($CreationResults.Password)")
     } catch {
-        $results.add("Failed to create user. $($_.Exception.Message)" )
-        return @{'Results' = $results }
+        $Results.Add("Failed to create user. $($_.Exception.Message)" )
+        return @{'Results' = $Results }
     }
 
     try {
-        if ($userobj.licenses.value) {
-            $LicenseResults = Set-CIPPUserLicense -UserId $CreationResults.username -TenantFilter $UserObj.tenantFilter -AddLicenses $UserObj.licenses.value -Headers $Headers
+        if ($UserObj.licenses.value) {
+            $LicenseResults = Set-CIPPUserLicense -UserId $CreationResults.Username -TenantFilter $UserObj.tenantFilter -AddLicenses $UserObj.licenses.value -Headers $Headers
             $Results.Add($LicenseResults)
         }
     } catch {
-        Write-LogMessage -headers $Headers -API $APINAME -tenant $($userobj.tenantFilter) -message "Failed to assign the license. Error:$($_.Exception.Message)" -Sev 'Error'
-        $body = $results.add("Failed to assign the license. $($_.Exception.Message)")
+        Write-LogMessage -headers $Headers -API $APIName -tenant $($UserObj.tenantFilter) -message "Failed to assign the license. Error:$($_.Exception.Message)" -Sev 'Error'
+        $Results.Add("Failed to assign the license. $($_.Exception.Message)")
     }
 
     try {
-        if ($Userobj.AddedAliases) {
-            $AliasResults = Add-CIPPAlias -user $CreationResults.username -Aliases ($UserObj.AddedAliases -split '\s') -UserprincipalName $CreationResults.Username -TenantFilter $UserObj.tenantFilter -APIName $APINAME -Headers $Headers
-            $results.add($AliasResults)
+        if ($UserObj.AddedAliases) {
+            $AliasResults = Add-CIPPAlias -user $CreationResults.Username -Aliases ($UserObj.AddedAliases -split '\s') -UserprincipalName $CreationResults.Username -TenantFilter $UserObj.tenantFilter -APIName $APIName -Headers $Headers
+            $Results.Add($AliasResults)
         }
     } catch {
-        Write-LogMessage -headers $Headers -API $APINAME -tenant $($userobj.tenantFilter) -message "Failed to create the Aliases. Error:$($_.Exception.Message)" -Sev 'Error'
-        $body = $results.add("Failed to create the Aliases: $($_.Exception.Message)")
+        Write-LogMessage -headers $Headers -API $APIName -tenant $($UserObj.tenantFilter) -message "Failed to create the Aliases. Error:$($_.Exception.Message)" -Sev 'Error'
+        $Results.Add("Failed to create the Aliases: $($_.Exception.Message)")
     }
-    if ($userobj.copyFrom.value) {
-        Write-Host "Copying from $($userObj.copyFrom.value)"
-        $CopyFrom = Set-CIPPCopyGroupMembers -Headers $Headers -CopyFromId $userObj.copyFrom.value -UserID $CreationResults.Username -TenantFilter $UserObj.tenantFilter
-        $CopyFrom.Success | ForEach-Object { $results.Add($_) }
-        $CopyFrom.Error | ForEach-Object { $results.Add($_) }
+    if ($UserObj.copyFrom.value) {
+        Write-Host "Copying from $($UserObj.copyFrom.value)"
+        $CopyFrom = Set-CIPPCopyGroupMembers -Headers $Headers -CopyFromId $UserObj.copyFrom.value -UserID $CreationResults.Username -TenantFilter $UserObj.tenantFilter
+        $CopyFrom.Success | ForEach-Object { $Results.Add($_) }
+        $CopyFrom.Error | ForEach-Object { $Results.Add($_) }
     }
 
-    if ($userobj.setManager) {
-        $ManagerResult = Set-CIPPManager -user $CreationResults.username -Manager $userObj.setManager.value -TenantFilter $UserObj.tenantFilter -APIName 'Set Manager' -Headers $Headers
-        $results.add($ManagerResult)
+    if ($UserObj.setManager) {
+        $ManagerResult = Set-CIPPManager -user $CreationResults.Username -Manager $UserObj.setManager.value -TenantFilter $UserObj.tenantFilter -APIName 'Set Manager' -Headers $Headers
+        $Results.Add($ManagerResult)
+    }
+
+    if ($UserObj.setSponsor) {
+        $SponsorResult = Set-CIPPManager -user $CreationResults.Username -Manager $UserObj.setSponsor.value -TenantFilter $UserObj.tenantFilter -APIName 'Set Sponsor' -Headers $Headers
+        $Results.Add($SponsorResult)
     }
 
     if ($userobj.setSponsor) {
@@ -55,9 +61,9 @@ function New-CIPPUserTask {
     }
 
     return @{
-        Results  = $results
-        username = $CreationResults.username
-        password = $CreationResults.password
+        Results  = $Results
+        Username = $CreationResults.Username
+        Password = $CreationResults.Password
         CopyFrom = $CopyFrom
     }
 }
@@ -1,29 +1,29 @@
 function New-CIPPUser {
     [CmdletBinding()]
     param (
-        $userobj,
+        $UserObj,
         $Aliases = 'Scheduled',
         $RestoreValues,
         $APIName = 'New User',
         $Headers
     )
 
     try {
-        $userobj = $userobj | ConvertTo-Json -Depth 10 | ConvertFrom-Json -Depth 10
+        $UserObj = $UserObj | ConvertTo-Json -Depth 10 | ConvertFrom-Json -Depth 10
         Write-Host $UserObj.PrimDomain.value
         $Aliases = ($UserObj.AddedAliases) -split '\s'
         $password = if ($UserObj.password) { $UserObj.password } else { New-passwordString }
-        $UserprincipalName = "$($userobj.username)@$($UserObj.Domain ? $UserObj.Domain : $UserObj.PrimDomain.value)"
-        Write-Host "Creating user $UserprincipalName"
+        $UserPrincipalName = "$($UserObj.username)@$($UserObj.Domain ? $UserObj.Domain : $UserObj.PrimDomain.value)"
+        Write-Host "Creating user $UserPrincipalName"
         Write-Host "tenant filter is $($UserObj.tenantFilter)"
         $BodyToship = [pscustomobject] @{
-            'givenName'         = $UserObj.givenname
+            'givenName'         = $UserObj.givenName
             'surname'           = $UserObj.surname
             'accountEnabled'    = $true
             'displayName'       = $UserObj.displayName
             'department'        = $UserObj.Department
-            'mailNickname'      = $UserObj.Username ? $userobj.username : $userobj.mailNickname
-            'userPrincipalName' = $UserprincipalName
+            'mailNickname'      = $UserObj.Username ? $UserObj.username : $UserObj.mailNickname
+            'userPrincipalName' = $UserPrincipalName
             'usageLocation'     = $UserObj.usageLocation.value ? $UserObj.usageLocation.value : $UserObj.usageLocation
             'city'              = $UserObj.City
             'country'           = $UserObj.Country
@@ -37,7 +37,7 @@ function New-CIPPUser {
                 'password'                      = $password
             }
         }
-        if ($userobj.businessPhones) { $bodytoShip | Add-Member -NotePropertyName businessPhones -NotePropertyValue @($UserObj.businessPhones) }
+        if ($UserObj.businessPhones) { $bodytoShip | Add-Member -NotePropertyName businessPhones -NotePropertyValue @($UserObj.businessPhones) }
         if ($UserObj.defaultAttributes) {
             $UserObj.defaultAttributes | Get-Member -MemberType NoteProperty | ForEach-Object {
                 Write-Host "Editing user and adding $($_.Name) with value $($UserObj.defaultAttributes.$($_.Name).value)"
@@ -50,7 +50,7 @@ function New-CIPPUser {
         $bodyToShip = ConvertTo-Json -Depth 10 -InputObject $BodyToship -Compress
         Write-Host "Shipping: $bodyToShip"
         $GraphRequest = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/users' -tenantId $UserObj.tenantFilter -type POST -body $BodyToship -verbose
-        Write-LogMessage -headers $Headers -API $APINAME -tenant $($UserObj.tenantFilter) -message "Created user $($UserObj.displayname) with id $($GraphRequest.id) " -Sev 'Info'
+        Write-LogMessage -headers $Headers -API $APIName -tenant $($UserObj.tenantFilter) -message "Created user $($UserObj.displayName) with id $($GraphRequest.id)" -Sev 'Info'
 
         try {
             $PasswordLink = New-PwPushLink -Payload $password
@@ -62,13 +62,15 @@ function New-CIPPUser {
         }
         $Results = @{
             Results  = ('Created New User.')
-            Username = $UserprincipalName
+            Username = $UserPrincipalName
             Password = $password
         }
     } catch {
-        Write-LogMessage -headers $Headers -API $APINAME -tenant $($UserObj.tenantFilter) -message "Failed to create user. Error:$($_.Exception.Message)" -Sev 'Error'
-        $results = @{ Results = ("Failed to create user. $($_.Exception.Message)" ) }
-        throw "Failed to create user  $($_.Exception.Message)"
+        $ErrorMessage = Get-CippException -Exception $_
+        $Result = "Failed to create user. Error:$($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -tenant $($UserObj.tenantFilter) -message "Failed to create user. Error:$($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        $Results = @{ Results = $Result }
+        throw $Result
     }
     return $Results
 }
Original file line number	Diff line number	Diff line change
`@@ -14,8 +14,6 @@ function Invoke-AddScheduledItem {`
`14`	`14`	`} else {`
`15`	`15`	`$hidden = $true`
`16`	`16`	`}`
`17`		`- $Result = Add-CIPPScheduledTask -Task $Request.body -Headers $Request.Headers -hidden $hidden -DisallowDuplicateName $Request.query.DisallowDuplicateName`
`18`		`- Write-LogMessage -headers $Request.Headers -API $APINAME -message $Result -Sev 'Info'`
`19`	`17`
`20`	`18`	`if ($Request.Body.RunNow -eq $true) {`
`21`	`19`	`try {`