feat: CA Vacation Mode - Travel CA Policy (country-scoped temporary access)#2050
feat: CA Vacation Mode - Travel CA Policy (country-scoped temporary access)#2050StoricU wants to merge 18 commits into
Conversation
…med Location retry logic
… active in other travel policies
0b6754d to
d798aec
Compare
| # Find and delete the travel CA policy by display name | ||
| $Policies = New-GraphGetRequest ` | ||
| -uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies?`$filter=displayName eq '$PolicyName'&`$select=id,displayName" ` | ||
| -tenantid $TenantFilter -asApp $true | ||
| if (-not $Policies) { | ||
| Write-LogMessage -headers $Headers -API 'Remove-CIPPTravelCAPolicy' ` | ||
| -message "Travel policy '$PolicyName' not found, may already be deleted" ` | ||
| -Sev 'Info' -tenant $TenantFilter | ||
| } else { | ||
| foreach ($Policy in $Policies) { | ||
| $null = New-GraphPOSTRequest ` | ||
| -uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies/$($Policy.id)" ` | ||
| -tenantid $TenantFilter -type DELETE -body '' -asApp $true | ||
| Write-LogMessage -headers $Headers -API 'Remove-CIPPTravelCAPolicy' ` | ||
| -message "Deleted travel CA policy: $($Policy.displayName)" ` | ||
| -Sev 'Info' -tenant $TenantFilter | ||
| } | ||
| } | ||
|
|
||
| # Wait for policy deletion to propagate before removing Named Location | ||
| Start-Sleep -Seconds 15 |
There was a problem hiding this comment.
start-sleep is not allowed, this will cause a massive delay in all processing and exponetionally increase costs in CIPP. a 15 second wait is already almost a $1 in wait times.
There was a problem hiding this comment.
Hi @KelvinTegelaar, I looked at the propagation handling in Push-ExecOnboardTenantQueue.ps1 and see the pattern of rescheduling via Add-CIPPScheduledTask with DesiredStartTime instead of using Start-Sleep.
For the Travel CA Policy, creating a Named Location and immediately referencing it in a CA policy causes error 1040 due to Graph propagation delay. Would the right approach be to split this into two scheduled tasks — one to create the Named Location, and a follow-up task (2-3 min later) to create the CA policy referencing it? Or is there a simpler pattern you'd recommend?
| # Find and delete the travel CA policy by display name | ||
| $Policies = New-GraphGetRequest ` | ||
| -uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies?`$filter=displayName eq '$PolicyName'&`$select=id,displayName" ` | ||
| -tenantid $TenantFilter -asApp $true | ||
| if (-not $Policies) { | ||
| Write-LogMessage -headers $Headers -API 'Remove-CIPPTravelCAPolicy' ` | ||
| -message "Travel policy '$PolicyName' not found, may already be deleted" ` | ||
| -Sev 'Info' -tenant $TenantFilter | ||
| } else { | ||
| foreach ($Policy in $Policies) { | ||
| $null = New-GraphPOSTRequest ` | ||
| -uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies/$($Policy.id)" ` | ||
| -tenantid $TenantFilter -type DELETE -body '' -asApp $true | ||
| Write-LogMessage -headers $Headers -API 'Remove-CIPPTravelCAPolicy' ` | ||
| -message "Deleted travel CA policy: $($Policy.displayName)" ` | ||
| -Sev 'Info' -tenant $TenantFilter | ||
| } | ||
| } | ||
|
|
||
| # Wait for policy deletion to propagate before removing Named Location | ||
| Start-Sleep -Seconds 15 |
There was a problem hiding this comment.
uses backtics, bad practice
…k 5min after EndDate
…ation propagation
9225311 to
eb47a37
Compare
|
Updated based on review feedback:
|
Closes #5993