Merge pull request #910 from KelvinTegelaar/dev

pull[bot] · web-flow · commit 6caa71bf8be4 · 2026-04-10T14:22:18.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1 b/Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1
@@ -285,8 +285,15 @@ function Compare-CIPPIntuneObject {
                                 # Both empty (null, "", []) - no difference
                                 continue
                             }
-                            if ($val1 -or $val2) {
+                            if ($null -ne $val1 -and $null -ne $val2) {
                                 Compare-ObjectsRecursively -Object1 $val1 -Object2 $val2 -PropertyPath $newPath -Depth ($Depth + 1) -MaxDepth $MaxDepth
+                            } elseif (-not $val1IsEmpty -or -not $val2IsEmpty) {
+                                # One side is null/empty, the other is not - report as difference
+                                $result.Add([PSCustomObject]@{
+                                        Property      = $newPath
+                                        ExpectedValue = if ($null -eq $val1) { '' } else { $val1 }
+                                        ReceivedValue = if ($null -eq $val2) { '' } else { $val2 }
+                                    })
                             }
                         } catch {
                             throw
@@ -297,10 +304,10 @@ function Compare-CIPPIntuneObject {
                             $valIsEmpty = ($null -eq $val -or $val -eq '' -or ($val -is [Array] -and $val.Count -eq 0))
                             if (-not $valIsEmpty) {
                                 $result.Add([PSCustomObject]@{
-                                    Property      = $newPath
-                                    ExpectedValue = $val
-                                    ReceivedValue = ''
-                                })
+                                        Property      = $newPath
+                                        ExpectedValue = $val
+                                        ReceivedValue = ''
+                                    })
                             }
                         } catch {
                             throw
@@ -311,10 +318,10 @@ function Compare-CIPPIntuneObject {
                             $valIsEmpty = ($null -eq $val -or $val -eq '' -or ($val -is [Array] -and $val.Count -eq 0))
                             if (-not $valIsEmpty) {
                                 $result.Add([PSCustomObject]@{
-                                    Property      = $newPath
-                                    ExpectedValue = ''
-                                    ReceivedValue = $val
-                                })
+                                        Property      = $newPath
+                                        ExpectedValue = ''
+                                        ReceivedValue = $val
+                                    })
                             }
                         } catch {
                             throw
diff --git a/Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1 b/Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1
@@ -61,7 +61,8 @@ function New-CIPPCAPolicy {
                         $GroupIds.Add($NewGroup.GroupId)
                     }
                 } else {
-                    Write-Warning "Group $_ not found in the tenant"
+                    Write-Warning "Group $_ not found in the tenant and CreateGroups is disabled"
+                    throw "Group '$_' not found in tenant $TenantFilter. Enable 'Create groups if they do not exist' or create the group manually before deploying this policy."
                 }
             }
         }
@@ -444,7 +445,7 @@ function New-CIPPCAPolicy {
                 # Preserve any exclusion groups named "Vacation Exclusion - <PolicyDisplayName>" from existing policy
                 try {
                     $ExistingVacationGroup = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=startsWith(displayName,'Vacation Exclusion')&`$select=id,displayName&`$top=999&`$count=true" -ComplexFilter -tenantid $TenantFilter -asApp $true |
-                        Where-Object { $CheckExisting.conditions.users.excludeGroups -contains $_.id }
+                    Where-Object { $CheckExisting.conditions.users.excludeGroups -contains $_.id }
                     if ($ExistingVacationGroup) {
                         if (-not ($JSONobj.conditions.users.PSObject.Properties.Name -contains 'excludeGroups')) {
                             $JSONobj.conditions.users | Add-Member -NotePropertyName 'excludeGroups' -NotePropertyValue @() -Force
diff --git a/Modules/CIPPCore/Public/New-CIPPGroup.ps1 b/Modules/CIPPCore/Public/New-CIPPGroup.ps1
@@ -178,16 +178,20 @@ function New-CIPPGroup {
                 GroupType = $NormalizedGroupType
                 Email     = if ($NeedsEmail) { $Email } else { $null }
             }
-            $CacheEntity = @{
-                PartitionKey = 'GroupCreation'
-                RowKey       = $CacheRowKey
-                GroupId      = [string]$GraphRequest.id
-                DisplayName  = [string]$GroupObject.displayName
-                GroupType    = [string]$NormalizedGroupType
-                Email        = [string]$(if ($NeedsEmail) { $Email } else { '' })
-                Tenant       = [string]$TenantFilter
+            try {
+                $CacheEntity = @{
+                    PartitionKey = 'GroupCreation'
+                    RowKey       = $CacheRowKey
+                    GroupId      = [string]$GraphRequest.id
+                    DisplayName  = [string]$GroupObject.displayName
+                    GroupType    = [string]$NormalizedGroupType
+                    Email        = [string]$(if ($NeedsEmail) { $Email } else { '' })
+                    Tenant       = [string]$TenantFilter
+                }
+                Add-CIPPAzDataTableEntity @GroupCacheTable -Entity $CacheEntity -Force
+            } catch {
+                Write-Warning "Failed to write group creation cache for $($GroupObject.displayName): $($_.Exception.Message)"
             }
-            Add-CIPPAzDataTableEntity @GroupCacheTable -Entity $CacheEntity -Force
             if ($GroupObject.subscribeMembers) {
                 #Waiting for group to become available in Exo.
                 Start-Sleep -Seconds 10
@@ -267,16 +271,20 @@ function New-CIPPGroup {
                 GroupType = $NormalizedGroupType
                 Email     = $Email
             }
-            $CacheEntity = @{
-                PartitionKey = 'GroupCreation'
-                RowKey       = $CacheRowKey
-                GroupId      = [string]$GraphRequest.Identity
-                DisplayName  = [string]$GroupObject.displayName
-                GroupType    = [string]$NormalizedGroupType
-                Email        = [string]$Email
-                Tenant       = [string]$TenantFilter
+            try {
+                $CacheEntity = @{
+                    PartitionKey = 'GroupCreation'
+                    RowKey       = $CacheRowKey
+                    GroupId      = [string]$GraphRequest.Identity
+                    DisplayName  = [string]$GroupObject.displayName
+                    GroupType    = [string]$NormalizedGroupType
+                    Email        = [string]$Email
+                    Tenant       = [string]$TenantFilter
+                }
+                Add-CIPPAzDataTableEntity @GroupCacheTable -Entity $CacheEntity -Force
+            } catch {
+                Write-Warning "Failed to write group creation cache for $($GroupObject.displayName): $($_.Exception.Message)"
             }
-            Add-CIPPAzDataTableEntity @GroupCacheTable -Entity $CacheEntity -Force
         }
 
         Write-LogMessage -API $APIName -tenant $TenantFilter -message "Created group $($GroupObject.displayName) with id $($Result.GroupId)" -Sev Info
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1
@@ -121,6 +121,12 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
         } else {
             $templateResult = New-CIPPCATemplate -TenantFilter $tenant -JSON $CheckExististing -preloadedLocations $preloadedLocations
             $CompareObj = ConvertFrom-Json -ErrorAction SilentlyContinue -InputObject $templateResult
+            if ($null -eq $Policy -or $null -eq $CompareObj) {
+                $nullSide = if ($null -eq $Policy) { 'template policy' } else { 'tenant policy conversion' }
+                Write-LogMessage -API 'Standards' -tenant $Tenant -message "Cannot compare CA policy: $nullSide returned null for $($Settings.TemplateList.label)" -sev Error
+                Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Settings.TemplateList.value)" -FieldValue "Error comparing policy: $nullSide returned null" -Tenant $Tenant
+                return
+            }
             try {
                 $Compare = Compare-CIPPIntuneObject -ReferenceObject $Policy -DifferenceObject $CompareObj -CompareType 'ca'
             } catch {
diff --git a/host.json b/host.json
@@ -16,7 +16,7 @@
         "distributedTracingEnabled": false,
         "version": "None"
       },
-      "defaultVersion": "10.2.6",
+      "defaultVersion": "10.3.0",
       "versionMatchStrategy": "Strict",
       "versionFailureStrategy": "Fail"
     }
diff --git a/version_latest.txt b/version_latest.txt
@@ -1 +1 @@
-10.2.6
+10.3.0

Original file line number	Diff line number	Diff line change
`@@ -61,7 +61,8 @@ function New-CIPPCAPolicy {`
`61`	`61`	`$GroupIds.Add($NewGroup.GroupId)`
`62`	`62`	`}`
`63`	`63`	`} else {`
`64`		`- Write-Warning "Group $_ not found in the tenant"`
	`64`	`+ Write-Warning "Group $_ not found in the tenant and CreateGroups is disabled"`
	`65`	`+ throw "Group '$_' not found in tenant $TenantFilter. Enable 'Create groups if they do not exist' or create the group manually before deploying this policy."`
`65`	`66`	`}`
`66`	`67`	`}`
`67`	`68`	`}`
`@@ -444,7 +445,7 @@ function New-CIPPCAPolicy {`
`444`	`445`	`# Preserve any exclusion groups named "Vacation Exclusion - <PolicyDisplayName>" from existing policy`
`445`	`446`	`try {`
`446`	`447`	$ExistingVacationGroup = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=startsWith(displayName,'Vacation Exclusion')&`$select=id,displayName&`$top=999&`$count=true" -ComplexFilter -tenantid $TenantFilter -asApp $true \|
`447`		`- Where-Object { $CheckExisting.conditions.users.excludeGroups -contains $_.id }`
	`448`	`+ Where-Object { $CheckExisting.conditions.users.excludeGroups -contains $_.id }`
`448`	`449`	`if ($ExistingVacationGroup) {`
`449`	`450`	`if (-not ($JSONobj.conditions.users.PSObject.Properties.Name -contains 'excludeGroups')) {`
`450`	`451`	`$JSONobj.conditions.users \| Add-Member -NotePropertyName 'excludeGroups' -NotePropertyValue @() -Force`
Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@`
`16`	`16`	`"distributedTracingEnabled": false,`
`17`	`17`	`"version": "None"`
`18`	`18`	`},`
`19`		`- "defaultVersion": "10.2.6",`
	`19`	`+ "defaultVersion": "10.3.0",`
`20`	`20`	`"versionMatchStrategy": "Strict",`
`21`	`21`	`"versionFailureStrategy": "Fail"`
`22`	`22`	`}`