Merge pull request #869 from KelvinTegelaar/dev

pull[bot] · web-flow · commit 137ba042a2bc · 2026-03-26T18:41:09.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1
@@ -112,7 +112,7 @@ function Invoke-ExecTenantGroup {
                     $Adds.Add('Added member {0}' -f $member.label)
                 }
 
-                if ($CurrentMembers) {
+                if ($CurrentMembers -and $members) {
                     foreach ($CurrentMember in $CurrentMembers) {
                         if ($members.value -notcontains $CurrentMember.customerId) {
                             Remove-AzDataTableEntity @MembersTable -Entity $CurrentMember -Force
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUser.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUser.ps1
@@ -58,20 +58,24 @@ function Invoke-AddUser {
     } else {
         try {
             $CreationResults = New-CIPPUserTask -UserObj $UserObj -APIName $APIName -Headers $Headers
+            $ResultsList = [System.Collections.Generic.List[object]]::new()
+            $ResultsList.Add($CreationResults.Results[0])
+            $ResultsList.Add(@{
+                    'resultText' = $CreationResults.Results[1]
+                    'copyField'  = $CreationResults.Username
+                    'state'      = 'success'
+                })
+            $ResultsList.Add(@{
+                    'resultText' = $CreationResults.Results[2]
+                    'copyField'  = $CreationResults.password
+                    'state'      = 'success'
+                })
+            # Append any additional results (licenses, groups, aliases, manager, etc.)
+            foreach ($AdditionalResult in $CreationResults.Results | Select-Object -Skip 3) {
+                $ResultsList.Add($AdditionalResult)
+            }
             $body = [pscustomobject] @{
-                'Results'  = @(
-                    $CreationResults.Results[0],
-                    @{
-                        'resultText' = $CreationResults.Results[1]
-                        'copyField'  = $CreationResults.Username
-                        'state'      = 'success'
-                    },
-                    @{
-                        'resultText' = $CreationResults.Results[2]
-                        'copyField'  = $CreationResults.password
-                        'state'      = 'success'
-                    }
-                )
+                'Results'  = $ResultsList
                 'CopyFrom' = @{
                     'Success' = $CreationResults.CopyFrom.Success
                     'Error'   = $CreationResults.CopyFrom.Error
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-EditTenant.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-EditTenant.ps1
@@ -45,8 +45,13 @@ function Invoke-EditTenant {
         }
 
         # Update tenant groups
+        $GroupTable = Get-CippTable -TableName 'TenantGroups'
+        $StaticGroups = Get-CIPPAzDataTableEntity @GroupTable -Filter "PartitionKey eq 'TenantGroup' and GroupType ne 'dynamic'"
+        $StaticGroupIds = $StaticGroups.RowKey
         $CurrentGroupMemberships = Get-CIPPAzDataTableEntity @GroupMembersTable -Filter "customerId eq '$customerId'"
         foreach ($Group in $tenantGroups) {
+            # Only allow adding to static groups; dynamic group membership is managed by the orchestrator
+            if ($StaticGroupIds -notcontains $Group.groupId) { continue }
             $GroupEntity = $CurrentGroupMemberships | Where-Object { $_.GroupId -eq $Group.groupId }
             if (!$GroupEntity) {
                 $GroupEntity = @{
@@ -56,33 +61,41 @@ function Invoke-EditTenant {
                     customerId   = $customerId
                 }
                 Add-CIPPAzDataTableEntity @GroupMembersTable -Entity $GroupEntity -Force
+                Write-LogMessage -headers $Headers -API $APINAME -tenant $Tenant.defaultDomainName -TenantId $Tenant.customerId -message "Added tenant to group '$($Group.groupName)'" -Sev 'Info'
             }
         }
 
-        # Remove any groups that are no longer selected
-        foreach ($Group in $CurrentGroupMemberships) {
-            if ($tenantGroups.GroupId -notcontains $Group.GroupId) {
-                Remove-AzDataTableEntity @GroupMembersTable -Entity $Group
+        # Remove any static groups that are no longer selected (dynamic groups are managed by the orchestrator)
+        if ($tenantGroups) {
+            foreach ($Group in $CurrentGroupMemberships) {
+                if ($StaticGroupIds -contains $Group.GroupId -and $tenantGroups.GroupId -notcontains $Group.GroupId) {
+                    $GroupName = ($StaticGroups | Where-Object { $_.RowKey -eq $Group.GroupId }).Name
+                    Remove-AzDataTableEntity @GroupMembersTable -Entity $Group
+                    Write-LogMessage -headers $Headers -API $APINAME -tenant $Tenant.defaultDomainName -TenantId $Tenant.customerId -message "Removed tenant from group '$GroupName'" -Sev 'Info'
+                }
             }
         }
         $DomainBasedEntries = Get-CIPPAzDataTableEntity @GroupMembersTable -Filter "customerId eq '$($Tenant.defaultDomainName)'"
-            if ($DomainBasedEntries) {
-                foreach ($Entry in $DomainBasedEntries) {
-                    try {
-                        # Add corrected GUID-based entry using the actual GUID
-                        $NewEntry = @{
-                            PartitionKey = 'Member'
-                            RowKey       = '{0}-{1}' -f $Entry.GroupId, $Tenant.customerId
-                            GroupId      = $Entry.GroupId
-                            customerId   = $Tenant.customerId
-                        }
-                        Add-CIPPAzDataTableEntity @GroupMembersTable -Entity $NewEntry -Force
-                        Remove-AzDataTableEntity @GroupMembersTable -Entity $Entry
-                    } catch {
-                        Write-Host "Error migrating entry: $($_.Exception.Message)"
+        if ($DomainBasedEntries) {
+            foreach ($Entry in $DomainBasedEntries) {
+                try {
+                    # Add corrected GUID-based entry using the actual GUID
+                    $NewEntry = @{
+                        PartitionKey = 'Member'
+                        RowKey       = '{0}-{1}' -f $Entry.GroupId, $Tenant.customerId
+                        GroupId      = $Entry.GroupId
+                        customerId   = $Tenant.customerId
                     }
+                    Add-CIPPAzDataTableEntity @GroupMembersTable -Entity $NewEntry -Force
+                    Remove-AzDataTableEntity @GroupMembersTable -Entity $Entry
+                } catch {
+                    Write-Host "Error migrating entry: $($_.Exception.Message)"
                 }
             }
+        }
+
+        # Bust the TenantGroups cache so subsequent calls reflect the changes made above
+        Get-TenantGroups -SkipCache | Out-Null
 
         $response = @{
             state      = 'success'
@@ -93,7 +106,7 @@ function Invoke-EditTenant {
                 Body       = $response
             })
     } catch {
-        Write-LogMessage -headers $Headers -tenant $customerId -API $APINAME -message "Edit Tenant failed. The error is: $($_.Exception.Message)" -Sev 'Error'
+        Write-LogMessage -headers $Headers -tenant $Tenant.defaultDomainName -TenantId $Tenant.customerId -API $APINAME -message "Edit Tenant failed. The error is: $($_.Exception.Message)" -Sev 'Error'
         $response = @{
             state      = 'error'
             resultText = $_.Exception.Message
diff --git a/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPOrchestrator.ps1 b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPOrchestrator.ps1
@@ -68,7 +68,7 @@ function Start-CIPPOrchestrator {
                 Parameters   = @{
                     BatchId = $BatchGuid
                 }
-            }
+            } -Force
         }
         try {
             $InstanceId = Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Depth 10 -Compress)
@@ -131,7 +131,7 @@ function Start-CIPPOrchestrator {
                 $InputObject.PSObject.Properties.Remove('Batch')
 
                 # Add queue function reference to retrieve batch items in orchestrator
-                $InputObject.QueueFunction = @{
+                $InputObject | Add-Member -MemberType NoteProperty -Force -Name QueueFunction -Value @{
                     FunctionName = 'OrchestratorBatchItems'
                     Parameters   = @{
                         BatchId = $Guid
diff --git a/Modules/CIPPCore/Public/New-CIPPUserTask.ps1 b/Modules/CIPPCore/Public/New-CIPPUserTask.ps1
@@ -20,22 +20,6 @@ function New-CIPPUserTask {
 
     try {
         if ($UserObj.licenses.value) {
-            # Filter out licenses with no available units
-            try {
-                $LicenseOverview = Get-CIPPLicenseOverview -TenantFilter $UserObj.tenantFilter
-                $FilteredLicenses = @(foreach ($LicenseId in $UserObj.licenses.value) {
-                    $Sku = $LicenseOverview | Where-Object { $_.skuId -eq $LicenseId }
-                    if ($Sku -and [int]$Sku.availableUnits -le 0) {
-                        $null = $Results.Add("Skipped license $($Sku.License): no available units")
-                        Write-LogMessage -headers $Headers -API $APIName -tenant $UserObj.tenantFilter -message "Skipped license $($Sku.License) for $($CreationResults.Username): no available units" -Sev 'Warn'
-                    } else {
-                        $LicenseId
-                    }
-                })
-                $UserObj.licenses = [PSCustomObject]@{ value = $FilteredLicenses }
-            } catch {
-                Write-Warning "Failed to check available licenses: $($_.Exception.Message)"
-            }
             if ($UserObj.sherwebLicense.value) {
                 $null = Set-SherwebSubscription -Headers $Headers -TenantFilter $UserObj.tenantFilter -SKU $UserObj.sherwebLicense.value -Add 1
                 $null = $Results.Add('Added Sherweb License, scheduling assignment')
@@ -84,17 +68,14 @@ function New-CIPPUserTask {
         $CopyFrom.Error | ForEach-Object { $Results.Add($_) }
     }
 
-    if ($UserObj.groupMemberships -and ($UserObj.groupMemberships | Measure-Object).Count -gt 0) {
-        Write-Host "Adding user to $(@($UserObj.groupMemberships).Count) groups from template"
-        foreach ($Group in $UserObj.groupMemberships) {
+    # Add to groups
+    if ($UserObj.AddToGroups) {
+        $UserObj.AddToGroups | ForEach-Object {
             try {
-                $GroupType = if ($Group.groupTypes -contains 'Unified') { 'Microsoft 365' }
-                    elseif ($Group.mailEnabled) { 'Distribution list' }
-                    else { 'Security' }
-                Add-CIPPGroupMember -Headers $Headers -GroupType $GroupType -GroupId $Group.id -Member $CreationResults.Username -TenantFilter $UserObj.tenantFilter -APIName $APIName
-                $Results.Add("Added user to group from template: $($Group.displayName)")
+                $AddMemberResult = Add-CIPPGroupMember -Headers $Headers -GroupType $_.addedFields.groupType -GroupId $_.value -Member @($CreationResults.Username) -TenantFilter $UserObj.tenantFilter
+                $Results.Add($AddMemberResult)
             } catch {
-                $Results.Add("Failed to add to group $($Group.displayName): $($_.Exception.Message)")
+                $Results.Add("Failed to add to group $($_.label): $_")
             }
         }
     }
diff --git a/Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1 b/Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1
@@ -144,6 +144,7 @@ function Get-TenantGroups {
                             Id          = $Group.RowKey
                             Name        = $Group.Name
                             Description = $Group.Description
+                            GroupType   = $Group.GroupType ?? 'static'
                         })
                 }
             }
diff --git a/Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1 b/Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1
@@ -143,7 +143,7 @@ function Update-CIPPDynamicTenantGroups {
 
                 Write-Information "Found $($MatchingTenants.Count) matching tenants for group '$($Group.Name)'"
 
-                $CurrentMembers = Get-CIPPAzDataTableEntity @MembersTable -Filter "PartitionKey eq 'Member' and GroupId eq '$($Group.RowKey)'"
+                $CurrentMembers = @($AllGroupMembers | Where-Object { $_.GroupId -eq $Group.RowKey })
                 $CurrentMemberIds = $CurrentMembers.customerId
                 $NewMemberIds = $MatchingTenants.customerId
 
@@ -184,6 +184,9 @@ function Update-CIPPDynamicTenantGroups {
 
         Write-LogMessage -API 'TenantGroups' -message "Dynamic tenant group update completed. Groups processed: $GroupsProcessed, Members added: $TotalMembersAdded, Members removed: $TotalMembersRemoved" -sev Info
 
+        # Bust the TenantGroups cache so subsequent calls reflect the changes made above
+        Get-TenantGroups -SkipCache | Out-Null
+
         return @{
             MembersAdded    = $TotalMembersAdded
             MembersRemoved  = $TotalMembersRemoved

Original file line number	Diff line number	Diff line change
`@@ -112,7 +112,7 @@ function Invoke-ExecTenantGroup {`
`112`	`112`	`$Adds.Add('Added member {0}' -f $member.label)`
`113`	`113`	`}`
`114`	`114`
`115`		`- if ($CurrentMembers) {`
	`115`	`+ if ($CurrentMembers -and $members) {`
`116`	`116`	`foreach ($CurrentMember in $CurrentMembers) {`
`117`	`117`	`if ($members.value -notcontains $CurrentMember.customerId) {`
`118`	`118`	`Remove-AzDataTableEntity @MembersTable -Entity $CurrentMember -Force`
Original file line number	Diff line number	Diff line change
`@@ -144,6 +144,7 @@ function Get-TenantGroups {`
`144`	`144`	`Id = $Group.RowKey`
`145`	`145`	`Name = $Group.Name`
`146`	`146`	`Description = $Group.Description`
	`147`	`+ GroupType = $Group.GroupType ?? 'static'`
`147`	`148`	`})`
`148`	`149`	`}`
`149`	`150`	`}`