Skip to content

Commit f84f772

Browse files
JohnDupreyJohnDuprey
committed
update permissions for app manifests when updates are detected
1 parent 1a67b7e commit f84f772

File tree

3 files changed

+58
-18
lines changed

3 files changed

+58
-18
lines changed

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ExecAppApprovalTemplate.ps1

Lines changed: 37 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ function Push-ExecAppApprovalTemplate {
1010
$TemplateId = $Item.templateId
1111
if (!$TemplateId) {
1212
Write-LogMessage -message 'No template specified' -tenant $Item.Tenant -API 'Add Multitenant App' -sev Error
13-
return
13+
return $false
1414
}
1515

1616
# Get the template data to determine if it's a Gallery Template or Enterprise App
@@ -19,7 +19,7 @@ function Push-ExecAppApprovalTemplate {
1919

2020
if (!$Template) {
2121
Write-LogMessage -message "Template $TemplateId not found" -tenant $Item.Tenant -API 'Add Multitenant App' -sev Error
22-
return
22+
return $false
2323
}
2424

2525
$TemplateData = $Template.JSON | ConvertFrom-Json
@@ -37,14 +37,14 @@ function Push-ExecAppApprovalTemplate {
3737
$GalleryTemplateId = $TemplateData.GalleryTemplateId
3838
if (!$GalleryTemplateId) {
3939
Write-LogMessage -message 'Gallery Template ID not found in template data' -tenant $Item.Tenant -API 'Add Multitenant App' -sev Error
40-
return
40+
return $false
4141
}
4242

4343
# Check if the app already exists in the tenant
4444
$ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -tenantid $Item.Tenant
4545
if ($TemplateData.GalleryTemplateId -in $ServicePrincipalList.applicationTemplateId) {
4646
Write-LogMessage -message "Gallery Template app $($TemplateData.AppName) already exists in tenant $($Item.Tenant)" -tenant $Item.Tenant -API 'Add Gallery App' -sev Info
47-
return
47+
return $true
4848
}
4949

5050
# Instantiate the gallery template
@@ -74,14 +74,36 @@ function Push-ExecAppApprovalTemplate {
7474
$ApplicationManifest = $TemplateData.ApplicationManifest
7575
if (!$ApplicationManifest) {
7676
Write-LogMessage -message 'Application Manifest not found in template data' -tenant $Item.Tenant -API 'Add Multitenant App' -sev Error
77-
return
77+
return $false
7878
}
7979

8080
# Check for existing application by display name
81-
$ExistingApp = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/applications?`$filter=displayName eq '$($TemplateData.AppName)'&`$top=1" -tenantid $Item.Tenant -NoAuthCheck $true
82-
if ($ExistingApp -and $ExistingApp.value) {
83-
Write-LogMessage -message "Application Manifest $($TemplateData.AppName) already exists in tenant $($Item.Tenant)" -tenant $Item.Tenant -API 'Add App Manifest' -sev Info
84-
return
81+
$ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -tenantid $Item.Tenant
82+
$ExistingApp = $ServicePrincipalList | Where-Object { $_.displayName -eq $TemplateData.AppName }
83+
if ($ExistingApp) {
84+
Write-LogMessage -message "Application with name '$($TemplateData.AppName)' already exists in tenant $($Item.Tenant)" -tenant $Item.Tenant -API 'Add App Manifest' -sev Info
85+
86+
# get existing application
87+
$App = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/applications(appId='$($ExistingApp.appId)')" -tenantid $Item.Tenant
88+
89+
# compare permissions
90+
$ExistingPermissions = $App.requiredResourceAccess | ConvertTo-Json -Depth 10
91+
$NewPermissions = $ApplicationManifest.requiredResourceAccess | ConvertTo-Json -Depth 10
92+
if ($ExistingPermissions -ne $NewPermissions) {
93+
Write-LogMessage -message "Updating permissions for existing application '$($TemplateData.AppName)' in tenant $($Item.Tenant)" -tenant $Item.Tenant -API 'Add App Manifest' -sev Info
94+
95+
# Update permissions for existing application
96+
$UpdateBody = @{
97+
requiredResourceAccess = $ApplicationManifest.requiredResourceAccess
98+
} | ConvertTo-Json -Depth 10
99+
$null = New-GraphPostRequest -type PATCH -uri "https://graph.microsoft.com/beta/applications(appId='$($ExistingApp.appId)')" -tenantid $Item.Tenant -body $UpdateBody
100+
101+
# consent new permissions
102+
Add-CIPPDelegatedPermission -RequiredResourceAccess $ApplicationManifest.requiredResourceAccess -ApplicationId $ExistingApp.appId -Tenantfilter $Item.Tenant
103+
Add-CIPPApplicationPermission -RequiredResourceAccess $ApplicationManifest.requiredResourceAccess -ApplicationId $ExistingApp.appId -Tenantfilter $Item.Tenant
104+
}
105+
106+
return $true
85107
}
86108

87109
$PropertiesToRemove = @('appId', 'id', 'createdDateTime', 'publisherDomain', 'servicePrincipalLockConfiguration', 'identifierUris', 'applicationIdUris')
@@ -103,22 +125,20 @@ function Push-ExecAppApprovalTemplate {
103125
appId = $CreatedApp.appId
104126
} | ConvertTo-Json
105127

106-
$ServicePrincipal = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals' -type POST -tenantid $Item.tenant -body $ServicePrincipalBody
128+
$null = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals' -type POST -tenantid $Item.tenant -body $ServicePrincipalBody
107129

108130
Write-LogMessage -message "Successfully deployed Application Manifest $($TemplateData.AppName) to tenant $($Item.Tenant). Application ID: $($CreatedApp.appId)" -tenant $Item.Tenant -API 'Add App Manifest' -sev Info
109-
$DelegateResourceAccess = $ApplicationManifest.requiredResourceAccess
110-
$ApplicationResourceAccess = $ApplicationManifest.requiredResourceAccess
111-
if ($ApplicationManifest.requiredResourceAccess) {
112-
Add-CIPPDelegatedPermission -RequiredResourceAccess $ApplicationManifest.requiredResourceAccess -ApplicationId $App -Tenantfilter $Tenant
113-
Add-CIPPApplicationPermission -RequiredResourceAccess $ApplicationManifest.requiredResourceAccess -ApplicationId $App -Tenantfilter $Tenant
114-
}
115131

132+
if ($CreatedApp.requiredResourceAccess) {
133+
Add-CIPPDelegatedPermission -RequiredResourceAccess $CreatedApp.requiredResourceAccess -ApplicationId $CreatedApp.appId -Tenantfilter $Item.Tenant
134+
Add-CIPPApplicationPermission -RequiredResourceAccess $CreatedApp.requiredResourceAccess -ApplicationId $CreatedApp.appId -Tenantfilter $Item.Tenant
135+
}
116136
} else {
117137
Write-LogMessage -message "Application Manifest deployment failed - no application ID returned for $($TemplateData.AppName) in tenant $($Item.Tenant)" -tenant $Item.Tenant -API 'Add App Manifest' -sev Error
118138
}
119139
} catch {
120140
Write-LogMessage -message "Error creating application from manifest in tenant $($Item.Tenant) - $($_.Exception.Message)" -tenant $Item.Tenant -API 'Add App Manifest' -sev Error
121-
throw
141+
throw $_.Exception.Message
122142
}
123143

124144
} else {

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppApprovalTemplate.ps1

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,6 @@ function Invoke-ExecAppApprovalTemplate {
102102
if ($Request.Query.TemplateId) {
103103
$templateId = $Request.Query.TemplateId
104104
$filter = "PartitionKey eq 'AppApprovalTemplate' and RowKey eq '$templateId'"
105-
Write-LogMessage -headers $Headers -API $APIName -message "Retrieved specific template: $templateId" -Sev 'Info'
106105
}
107106

108107
$Templates = Get-CIPPAzDataTableEntity @Table -Filter $filter

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,27 @@ function Invoke-CIPPStandardAppDeploy {
186186
$ExistingApp = $AppExists | Where-Object { $_.displayName -eq $TemplateData.AppName }
187187
if ($ExistingApp) {
188188
Write-LogMessage -API 'Standards' -tenant $tenant -message "Application with name '$($TemplateData.AppName)' already exists in tenant $Tenant" -sev Info
189+
190+
# get existing application
191+
$App = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/applications(appId='$($ExistingApp.appId)')" -tenantid $Tenant
192+
193+
# compare permissions
194+
$ExistingPermissions = $App.requiredResourceAccess | ConvertTo-Json -Depth 10
195+
$NewPermissions = $ApplicationManifest.requiredResourceAccess | ConvertTo-Json -Depth 10
196+
if ($ExistingPermissions -ne $NewPermissions) {
197+
Write-LogMessage -API 'Standards' -tenant $tenant -message "Updating permissions for existing application '$($TemplateData.AppName)' in tenant $Tenant" -sev Info
198+
199+
# Update permissions for existing application
200+
$UpdateBody = @{
201+
requiredResourceAccess = $ApplicationManifest.requiredResourceAccess
202+
} | ConvertTo-Json -Depth 10
203+
$null = New-GraphPostRequest -type PATCH -uri "https://graph.microsoft.com/beta/applications(appId='$($ExistingApp.appId)')" -tenantid $Tenant -body $UpdateBody
204+
205+
# consent new permissions
206+
Add-CIPPDelegatedPermission -RequiredResourceAccess $ApplicationManifest.requiredResourceAccess -ApplicationId $ExistingApp.appId -Tenantfilter $Tenant
207+
Add-CIPPApplicationPermission -RequiredResourceAccess $ApplicationManifest.requiredResourceAccess -ApplicationId $ExistingApp.appId -Tenantfilter $Tenant
208+
}
209+
189210
continue
190211
}
191212

0 commit comments

Comments
 (0)