harden orc start and audit log error message

Author: Zacgoose

Modules/CIPPCore/Public/AuditLogs/New-CippAuditLogSearch.ps1

@@ -189,6 +189,20 @@ function New-CippAuditLogSearch {
                     message     = [string]'Unified auditing is disabled for this tenant.'
                 }
             }
+
+            # Handle Microsoft-side timeouts / transient errors (e.g. UnknownError with empty message)
+            $ErrorCode = $AuditLogError.error.code ?? $AuditLogError.code
+            if ($ErrorCode -in @('UnknownError', 'ServiceUnavailable', 'RequestTimeout', 'GatewayTimeout', 'TooManyRequests')) {
+                Write-LogMessage -API 'Audit Logs' -tenant $TenantFilter -message "Audit log search creation failed with transient error for tenant $TenantFilter ($ErrorCode) - will retry next cycle" -sev Warning
+                return [PSCustomObject]@{
+                    id          = $null
+                    displayName = [string]$DisplayName
+                    status      = [string]$ErrorCode
+                    cippStatus  = [string]'TransientError'
+                    message     = [string]"Microsoft returned $ErrorCode - search will be retried next cycle."
+                }
+            }
+
             throw
         }
 

Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPOrchestrator.ps1

@@ -37,6 +37,23 @@ function Start-CIPPOrchestrator {
     # ─── CIPPNG runtime: push batch directly to OrchestratorService ───
     if ($env:CIPPNG -eq 'true' -and $InputObject) {
         $OrchestratorName = $InputObject.OrchestratorName ?? 'UnnamedOrchestrator'
+
+        # QueueFunction pattern: call the function first to generate batch items
+        if (-not $InputObject.Batch -and $InputObject.QueueFunction) {
+            $QueueFuncName = "Push-$($InputObject.QueueFunction.FunctionName)"
+            Write-Information "CIPP-NG: Calling QueueFunction '$QueueFuncName' to build batch for '$OrchestratorName'"
+            $QueueItem = [PSCustomObject]@{}
+            if ($InputObject.QueueFunction.Parameters) {
+                $QueueItem = [PSCustomObject]$InputObject.QueueFunction.Parameters
+            }
+            $BatchResult = & $QueueFuncName -Item $QueueItem
+            $InputObject.Batch = @($BatchResult | Where-Object { $null -ne $_ })
+            if ($InputObject.Batch.Count -eq 0) {
+                Write-Information "CIPP-NG: QueueFunction '$QueueFuncName' returned 0 tasks for '$OrchestratorName' - skipping"
+                return "CIPPNG-$OrchestratorName-NoTasks"
+            }
+        }
+
         $BatchJson = ConvertTo-Json -InputObject @($InputObject.Batch) -Depth 10 -Compress
 
         $PostExecFunctionName = $null