Merge pull request #974 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1

@@ -73,6 +73,7 @@ function Get-NormalizedError {
         '*AADSTS9002313*' { 'The credentials used to connect to the Graph API are not available, please retry. If this issue persists you may need to execute the SAM wizard.' }
         '*One or more platform(s) is/are not configured for the customer. Please configure the platform before trying to purchase a SKU.*' { 'One or more platform(s) is/are not configured for the customer. Please configure the platform before trying to purchase a SKU.' }
         "One or more added object references already exist for the following modified properties: 'members'." { 'This user is already a member of the selected group.' }
+        '*is not present in the role definition of the current user*' { 'We do not have permissions to access this resource, try performing a CPV refresh in Application Settings -> Permissions. ' }
         default { $message }
 
     }

Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1

@@ -17,21 +17,34 @@ function Set-CIPPSAMAdminRoles {
 
     $ActionLogs = [System.Collections.Generic.List[object]]::new()
 
+    # Default roles always assigned for all tenants
+    $DefaultRoles = @(
+        [PSCustomObject]@{ value = '17315797-102d-40b4-93e0-432062caca18'; label = 'Compliance Administrator' }
+    )
+
     $SAMRolesTable = Get-CIPPTable -tablename 'SAMRoles'
     $Roles = Get-CIPPAzDataTableEntity @SAMRolesTable
 
     try {
-        $SAMRoles = $Roles.Roles | ConvertFrom-Json -ErrorAction Stop
+        $SAMRoles = @($Roles.Roles | ConvertFrom-Json -ErrorAction Stop)
         $Tenants = $Roles.Tenants | ConvertFrom-Json -ErrorAction Stop
         if ($Tenants.value) {
             $Tenants = $Tenants.value
         }
     } catch {
-        $ActionLogs.Add('CIPP-SAM roles not configured')
-        return $ActionLogs
+        $SAMRoles = @()
+        $Tenants = @()
+    }
+
+    # Merge default roles with user-configured roles, avoiding duplicates
+    $ExistingValues = @($SAMRoles | ForEach-Object { $_.value })
+    foreach ($DefaultRole in $DefaultRoles) {
+        if ($DefaultRole.value -notin $ExistingValues) {
+            $SAMRoles = @($SAMRoles) + @($DefaultRole)
+        }
     }
 
-    if (($SAMRoles | Measure-Object).count -gt 0 -and $Tenants -contains $TenantFilter -or $Tenants -contains 'AllTenants') {
+    if (($SAMRoles | Measure-Object).Count -gt 0 -and ($Tenants -contains $TenantFilter -or $Tenants -contains 'AllTenants' -or ($Tenants | Measure-Object).Count -eq 0)) {
         $InitialRequests = @(
             [PSCustomObject]@{
                 id     = 'memberOf'
@@ -83,8 +96,10 @@ function Set-CIPPSAMAdminRoles {
             $Results | ForEach-Object {
                 if ($_.status -eq 204) {
                     $ActionLogs.Add("Added service principal to directory role $($_.id)")
+                } elseif ($_.status -eq 404) {
+                    $ActionLogs.Add("Directory role $($_.id) does not exist in tenant, skipping")
                 } else {
-                    $ActionLogs.Add("Failed to add service principal to directoryRole $($_.id)")
+                    $ActionLogs.Add("Failed to add service principal to directoryRole $($_.id):  $($_ | ConvertTo-Json -Depth 5)")
                     Write-Verbose ($_ | ConvertTo-Json -Depth 5)
                     $HasFailures = $true
                 }