Skip to content

feat: CA Vacation Mode - Travel CA Policy (country-scoped temporary access)#2050

Closed
StoricU wants to merge 18 commits into
KelvinTegelaar:devfrom
MobitL:pr/travel-ca-policy
Closed

feat: CA Vacation Mode - Travel CA Policy (country-scoped temporary access)#2050
StoricU wants to merge 18 commits into
KelvinTegelaar:devfrom
MobitL:pr/travel-ca-policy

Conversation

@StoricU

@StoricU StoricU commented May 13, 2026

Copy link
Copy Markdown
Contributor

Closes #5993

@StoricU
StoricU force-pushed the pr/travel-ca-policy branch 2 times, most recently from 0b6754d to d798aec Compare May 13, 2026 19:44
Comment on lines +10 to +30
# Find and delete the travel CA policy by display name
$Policies = New-GraphGetRequest `
-uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies?`$filter=displayName eq '$PolicyName'&`$select=id,displayName" `
-tenantid $TenantFilter -asApp $true
if (-not $Policies) {
Write-LogMessage -headers $Headers -API 'Remove-CIPPTravelCAPolicy' `
-message "Travel policy '$PolicyName' not found, may already be deleted" `
-Sev 'Info' -tenant $TenantFilter
} else {
foreach ($Policy in $Policies) {
$null = New-GraphPOSTRequest `
-uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies/$($Policy.id)" `
-tenantid $TenantFilter -type DELETE -body '' -asApp $true
Write-LogMessage -headers $Headers -API 'Remove-CIPPTravelCAPolicy' `
-message "Deleted travel CA policy: $($Policy.displayName)" `
-Sev 'Info' -tenant $TenantFilter
}
}

# Wait for policy deletion to propagate before removing Named Location
Start-Sleep -Seconds 15

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

start-sleep is not allowed, this will cause a massive delay in all processing and exponetionally increase costs in CIPP. a 15 second wait is already almost a $1 in wait times.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @KelvinTegelaar, I looked at the propagation handling in Push-ExecOnboardTenantQueue.ps1 and see the pattern of rescheduling via Add-CIPPScheduledTask with DesiredStartTime instead of using Start-Sleep.
For the Travel CA Policy, creating a Named Location and immediately referencing it in a CA policy causes error 1040 due to Graph propagation delay. Would the right approach be to split this into two scheduled tasks — one to create the Named Location, and a follow-up task (2-3 min later) to create the CA policy referencing it? Or is there a simpler pattern you'd recommend?

Comment on lines +10 to +30
# Find and delete the travel CA policy by display name
$Policies = New-GraphGetRequest `
-uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies?`$filter=displayName eq '$PolicyName'&`$select=id,displayName" `
-tenantid $TenantFilter -asApp $true
if (-not $Policies) {
Write-LogMessage -headers $Headers -API 'Remove-CIPPTravelCAPolicy' `
-message "Travel policy '$PolicyName' not found, may already be deleted" `
-Sev 'Info' -tenant $TenantFilter
} else {
foreach ($Policy in $Policies) {
$null = New-GraphPOSTRequest `
-uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies/$($Policy.id)" `
-tenantid $TenantFilter -type DELETE -body '' -asApp $true
Write-LogMessage -headers $Headers -API 'Remove-CIPPTravelCAPolicy' `
-message "Deleted travel CA policy: $($Policy.displayName)" `
-Sev 'Info' -tenant $TenantFilter
}
}

# Wait for policy deletion to propagate before removing Named Location
Start-Sleep -Seconds 15

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uses backtics, bad practice

@StoricU
StoricU force-pushed the pr/travel-ca-policy branch from 9225311 to eb47a37 Compare May 24, 2026 12:07
@StoricU

StoricU commented May 24, 2026

Copy link
Copy Markdown
Contributor Author

Updated based on review feedback:

  • Removed all backtick line continuations — inline parameters used throughout, consistent with existing CIPP style
  • Replaced Start-Sleep with a scheduled retry task for Named Location propagation (error 1040). The retry passes CountryLocationId directly to skip re-creation on subsequent attempts
  • Added RetryAttempt counter with max 3 attempts to prevent infinite retry loops
  • Deletion now uses IDs directly instead of searching by display name — Remove-CIPPTravelCAPolicy accepts PolicyId, Remove-CIPPTravelNamedLocation accepts LocationId
  • Timezone-aware policy naming using CIPP's existing TimeSettings config with UTC fallback
  • Remove-CIPPTravelCAPolicy retains fallback to display name search if PolicyId is not available

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants