Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev

KelvinTegelaar · KelvinTegelaar · commit 68edc5ce9930 · 2026-07-17T14:38:05.000+02:00
diff --git a/Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1
@@ -19,6 +19,18 @@ function Set-CIPPAssignedPolicy {
         $AssignmentDirection
     )
 
+    # App protection policy lists expose the singular @odata.type as the URLName, but Graph
+    # needs the plural collection segment. Normalize the known types here.
+    $Type = switch ($Type) {
+        'androidManagedAppProtection' { 'androidManagedAppProtections' }
+        'iosManagedAppProtection' { 'iosManagedAppProtections' }
+        'windowsManagedAppProtection' { 'windowsManagedAppProtections' }
+        'mdmWindowsInformationProtectionPolicy' { 'mdmWindowsInformationProtectionPolicies' }
+        'windowsInformationProtectionPolicy' { 'windowsInformationProtectionPolicies' }
+        'targetedManagedAppConfiguration' { 'targetedManagedAppConfigurations' }
+        default { $Type }
+    }
+
     Write-Host "Assigning policy $PolicyId ($PlatformType/$Type) to $GroupName"
 
     try {
diff --git a/Modules/CIPPCore/Public/Set-CIPPResetPassword.ps1 b/Modules/CIPPCore/Public/Set-CIPPResetPassword.ps1
@@ -11,15 +11,23 @@ function Set-CIPPResetPassword {
 
     try {
         $password = New-passwordString
-        $passwordProfile = @{
-            'passwordProfile' = @{
-                'forceChangePasswordNextSignIn' = $forceChangePasswordNextSignIn
-                'password'                      = $password
-            }
-        } | ConvertTo-Json -Compress
 
         $UserDetails = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($UserID)?`$select=onPremisesSyncEnabled" -noPagination $true -tenantid $TenantFilter -verbose
-        $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/users/$($UserID)" -tenantid $TenantFilter -type PATCH -body $passwordProfile -verbose
+        $IsSynced = $UserDetails.onPremisesSyncEnabled -eq $true
+
+        if ($IsSynced) {
+            $ResetBody = @{ 'newPassword' = $password } | ConvertTo-Json -Compress
+            $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$($UserID)/authentication/methods/28c10230-6103-485e-b985-444c60001490/resetPassword" -tenantid $TenantFilter -type POST -body $ResetBody -verbose
+        } else {
+            $passwordProfile = @{
+                'passwordProfile' = @{
+                    'forceChangePasswordNextSignIn' = $forceChangePasswordNextSignIn
+                    'password'                      = $password
+                }
+            } | ConvertTo-Json -Compress
+
+            $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/users/$($UserID)" -tenantid $TenantFilter -type PATCH -body $passwordProfile -verbose
+        }
 
         #PWPush
         $PasswordLink = $null
@@ -32,15 +40,17 @@ function Set-CIPPResetPassword {
         catch {
             Write-LogMessage -headers $Headers -API $APIName -message "Failed to create PwPush link, using plain password. Error: $($_.Exception.Message)" -sev 'Warning' -tenant $TenantFilter
         }
-        Write-LogMessage -headers $Headers -API $APIName -message "Successfully reset the password for $DisplayName, $($UserID). User must change password is set to $forceChangePasswordNextSignIn" -Sev 'Info' -tenant $TenantFilter
+        if ($IsSynced) {
+            Write-LogMessage -headers $Headers -API $APIName -message "Submitted a password writeback reset for $DisplayName, $($UserID). This user is directory synced, so the reset was sent via password writeback and the user must change password at next logon regardless of the requested setting ($forceChangePasswordNextSignIn)." -Sev 'Info' -tenant $TenantFilter
 
-        if ($UserDetails.onPremisesSyncEnabled -eq $true) {
             return [pscustomobject]@{
-                resultText = "Successfully reset the password for $DisplayName, $($UserID). User must change password is set to $forceChangePasswordNextSignIn. The new password is $password. WARNING: This user is AD synced. Please confirm passthrough or writeback is enabled."
+                resultText = "Password reset accepted for $DisplayName, $($UserID). The new password is $password. This user is directory synced, so the reset was submitted via password writeback and is applied asynchronously - it is not confirmed yet, and will fail if writeback is not enabled or if the on-premises password policy rejects the password. This user must change their password at next logon; that is enforced by this method and cannot be turned off."
                 copyField  = $password
-                state      = 'warning'
+                state      = 'success'
             }
         } else {
+            Write-LogMessage -headers $Headers -API $APIName -message "Successfully reset the password for $DisplayName, $($UserID). User must change password is set to $forceChangePasswordNextSignIn" -Sev 'Info' -tenant $TenantFilter
+
             return [pscustomobject]@{
                 resultText = "Successfully reset the password for $DisplayName, $($UserID). User must change password is set to $forceChangePasswordNextSignIn. The new password is $password"
                 copyField  = $password
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemovePolicy.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemovePolicy.ps1
@@ -16,15 +16,23 @@ function Invoke-RemovePolicy {
     $TenantFilter = $Request.Query.tenantFilter ?? $Request.body.tenantFilter
     $PolicyId = $Request.Query.ID ?? $Request.body.ID
     $UrlName = $Request.Query.URLName ?? $Request.body.URLName
-    $BaseEndpoint = switch ($UrlName) {
-        'managedAppPolicies' { 'deviceAppManagement' }
-        'mobileAppConfigurations' { 'deviceAppManagement' }
-        default { 'deviceManagement' }
+    # App protection policy lists expose the singular @odata.type as the URLName, but a Graph
+    # DELETE needs the plural collection segment under deviceAppManagement. Normalize here.
+    $GraphPath = switch ($UrlName) {
+        'androidManagedAppProtection' { 'deviceAppManagement/androidManagedAppProtections' }
+        'iosManagedAppProtection' { 'deviceAppManagement/iosManagedAppProtections' }
+        'windowsManagedAppProtection' { 'deviceAppManagement/windowsManagedAppProtections' }
+        'mdmWindowsInformationProtectionPolicy' { 'deviceAppManagement/mdmWindowsInformationProtectionPolicies' }
+        'windowsInformationProtectionPolicy' { 'deviceAppManagement/windowsInformationProtectionPolicies' }
+        'targetedManagedAppConfiguration' { 'deviceAppManagement/targetedManagedAppConfigurations' }
+        'managedAppPolicies' { 'deviceAppManagement/managedAppPolicies' }
+        'mobileAppConfigurations' { 'deviceAppManagement/mobileAppConfigurations' }
+        default { "deviceManagement/$UrlName" }
     }
     if (!$PolicyId) { exit }
 
     try {
-        $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/$($BaseEndpoint)/$($UrlName)('$($PolicyId)')" -type DELETE -tenant $TenantFilter
+        $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/$($GraphPath)('$($PolicyId)')" -type DELETE -tenant $TenantFilter
 
         $Results = "Successfully deleted the $UrlName policy with ID: $($PolicyId)"
         Write-LogMessage -headers $Headers -API $APINAME -message $Results -Sev Info -tenant $TenantFilter
diff --git a/Tests/Endpoint/Invoke-RemovePolicy.Tests.ps1 b/Tests/Endpoint/Invoke-RemovePolicy.Tests.ps1
@@ -0,0 +1,83 @@
+# Pester tests for Invoke-RemovePolicy Graph URL construction (issue #6384).
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-RemovePolicy.ps1' -File |
+        Select-Object -First 1 -ExpandProperty FullName
+
+    ([PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')).GetMethod('Add').Invoke(
+        $null, @('HttpStatusCode', [System.Net.HttpStatusCode]))
+
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+
+    function New-GraphPostRequest { param($uri, $type, $tenant) }
+    function Write-LogMessage { param($headers, $API, $message, $Sev, $tenant, $LogData) }
+    function Get-CippException { param($Exception) }
+
+    . $FunctionPath
+}
+
+Describe 'Invoke-RemovePolicy Graph URL' {
+    BeforeEach {
+        $script:deleteUri = $null
+        Mock -CommandName New-GraphPostRequest -MockWith {
+            $script:deleteUri = $uri
+        }
+        Mock -CommandName Write-LogMessage -MockWith {}
+    }
+
+    It 'maps singular app protection URLNames to the plural deviceAppManagement segment' {
+        $request = [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'RemovePolicy' }
+            Headers = @{}
+            Query   = [pscustomobject]@{
+                tenantFilter = 'contoso.onmicrosoft.com'
+                ID           = 'T_policy-1'
+                URLName      = 'androidManagedAppProtection'
+            }
+            Body    = [pscustomobject]@{}
+        }
+
+        $response = Invoke-RemovePolicy -Request $request -TriggerMetadata $null
+
+        $response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        $script:deleteUri | Should -Be "https://graph.microsoft.com/beta/deviceAppManagement/androidManagedAppProtections('T_policy-1')"
+    }
+
+    It 'keeps mobileAppConfigurations under deviceAppManagement' {
+        $request = [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'RemovePolicy' }
+            Headers = @{}
+            Query   = [pscustomobject]@{
+                tenantFilter = 'contoso.onmicrosoft.com'
+                ID           = 'config-1'
+                URLName      = 'mobileAppConfigurations'
+            }
+            Body    = [pscustomobject]@{}
+        }
+
+        $null = Invoke-RemovePolicy -Request $request -TriggerMetadata $null
+
+        $script:deleteUri | Should -Be "https://graph.microsoft.com/beta/deviceAppManagement/mobileAppConfigurations('config-1')"
+    }
+
+    It 'defaults other URLNames to deviceManagement' {
+        $request = [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'RemovePolicy' }
+            Headers = @{}
+            Query   = [pscustomobject]@{
+                tenantFilter = 'contoso.onmicrosoft.com'
+                ID           = 'policy-2'
+                URLName      = 'deviceConfigurations'
+            }
+            Body    = [pscustomobject]@{}
+        }
+
+        $null = Invoke-RemovePolicy -Request $request -TriggerMetadata $null
+
+        $script:deleteUri | Should -Be "https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations('policy-2')"
+    }
+}
