Merge pull request #1077 from KelvinTegelaar/dev

pull[bot] · web-flow · commit 67df3baf3104 · 2026-07-08T18:41:09.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/Modules/CIPPCore/Public/Authentication/Get-CIPPRolePermissions.ps1 b/Modules/CIPPCore/Public/Authentication/Get-CIPPRolePermissions.ps1
@@ -17,13 +17,25 @@ function Get-CIPPRolePermissions {
     $Filter = "RowKey eq '$RoleName'"
     $Role = Get-CIPPAzDataTableEntity @Table -Filter $Filter
     if ($Role) {
-        $Permissions = $Role.Permissions | ConvertFrom-Json
+        $Permissions = ($Role.Permissions | ConvertFrom-Json).PSObject.Properties.Value
+        # Stored permissions can reference endpoints removed or renamed in later CIPP
+        # versions; drop those so stale entries don't inflate the role's permission set
+        # (e.g. failing the Test-CippApiClientRoleGrant subset check). Skip filtering if
+        # the valid-permission universe can't be resolved, rather than emptying the role.
+        try {
+            $ValidPermissions = Get-CippHttpPermissions
+            if (@($ValidPermissions).Count -gt 0) {
+                $Permissions = @($Permissions | Where-Object { $ValidPermissions -contains $_ })
+            }
+        } catch {
+            Write-Warning "Unable to resolve valid permissions to filter role '$RoleName': $($_.Exception.Message)"
+        }
         $AllowedTenants = if ($Role.AllowedTenants) { $Role.AllowedTenants | ConvertFrom-Json } else { @() }
         $BlockedTenants = if ($Role.BlockedTenants) { $Role.BlockedTenants | ConvertFrom-Json } else { @() }
         $BlockedEndpoints = if ($Role.BlockedEndpoints) { $Role.BlockedEndpoints | ConvertFrom-Json } else { @() }
         [PSCustomObject]@{
             Role             = $Role.RowKey
-            Permissions      = $Permissions.PSObject.Properties.Value
+            Permissions      = @($Permissions)
             AllowedTenants   = @($AllowedTenants)
             BlockedTenants   = @($BlockedTenants)
             BlockedEndpoints = @($BlockedEndpoints)
diff --git a/Modules/CIPPCore/Public/Authentication/Get-CippAllowedPermissions.ps1 b/Modules/CIPPCore/Public/Authentication/Get-CippAllowedPermissions.ps1
@@ -22,30 +22,10 @@ function Get-CippAllowedPermissions {
     )
 
     # Get all available permissions and base roles configuration
-
-    $Version = if ($env:CIPPNG -eq 'true') {
-        $env:APP_VERSION
-    } else {
-        (Get-Content -Path (Join-Path $env:CIPPRootPath 'version_latest.txt')).Trim()
-    }
     $BaseRoles = Get-Content -Path (Join-Path $env:CIPPRootPath 'Config\cipp-roles.json') | ConvertFrom-Json
     $DefaultRoles = @('superadmin', 'admin', 'editor', 'readonly', 'anonymous', 'authenticated')
 
-    $AllPermissionCacheTable = Get-CIPPTable -tablename 'cachehttppermissions'
-    $AllPermissionsRow = Get-CIPPAzDataTableEntity @AllPermissionCacheTable -Filter "PartitionKey eq 'HttpFunctions' and RowKey eq 'HttpFunctions' and Version eq '$($Version)'"
-
-    if (-not $AllPermissionsRow.Permissions) {
-        $AllPermissions = Get-CIPPHttpFunctions -ByRole | Select-Object -ExpandProperty Permission
-        $Entity = @{
-            PartitionKey = 'HttpFunctions'
-            RowKey       = 'HttpFunctions'
-            Version      = [string]$Version
-            Permissions  = [string]($AllPermissions | ConvertTo-Json -Compress)
-        }
-        Add-CIPPAzDataTableEntity @AllPermissionCacheTable -Entity $Entity -Force
-    } else {
-        $AllPermissions = $AllPermissionsRow.Permissions | ConvertFrom-Json
-    }
+    $AllPermissions = Get-CippHttpPermissions
 
     $AllowedPermissions = [System.Collections.Generic.List[string]]::new()
 
diff --git a/Modules/CIPPCore/Public/Authentication/Get-CippHttpPermissions.ps1 b/Modules/CIPPCore/Public/Authentication/Get-CippHttpPermissions.ps1
@@ -0,0 +1,50 @@
+function Get-CippHttpPermissions {
+    <#
+    .SYNOPSIS
+        Returns the set of API permissions that exist on the current HTTP functions.
+
+    .DESCRIPTION
+        Resolves the full permission universe for the running CIPP version from the
+        cachehttppermissions table, computing and caching it via Get-CIPPHttpFunctions
+        on a cache miss. Results are memoized in-process per version so hot paths
+        (Test-CIPPAccess, Get-CippAllowedPermissions) avoid repeated table reads.
+
+    .OUTPUTS
+        [string[]] of valid permission names, e.g. 'Exchange.Mailbox.ReadWrite'.
+
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    $Version = if ($env:CIPPNG -eq 'true') {
+        $env:APP_VERSION
+    } else {
+        (Get-Content -Path (Join-Path $env:CIPPRootPath 'version_latest.txt')).Trim()
+    }
+
+    if ($script:CippHttpPermissions -and $script:CippHttpPermissionsVersion -eq $Version) {
+        return $script:CippHttpPermissions
+    }
+
+    $AllPermissionCacheTable = Get-CIPPTable -tablename 'cachehttppermissions'
+    $AllPermissionsRow = Get-CIPPAzDataTableEntity @AllPermissionCacheTable -Filter "PartitionKey eq 'HttpFunctions' and RowKey eq 'HttpFunctions' and Version eq '$($Version)'"
+
+    if (-not $AllPermissionsRow.Permissions) {
+        $AllPermissions = Get-CIPPHttpFunctions -ByRole | Select-Object -ExpandProperty Permission
+        $Entity = @{
+            PartitionKey = 'HttpFunctions'
+            RowKey       = 'HttpFunctions'
+            Version      = [string]$Version
+            Permissions  = [string]($AllPermissions | ConvertTo-Json -Compress)
+        }
+        Add-CIPPAzDataTableEntity @AllPermissionCacheTable -Entity $Entity -Force
+    } else {
+        $AllPermissions = $AllPermissionsRow.Permissions | ConvertFrom-Json
+    }
+
+    $script:CippHttpPermissions = @($AllPermissions)
+    $script:CippHttpPermissionsVersion = $Version
+    return $script:CippHttpPermissions
+}
diff --git a/Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1 b/Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1
@@ -450,7 +450,7 @@ function Compare-CIPPIntuneObject {
                                 }
                                 $values.Add($displayValue)
                             }
-                            $childValue = $values -join ', '
+                            $childValue = ($values | Sort-Object) -join ', '
 
                             $results.Add([PSCustomObject]@{
                                     Key    = "GroupChild-$($child.settingDefinitionId)"
@@ -466,7 +466,7 @@ function Compare-CIPPIntuneObject {
                             foreach ($simpleValue in $child.simpleSettingCollectionValue) {
                                 $values.Add($simpleValue.value)
                             }
-                            $childValue = $values -join ', '
+                            $childValue = ($values | Sort-Object) -join ', '
 
                             $results.Add([PSCustomObject]@{
                                     Key    = "GroupChild-$($child.settingDefinitionId)"
@@ -767,7 +767,9 @@ function Compare-CIPPIntuneObject {
                 $key
             }
 
-            if ($refRawValue -ne $diffRawValue -or $null -eq $refRawValue -or $null -eq $diffRawValue) {
+            # Flag when values differ or the setting exists on only one side; a setting present on both sides with equal (even null) values is compliant
+            $presenceMismatch = ($null -eq $refItem) -xor ($null -eq $diffItem)
+            if ($refRawValue -ne $diffRawValue -or $presenceMismatch) {
                 $result.Add([PSCustomObject]@{
                         Property      = $label
                         ExpectedValue = $refValue
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
@@ -312,8 +312,7 @@ function Invoke-CIPPStandardAntiPhishPolicy {
     }
 
     if ($Settings.report -eq $true) {
-        $FieldValue = $StateIsCorrect ? $true : $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.AntiPhishPolicy' -FieldValue $FieldValue -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AntiPhishPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'AntiPhishPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1
@@ -54,6 +54,22 @@ function Invoke-CIPPStandardBranding {
     $Localizations = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/organization/$($TenantId.customerId)/branding/localizations" -tenantID $Tenant -AsApp $true
     # Get layoutTemplateType value using null-coalescing operator
     $layoutTemplateType = $Settings.layoutTemplateType.value ?? $Settings.layoutTemplateType
+
+    $SetSignInPageText = -not [string]::IsNullOrEmpty($Settings.signInPageText)
+    $SetUsernameHintText = -not [string]::IsNullOrEmpty($Settings.usernameHintText)
+
+    $BrandingBody = [ordered]@{
+        loginPageTextVisibilitySettings = [pscustomobject]@{
+            hideAccountResetCredentials = $Settings.hideAccountResetCredentials
+        }
+        loginPageLayoutConfiguration    = [pscustomobject]@{
+            layoutTemplateType = $layoutTemplateType
+            isHeaderShown      = $Settings.isHeaderShown
+            isFooterShown      = $Settings.isFooterShown
+        }
+    }
+    if ($SetSignInPageText) { $BrandingBody['signInPageText'] = $Settings.signInPageText }
+    if ($SetUsernameHintText) { $BrandingBody['usernameHintText'] = $Settings.usernameHintText }
     # If default localization (id "0") exists, use that to get the currentState. Otherwise we have to create it first.
     if ($Localizations | Where-Object { $_.id -eq '0' }) {
         try {
@@ -71,18 +87,7 @@ function Invoke-CIPPStandardBranding {
                 AsApp       = $true
                 Type        = 'POST'
                 ContentType = 'application/json; charset=utf-8'
-                Body        = [pscustomobject]@{
-                    signInPageText                  = $Settings.signInPageText
-                    usernameHintText                = $Settings.usernameHintText
-                    loginPageTextVisibilitySettings = [pscustomobject]@{
-                        hideAccountResetCredentials = $Settings.hideAccountResetCredentials
-                    }
-                    loginPageLayoutConfiguration    = [pscustomobject]@{
-                        layoutTemplateType = $layoutTemplateType
-                        isHeaderShown      = $Settings.isHeaderShown
-                        isFooterShown      = $Settings.isFooterShown
-                    }
-                } | ConvertTo-Json -Compress
+                Body        = [pscustomobject]$BrandingBody | ConvertTo-Json -Compress
             }
             $CurrentState = New-GraphPostRequest @GraphRequest
         } catch {
@@ -92,22 +97,18 @@ function Invoke-CIPPStandardBranding {
         }
     }
 
-    $StateIsCorrect = ($CurrentState.signInPageText -eq $Settings.signInPageText) -and
-    ($CurrentState.usernameHintText -eq $Settings.usernameHintText) -and
-    ($CurrentState.loginPageTextVisibilitySettings.hideAccountResetCredentials -eq $Settings.hideAccountResetCredentials) -and
+    $StateIsCorrect = ($CurrentState.loginPageTextVisibilitySettings.hideAccountResetCredentials -eq $Settings.hideAccountResetCredentials) -and
     ($CurrentState.loginPageLayoutConfiguration.layoutTemplateType -eq $layoutTemplateType) -and
     ($CurrentState.loginPageLayoutConfiguration.isHeaderShown -eq $Settings.isHeaderShown) -and
-    ($CurrentState.loginPageLayoutConfiguration.isFooterShown -eq $Settings.isFooterShown)
+    ($CurrentState.loginPageLayoutConfiguration.isFooterShown -eq $Settings.isFooterShown) -and
+    (-not $SetSignInPageText -or ($CurrentState.signInPageText -eq $Settings.signInPageText)) -and
+    (-not $SetUsernameHintText -or ($CurrentState.usernameHintText -eq $Settings.usernameHintText))
 
-    $CurrentValue = [PSCustomObject]@{
-        signInPageText                  = $CurrentState.signInPageText
-        usernameHintText                = $CurrentState.usernameHintText
+    $CurrentValue = [ordered]@{
         loginPageTextVisibilitySettings = $CurrentState.loginPageTextVisibilitySettings | Select-Object -Property hideAccountResetCredentials
         loginPageLayoutConfiguration    = $CurrentState.loginPageLayoutConfiguration | Select-Object -Property layoutTemplateType, isHeaderShown, isFooterShown
     }
-    $ExpectedValue = [PSCustomObject]@{
-        signInPageText                  = $Settings.signInPageText
-        usernameHintText                = $Settings.usernameHintText
+    $ExpectedValue = [ordered]@{
         loginPageTextVisibilitySettings = [pscustomobject]@{
             hideAccountResetCredentials = $Settings.hideAccountResetCredentials
         }
@@ -117,6 +118,16 @@ function Invoke-CIPPStandardBranding {
             isFooterShown      = $Settings.isFooterShown
         }
     }
+    if ($SetSignInPageText) {
+        $CurrentValue['signInPageText'] = $CurrentState.signInPageText
+        $ExpectedValue['signInPageText'] = $Settings.signInPageText
+    }
+    if ($SetUsernameHintText) {
+        $CurrentValue['usernameHintText'] = $CurrentState.usernameHintText
+        $ExpectedValue['usernameHintText'] = $Settings.usernameHintText
+    }
+    $CurrentValue = [pscustomobject]$CurrentValue
+    $ExpectedValue = [pscustomobject]$ExpectedValue
 
     if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
@@ -129,18 +140,7 @@ function Invoke-CIPPStandardBranding {
                     AsApp       = $true
                     Type        = 'PATCH'
                     ContentType = 'application/json; charset=utf-8'
-                    Body        = [pscustomobject]@{
-                        signInPageText                  = $Settings.signInPageText
-                        usernameHintText                = $Settings.usernameHintText
-                        loginPageTextVisibilitySettings = [pscustomobject]@{
-                            hideAccountResetCredentials = $Settings.hideAccountResetCredentials
-                        }
-                        loginPageLayoutConfiguration    = [pscustomobject]@{
-                            layoutTemplateType = $layoutTemplateType
-                            isHeaderShown      = $Settings.isHeaderShown
-                            isFooterShown      = $Settings.isFooterShown
-                        }
-                    } | ConvertTo-Json -Compress
+                    Body        = [pscustomobject]$BrandingBody | ConvertTo-Json -Compress
                 }
                 $null = New-GraphPostRequest @GraphRequest
                 Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Successfully updated branding.' -Sev Info
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
@@ -121,6 +121,11 @@ function Invoke-CIPPStandardIntuneTemplate {
             $JSONTemplate = $RawJSON | ConvertFrom-Json
             $Compare = Compare-CIPPIntuneObject -ReferenceObject $JSONTemplate -DifferenceObject $JSONExistingPolicy -compareType $TemplateType -ErrorAction SilentlyContinue
         } catch {
+            Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to compare Intune Template $displayname against the existing policy: $($_.Exception.Message)" -sev 'Error'
+            $Compare = [pscustomobject]@{
+                MatchFailed = $true
+                Difference  = "Comparison failed: $($_.Exception.Message)"
+            }
         }
         Write-Information "[IntuneTemplate][$Tenant] Compare '$displayname': $([int]($sw.Elapsed - $lap).TotalMilliseconds)ms"
         $lap = $sw.Elapsed

Original file line number	Diff line number	Diff line change
`@@ -450,7 +450,7 @@ function Compare-CIPPIntuneObject {`
`450`	`450`	`}`
`451`	`451`	`$values.Add($displayValue)`
`452`	`452`	`}`
`453`		`- $childValue = $values -join ', '`
	`453`	`+ $childValue = ($values \| Sort-Object) -join ', '`
`454`	`454`
`455`	`455`	`$results.Add([PSCustomObject]@{`
`456`	`456`	`Key = "GroupChild-$($child.settingDefinitionId)"`
`@@ -466,7 +466,7 @@ function Compare-CIPPIntuneObject {`
`466`	`466`	`foreach ($simpleValue in $child.simpleSettingCollectionValue) {`
`467`	`467`	`$values.Add($simpleValue.value)`
`468`	`468`	`}`
`469`		`- $childValue = $values -join ', '`
	`469`	`+ $childValue = ($values \| Sort-Object) -join ', '`
`470`	`470`
`471`	`471`	`$results.Add([PSCustomObject]@{`
`472`	`472`	`Key = "GroupChild-$($child.settingDefinitionId)"`
`@@ -767,7 +767,9 @@ function Compare-CIPPIntuneObject {`
`767`	`767`	`$key`
`768`	`768`	`}`
`769`	`769`
`770`		`- if ($refRawValue -ne $diffRawValue -or $null -eq $refRawValue -or $null -eq $diffRawValue) {`
	`770`	`+ # Flag when values differ or the setting exists on only one side; a setting present on both sides with equal (even null) values is compliant`
	`771`	`+ $presenceMismatch = ($null -eq $refItem) -xor ($null -eq $diffItem)`
	`772`	`+ if ($refRawValue -ne $diffRawValue -or $presenceMismatch) {`
`771`	`773`	`$result.Add([PSCustomObject]@{`
`772`	`774`	`Property = $label`
`773`	`775`	`ExpectedValue = $refValue`
Original file line number	Diff line number	Diff line change
`@@ -312,8 +312,7 @@ function Invoke-CIPPStandardAntiPhishPolicy {`
`312`	`312`	`}`
`313`	`313`
`314`	`314`	`if ($Settings.report -eq $true) {`
`315`		`- $FieldValue = $StateIsCorrect ? $true : $CurrentState`
`316`		`- Set-CIPPStandardsCompareField -FieldName 'standards.AntiPhishPolicy' -FieldValue $FieldValue -TenantFilter $Tenant`
	`315`	`+ Set-CIPPStandardsCompareField -FieldName 'standards.AntiPhishPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant`
`317`	`316`	`Add-CIPPBPAField -FieldName 'AntiPhishPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant`
`318`	`317`	`}`
`319`	`318`