JohnDuprey
diff --git a/‎.github/workflows/dev-testing_cipprnpxo.yml
Lines changed: 0 additions & 30 deletions b/‎.github/workflows/dev-testing_cipprnpxo.yml
Lines changed: 0 additions & 30 deletions
diff --git a/‎Config/CyberEssentials.BPATemplate.json
Lines changed: 4 additions & 1 deletion b/‎Config/CyberEssentials.BPATemplate.json
Lines changed: 4 additions & 1 deletion
diff --git a/‎Config/schemaDefinitions.json
Lines changed: 16 additions & 0 deletions b/‎Config/schemaDefinitions.json
Lines changed: 16 additions & 0 deletions
diff --git a/‎ConversionTable.csv
Lines changed: 260 additions & 0 deletions b/‎ConversionTable.csv
Lines changed: 260 additions & 0 deletions
diff --git a/‎Modules/CIPPCore/Public/Add-CIPPAzDataTableEntity.ps1
Lines changed: 24 additions & 8 deletions b/‎Modules/CIPPCore/Public/Add-CIPPAzDataTableEntity.ps1
Lines changed: 24 additions & 8 deletions
diff --git a/‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertDefenderIncidents.ps1
Lines changed: 24 additions & 0 deletions b/‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertDefenderIncidents.ps1
Lines changed: 24 additions & 0 deletions
diff --git a/‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertMFAAdmins.ps1
Lines changed: 1 addition & 1 deletion b/‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertMFAAdmins.ps1
Lines changed: 1 addition & 1 deletion
diff --git a/‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertMFAAlertUsers.ps1
Lines changed: 1 addition & 1 deletion b/‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertMFAAlertUsers.ps1
Lines changed: 1 addition & 1 deletion
diff --git a/‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertNoCAConfig.ps1
Lines changed: 1 addition & 3 deletions b/‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertNoCAConfig.ps1
Lines changed: 1 addition & 3 deletions
diff --git a/‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertUnusedLicenses.ps1
Lines changed: 3 additions & 4 deletions b/‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertUnusedLicenses.ps1
Lines changed: 3 additions & 4 deletions
@@ -92,7 +92,10 @@
         "isMFARegistered",
         "defaultMFAMethod"
       ],
-      "URL": "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails"
+      "URL": "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails",
+      "Parameters": {
+        "asApp": "True"
+      }
     }
   ]
 }
@@ -0,0 +1,16 @@
+[
+    {
+        "id": "cippUser",
+        "description": "CIPP User Schema",
+        "targetTypes": ["User"],
+        "properties": [
+            { "name": "jitAdminEnabled", "type": "Boolean" },
+            { "name": "jitAdminExpiration", "type": "DateTime" },
+            { "name": "mailboxType", "type": "String" },
+            { "name": "archiveEnabled", "type": "Boolean" },
+            { "name": "autoExpandingArchiveEnabled", "type": "Boolean" },
+            { "name": "perUserMfaState", "type": "String" }
+        ],
+        "status": "Available"
+    }
+]
@@ -1,12 +1,28 @@
 function Add-CIPPAzDataTableEntity {
-    [CmdletBinding()]
+    [CmdletBinding(DefaultParameterSetName = 'OperationType')]
     param(
         $Context,
         $Entity,
+        [switch]$CreateTableIfNotExists,
+
+        [Parameter(ParameterSetName = 'Force')]
         [switch]$Force,
-        [switch]$CreateTableIfNotExists
+
+        [Parameter(ParameterSetName = 'OperationType')]
+        [ValidateSet('Add', 'UpsertMerge', 'UpsertReplace')]
+        [string]$OperationType = 'Add'
     )
 
+    $Parameters = @{
+        Context                = $Context
+        CreateTableIfNotExists = $CreateTableIfNotExists
+    }
+    if ($PSCmdlet.ParameterSetName -eq 'Force') {
+        $Parameters.Force = $Force
+    } else {
+        $Parameters.OperationType = $OperationType
+    }
+
     $MaxRowSize = 500000 - 100 # Maximum size of an entity
     $MaxSize = 30kb # Maximum size of a property value
 
@@ -15,7 +31,7 @@ function Add-CIPPAzDataTableEntity {
             if ($null -eq $SingleEnt.PartitionKey -or $null -eq $SingleEnt.RowKey) {
                 throw 'PartitionKey or RowKey is null'
             }
-            Add-AzDataTableEntity -Context $Context -Force:$Force -CreateTableIfNotExists:$CreateTableIfNotExists -Entity $SingleEnt -ErrorAction Stop
+            Add-AzDataTableEntity @Parameters -Entity $SingleEnt -ErrorAction Stop
         } catch [System.Exception] {
             if ($_.Exception.ErrorCode -eq 'PropertyValueTooLarge' -or $_.Exception.ErrorCode -eq 'EntityTooLarge' -or $_.Exception.ErrorCode -eq 'RequestBodyTooLarge') {
                 try {
@@ -137,17 +153,17 @@ function Add-CIPPAzDataTableEntity {
 
                         foreach ($row in $rows) {
                             Write-Information "current entity is $($row.RowKey) with $($row.PartitionKey). Our size is $([System.Text.Encoding]::UTF8.GetByteCount($($row | ConvertTo-Json -Compress)))"
-                            $NewRow = [PSCustomObject]$row
-                            Add-AzDataTableEntity -Context $Context -Force:$Force -CreateTableIfNotExists:$CreateTableIfNotExists -Entity $NewRow
+                            $NewRow = ([PSCustomObject]$row) | Select-Object * -ExcludeProperty Timestamp
+                            Add-AzDataTableEntity @Parameters -Entity $NewRow
                         }
                     } else {
-                        $NewEnt = [PSCustomObject]$SingleEnt
-                        Add-AzDataTableEntity -Context $Context -Force:$Force -CreateTableIfNotExists:$CreateTableIfNotExists -Entity $NewEnt
+                        $NewEnt = ([PSCustomObject]$SingleEnt) | Select-Object * -ExcludeProperty Timestamp
+                        Add-AzDataTableEntity @Parameters -Entity $NewEnt
                     }
 
                 } catch {
                     $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-                    Write-Warning ("AzBobbyTables Error")
+                    Write-Warning ('AzBobbyTables Error')
                     Write-Information ($SingleEnt | ConvertTo-Json)
                     throw "Error processing entity: $ErrorMessage Linenumber: $($_.InvocationInfo.ScriptLineNumber)"
                 }
 
@@ -0,0 +1,24 @@
+
+function Get-CIPPAlertDefenderIncidents {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $false)]
+        [Alias('input')]
+        $InputValue,
+        $TenantFilter
+    )
+    try {
+        $AlertData = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/security/incidents?`$top=50&`$filter=status eq 'active'" -tenantid $TenantFilter | ForEach-Object {
+            "Incident ID $($_.id): Created at $($_.createdDateTime). Severity: $($_.severity). `nIncident name: $($_.displayName). Incident URL: $($_.incidentWebUrl)."
+        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
+
+    } catch {
+        # Pretty sure this one is gonna be spammy cause of licensing issues, so it's commented out -Bobby
+        # Write-AlertMessage -tenant $($TenantFilter) -message "Could not get Defender incident data for $($TenantFilter): $(Get-NormalizedError -message $_.Exception.message)"
+    }
+}
@@ -18,7 +18,7 @@ function Get-CIPPAlertMFAAdmins {
             }
         }
         if (!$DuoActive) {
-            $users = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?`$top=999&filter=IsAdmin eq true and isMfaRegistered eq false and userType eq 'member'&`$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered,IsAdmin" -tenantid $($TenantFilter) | Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' }
+            $users = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?`$top=999&filter=IsAdmin eq true and isMfaRegistered eq false and userType eq 'member'&`$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered,IsAdmin" -tenantid $($TenantFilter) -AsApp $true | Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' }
             if ($users.UserPrincipalName) {
                 $AlertData = "The following admins do not have MFA registered: $($users.UserPrincipalName -join ', ')"
                 Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
@@ -12,7 +12,7 @@ function Get-CIPPAlertMFAAlertUsers {
     )
     try {
 
-        $users = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?`$top=999&filter=IsAdmin eq false and isMfaRegistered eq false and userType eq 'member'&`$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered,IsAdmin" -tenantid $($TenantFilter) | Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' }
+        $users = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?`$top=999&filter=IsAdmin eq false and isMfaRegistered eq false and userType eq 'member'&`$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered,IsAdmin" -tenantid $($TenantFilter) -AsApp $true | Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' }
         if ($users.UserPrincipalName) {
             $AlertData = "The following $($users.Count) users do not have MFA registered: $($users.UserPrincipalName -join ', ')"
             Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
@@ -12,16 +12,14 @@ function Get-CIPPAlertNoCAConfig {
     )
 
     try {
-        $CAAvailable = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/subscribedSkus' -tenantid $TenantFilter -erroraction stop).serviceplans
+        $CAAvailable = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/subscribedSkus' -tenantid $TenantFilter -ErrorAction Stop).serviceplans
         if ('AAD_PREMIUM' -in $CAAvailable.servicePlanName) {
             $CAPolicies = (New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies' -tenantid $TenantFilter)
             if (!$CAPolicies.id) {
                 $AlertData = 'Conditional Access is available, but no policies could be found.'
                 Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-
             }
         }
-
     } catch {
         Write-AlertMessage -tenant $($TenantFilter) -message "Conditional Access Config Alert: Error occurred: $(Get-NormalizedError -message $_.Exception.message)"
     }
 
@@ -11,15 +11,14 @@ function Get-CIPPAlertUnusedLicenses {
         $TenantFilter
     )
 
-
     try {
         $LicenseTable = Get-CIPPTable -TableName ExcludedLicenses
         $ExcludedSkuList = Get-CIPPAzDataTableEntity @LicenseTable
         $AlertData = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/subscribedSkus' -tenantid $TenantFilter | ForEach-Object {
-            $skuid = $_
-            foreach ($sku in $skuid) {
+            $skuId = $_
+            foreach ($sku in $skuId) {
                 if ($sku.skuId -in $ExcludedSkuList.GUID) { continue }
-                $PrettyName = ($ConvertTable | Where-Object { $_.GUID -eq $sku.skuid }).'Product_Display_Name' | Select-Object -Last 1
+                $PrettyName = ($ConvertTable | Where-Object { $_.GUID -eq $sku.skuId }).'Product_Display_Name' | Select-Object -Last 1
                 if (!$PrettyName) { $PrettyName = $sku.skuPartNumber }
                 if ($sku.prepaidUnits.enabled - $sku.consumedUnits -gt 0) {
                     "$PrettyName has unused licenses. Using $($_.consumedUnits) of $($_.prepaidUnits.enabled)."
Original file line number	Diff line number	Diff line change
`@@ -92,7 +92,10 @@`
`92`	`92`	`"isMFARegistered",`
`93`	`93`	`"defaultMFAMethod"`
`94`	`94`	`],`
`95`		`- "URL": "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails"`
	`95`	`+ "URL": "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails",`
	`96`	`+ "Parameters": {`
	`97`	`+ "asApp": "True"`
	`98`	`+ }`
`96`	`99`	`}`
`97`	`100`	`]`
`98`	`101`	`}`
Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@ function Get-CIPPAlertMFAAdmins {`
`18`	`18`	`}`
`19`	`19`	`}`
`20`	`20`	`if (!$DuoActive) {`
`21`		- $users = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?`$top=999&filter=IsAdmin eq true and isMfaRegistered eq false and userType eq 'member'&`$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered,IsAdmin" -tenantid $($TenantFilter) \| Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' }
	`21`	+ $users = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?`$top=999&filter=IsAdmin eq true and isMfaRegistered eq false and userType eq 'member'&`$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered,IsAdmin" -tenantid $($TenantFilter) -AsApp $true \| Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' }
`22`	`22`	`if ($users.UserPrincipalName) {`
`23`	`23`	`$AlertData = "The following admins do not have MFA registered: $($users.UserPrincipalName -join ', ')"`
`24`	`24`	`Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData`
Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ function Get-CIPPAlertMFAAlertUsers {`
`12`	`12`	`)`
`13`	`13`	`try {`
`14`	`14`
`15`		- $users = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?`$top=999&filter=IsAdmin eq false and isMfaRegistered eq false and userType eq 'member'&`$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered,IsAdmin" -tenantid $($TenantFilter) \| Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' }
	`15`	+ $users = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?`$top=999&filter=IsAdmin eq false and isMfaRegistered eq false and userType eq 'member'&`$select=userPrincipalName,lastUpdatedDateTime,isMfaRegistered,IsAdmin" -tenantid $($TenantFilter) -AsApp $true \| Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' }
`16`	`16`	`if ($users.UserPrincipalName) {`
`17`	`17`	`$AlertData = "The following $($users.Count) users do not have MFA registered: $($users.UserPrincipalName -join ', ')"`
`18`	`18`	`Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData`
Original file line number	Diff line number	Diff line change
`@@ -12,16 +12,14 @@ function Get-CIPPAlertNoCAConfig {`
`12`	`12`	`)`
`13`	`13`
`14`	`14`	`try {`
`15`		`- $CAAvailable = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/subscribedSkus' -tenantid $TenantFilter -erroraction stop).serviceplans`
	`15`	`+ $CAAvailable = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/subscribedSkus' -tenantid $TenantFilter -ErrorAction Stop).serviceplans`
`16`	`16`	`if ('AAD_PREMIUM' -in $CAAvailable.servicePlanName) {`
`17`	`17`	`$CAPolicies = (New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies' -tenantid $TenantFilter)`
`18`	`18`	`if (!$CAPolicies.id) {`
`19`	`19`	`$AlertData = 'Conditional Access is available, but no policies could be found.'`
`20`	`20`	`Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData`
`21`		`-`
`22`	`21`	`}`
`23`	`22`	`}`
`24`		`-`
`25`	`23`	`} catch {`
`26`	`24`	`Write-AlertMessage -tenant $($TenantFilter) -message "Conditional Access Config Alert: Error occurred: $(Get-NormalizedError -message $_.Exception.message)"`
`27`	`25`	`}`