More reliable RG name resolution

Zacgoose · Zacgoose · commit f690b6df4cf4 · 2026-06-24T13:50:31.000+08:00
diff --git a/Modules/CIPPCore/Public/Authentication/Get-CIPPManagedIdentityResourceId.ps1 b/Modules/CIPPCore/Public/Authentication/Get-CIPPManagedIdentityResourceId.ps1
@@ -0,0 +1,51 @@
+function Get-CIPPManagedIdentityResourceId {
+    <#
+    .SYNOPSIS
+        Get the Azure resource ID that the Function App's managed identity belongs to.
+    .DESCRIPTION
+        Reads the 'xms_mirid' claim from a managed identity access token. For a system-assigned
+        identity (which CIPP uses), this claim is the ARM resource ID of the host resource itself
+        - i.e. the Function App site, including its resource group:
+
+            /subscriptions/{sub}/resourcegroups/{rg}/providers/Microsoft.Web/sites/{site}
+
+        This is the most reliable in-process source for the site's resource group because it is
+        present in every managed identity token, requires no extra ARM/Graph call, and - unlike
+        parsing WEBSITE_OWNER_NAME - always names the site's RG rather than the App Service Plan's
+        webspace RG.
+
+        Note: for a user-assigned identity, xms_mirid points at the userAssignedIdentities resource
+        instead, which may live in a different RG. Callers that need the site's RG should validate
+        the returned ID against the expected site (see Get-CIPPFunctionAppResourceGroup).
+    .PARAMETER ResourceUrl
+        The Azure resource URL to request the token for. Defaults to Azure Resource Manager.
+    .EXAMPLE
+        Get-CIPPManagedIdentityResourceId
+        Returns e.g. /subscriptions/.../resourcegroups/CIPP-myinstance/providers/Microsoft.Web/sites/cippabcde
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $false)]
+        [string]$ResourceUrl = 'https://management.azure.com/'
+    )
+
+    $Token = Get-CIPPAzIdentityToken -ResourceUrl $ResourceUrl
+    if (-not $Token) {
+        throw 'Could not acquire a managed identity token to read the xms_mirid claim.'
+    }
+
+    # JWT payload is the second dot-delimited segment, base64url-encoded.
+    $Parts = $Token.Split('.')
+    if ($Parts.Count -lt 2) {
+        throw 'Managed identity token is not a well-formed JWT.'
+    }
+
+    $Payload = $Parts[1].Replace('-', '+').Replace('_', '/')
+    switch ($Payload.Length % 4) {
+        2 { $Payload += '==' }
+        3 { $Payload += '=' }
+    }
+
+    $Claims = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Payload)) | ConvertFrom-Json
+    return $Claims.xms_mirid
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-ContainerUpdateCheck.ps1 b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-ContainerUpdateCheck.ps1
@@ -86,12 +86,11 @@ function Start-ContainerUpdateCheck {
             # Resolve ARM site details
             $Subscription = Get-CIPPAzFunctionAppSubId
             $SiteName = $env:WEBSITE_SITE_NAME
-            $RGName = $env:WEBSITE_RESOURCE_GROUP
-            if (-not $RGName) {
-                $Owner = $env:WEBSITE_OWNER_NAME
-                if ($Owner -match '^(?<SubscriptionId>[^+]+)\+(?<RGName>[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') {
-                    $RGName = $Matches.RGName
-                }
+            try {
+                $RGName = Get-CIPPFunctionAppResourceGroup -SiteName $SiteName
+            } catch {
+                Write-Information "Could not determine resource group: $($_.Exception.Message)"
+                $RGName = $null
             }
 
             $ImageTag = $env:IMAGE_TAG ?? 'unknown'
diff --git a/Modules/CIPPCore/Public/Functions/Request-CIPPRestart.ps1 b/Modules/CIPPCore/Public/Functions/Request-CIPPRestart.ps1
@@ -19,13 +19,7 @@ function Request-CIPPRestart {
     try {
         $Subscription = Get-CIPPAzFunctionAppSubId
         $SiteName = $env:WEBSITE_SITE_NAME
-        $RGName = $env:WEBSITE_RESOURCE_GROUP
-        if (-not $RGName) {
-            $Owner = $env:WEBSITE_OWNER_NAME
-            if ($Owner -match '^(?<SubscriptionId>[^+]+)\+(?<RGName>[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') {
-                $RGName = $Matches.RGName
-            }
-        }
+        $RGName = Get-CIPPFunctionAppResourceGroup -SiteName $SiteName
         if (-not ($Subscription -and $RGName -and $SiteName)) {
             throw 'Azure App Service details could not be determined from environment'
         }
diff --git a/Modules/CIPPCore/Public/Get-ApplicationInsightsQuery.ps1 b/Modules/CIPPCore/Public/Get-ApplicationInsightsQuery.ps1
@@ -10,11 +10,7 @@ function Get-ApplicationInsightsQuery {
     }
 
     $SubscriptionId = Get-CIPPAzFunctionAppSubId
-    if ($env:WEBSITE_SKU -ne 'FlexConsumption' -and $Owner -match '^(?<SubscriptionId>[^+]+)\+(?<RGName>[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') {
-        $RGName = $Matches.RGName
-    } else {
-        $RGName = $env:WEBSITE_RESOURCE_GROUP
-    }
+    $RGName = Get-CIPPFunctionAppResourceGroup
     $AppInsightsName = $env:WEBSITE_SITE_NAME
 
     $Body = @{
diff --git a/Modules/CIPPCore/Public/GraphHelper/Get-CIPPFunctionAppResourceGroup.ps1 b/Modules/CIPPCore/Public/GraphHelper/Get-CIPPFunctionAppResourceGroup.ps1
@@ -0,0 +1,50 @@
+function Get-CIPPFunctionAppResourceGroup {
+    <#
+    .SYNOPSIS
+        Resolve the resource group that the CIPP Function App site lives in.
+    .DESCRIPTION
+        Returns the resource group of the running Function App, using authoritative sources only:
+
+            1. WEBSITE_RESOURCE_GROUP - platform-injected, the site's actual RG. Free, no decode.
+            2. xms_mirid claim from the managed identity token - the site's own ARM resource ID,
+               present even when WEBSITE_RESOURCE_GROUP is empty, needs no extra call or permission.
+
+        The legacy approach of parsing WEBSITE_OWNER_NAME is intentionally NOT used: that string
+        encodes the App Service Plan's webspace RG, which is frequently different from the site's RG
+        (e.g. it returns 'DefaultResourceGroup-WEU' or '<rg>-m01' for sites whose plan was created
+        in an auto-generated/other resource group). Writing auth settings, restarting, or querying
+        the wrong RG is worse than failing, so this throws when no reliable source is available.
+    .PARAMETER SiteName
+        The Function App site name to resolve. Defaults to WEBSITE_SITE_NAME.
+    .EXAMPLE
+        Get-CIPPFunctionAppResourceGroup
+        Returns e.g. 'CIPP-myinstance'
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $false)]
+        [string]$SiteName = $env:WEBSITE_SITE_NAME
+    )
+
+    # 1. Platform-injected site resource group - authoritative, zero cost.
+    if ($env:WEBSITE_RESOURCE_GROUP) {
+        return $env:WEBSITE_RESOURCE_GROUP
+    }
+
+    # 2. The managed identity's own token names this site's resource ID (incl. RG). Only trust it
+    #    when it actually points at this Microsoft.Web/sites resource, so a user-assigned identity
+    #    (whose xms_mirid is a userAssignedIdentities resource) falls through rather than returning
+    #    the identity's RG.
+    try {
+        $MiRid = Get-CIPPManagedIdentityResourceId
+        if ($SiteName -and $MiRid -match "(?i)/resourcegroups/(?<RG>[^/]+)/providers/Microsoft\.Web/sites/$([regex]::Escape($SiteName))(/|$)") {
+            return $Matches.RG
+        }
+        Write-Information "xms_mirid did not match site '$SiteName': $MiRid"
+    } catch {
+        Write-Warning "Could not read resource group from managed identity token: $($_.Exception.Message)"
+    }
+
+    # 3. No reliable source - fail loudly rather than guess from WEBSITE_OWNER_NAME.
+    throw "Could not determine the function app resource group for site '$SiteName'. WEBSITE_RESOURCE_GROUP is empty and the managed identity resource ID was unavailable."
+}
diff --git a/Modules/CIPPCore/Public/GraphHelper/Set-CIPPOffloadFunctionTriggers.ps1 b/Modules/CIPPCore/Public/GraphHelper/Set-CIPPOffloadFunctionTriggers.ps1
@@ -38,16 +38,7 @@ function Set-CIPPOffloadFunctionTriggers {
     }
 
     # Determine resource group
-    if ($env:WEBSITE_RESOURCE_GROUP) {
-        $ResourceGroupName = $env:WEBSITE_RESOURCE_GROUP
-    } else {
-        $Owner = $env:WEBSITE_OWNER_NAME
-        if ($env:WEBSITE_SKU -ne 'FlexConsumption' -and $Owner -match '^(?<SubscriptionId>[^+]+)\+(?<RGName>[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') {
-            $ResourceGroupName = $Matches.RGName
-        } else {
-            throw 'Could not determine resource group. Please provide ResourceGroupName parameter.'
-        }
-    }
+    $ResourceGroupName = Get-CIPPFunctionAppResourceGroup -SiteName $FunctionAppName
 
     # Define the triggers to disable when offloading is enabled
     $TargetedTriggers = @(
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1
@@ -193,19 +193,9 @@ function Invoke-ExecApiClient {
             }
         }
         'GetAzureConfiguration' {
-            if ($env:WEBSITE_RESOURCE_GROUP) {
-                $RGName = $env:WEBSITE_RESOURCE_GROUP
-            } else {
-                $Owner = $env:WEBSITE_OWNER_NAME
-                if ($env:WEBSITE_SKU -ne 'FlexConsumption' -and $Owner -match '^(?<SubscriptionId>[^+]+)\+(?<RGName>[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') {
-                    $RGName = $Matches.RGName
-                } else {
-                    Write-Information "Could not determine resource group from environment variables. Owner: $Owner"
-                    $RGName = $null
-                }
-            }
             $FunctionAppName = $env:WEBSITE_SITE_NAME
             try {
+                $RGName = Get-CIPPFunctionAppResourceGroup -SiteName $FunctionAppName
                 $APIClients = Get-CippApiAuth -RGName $RGName -FunctionAppName $FunctionAppName
                 $Results = $ApiClients
             } catch {
@@ -220,24 +210,14 @@ function Invoke-ExecApiClient {
         }
         'SaveToAzure' {
             $TenantId = $env:TenantID
-            if ($env:WEBSITE_RESOURCE_GROUP) {
-                $RGName = $env:WEBSITE_RESOURCE_GROUP
-            } else {
-                $Owner = $env:WEBSITE_OWNER_NAME
-                if ($env:WEBSITE_SKU -ne 'FlexConsumption' -and $Owner -match '^(?<SubscriptionId>[^+]+)\+(?<RGName>[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') {
-                    $RGName = $Matches.RGName
-                } else {
-                    Write-Information "Could not determine resource group from environment variables. Owner: $Owner"
-                    $RGName = $null
-                }
-            }
             $FunctionAppName = $env:WEBSITE_SITE_NAME
             $AllClients = Get-CIPPAzDataTableEntity @Table -Filter 'Enabled eq true' | Where-Object { ![string]::IsNullOrEmpty($_.RowKey) }
             $ClientIds = $AllClients.RowKey
             # MCPAllowed can round-trip from table storage as a bool or a string; compare on string form.
             $McpClientIds = @($AllClients | Where-Object { "$($_.MCPAllowed)" -eq 'True' } | ForEach-Object { $_.RowKey })
             Write-Information "[ExecApiClient] MCP clients resolved for audiences/scope: $($McpClientIds -join ', ')"
             try {
+                $RGName = Get-CIPPFunctionAppResourceGroup -SiteName $FunctionAppName
                 Set-CippApiAuth -RGName $RGName -FunctionAppName $FunctionAppName -TenantId $TenantId -ClientIds $ClientIds -McpClientIds $McpClientIds
 
                 # Advertise the MCP resource scope via App Service PRM so the Claude connector requests
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackendURLs.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackendURLs.ps1
@@ -13,16 +13,11 @@ function Invoke-ExecBackendURLs {
     # Write to the Azure Functions log stream.
     Write-Host 'PowerShell HTTP trigger function processed a request.'
 
-    if ($env:WEBSITE_RESOURCE_GROUP) {
-        $RGName = $env:WEBSITE_RESOURCE_GROUP
-    } else {
-        $Owner = $env:WEBSITE_OWNER_NAME
-        if ($env:WEBSITE_SKU -ne 'FlexConsumption' -and $Owner -match '^(?<SubscriptionId>[^+]+)\+(?<RGName>[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') {
-            $RGName = $Matches.RGName
-        } else {
-            Write-Information "Could not determine resource group from environment variables. Owner: $Owner"
-            $RGName = $null
-        }
+    try {
+        $RGName = Get-CIPPFunctionAppResourceGroup
+    } catch {
+        Write-Information "Could not determine resource group: $($_.Exception.Message)"
+        $RGName = $null
     }
 
     $results = @{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1
@@ -17,18 +17,18 @@ function Invoke-ExecContainerManagement {
 
     # Helper: resolve ARM site details
     function Get-ContainerSiteInfo {
-        $info = @{
-            Subscription = Get-CIPPAzFunctionAppSubId
-            SiteName     = $env:WEBSITE_SITE_NAME
-            RGName       = $env:WEBSITE_RESOURCE_GROUP
+        $SiteName = $env:WEBSITE_SITE_NAME
+        try {
+            $RGName = Get-CIPPFunctionAppResourceGroup -SiteName $SiteName
+        } catch {
+            Write-Information "Could not determine resource group: $($_.Exception.Message)"
+            $RGName = $null
         }
-        if (-not $info.RGName) {
-            $Owner = $env:WEBSITE_OWNER_NAME
-            if ($Owner -match '^(?<SubscriptionId>[^+]+)\+(?<RGName>[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') {
-                $info.RGName = $Matches.RGName
-            }
+        return @{
+            Subscription = Get-CIPPAzFunctionAppSubId
+            SiteName     = $SiteName
+            RGName       = $RGName
         }
-        return $info
     }
 
     # Helper: query GHCR for the image at $Tag and return its digest + version label.
