changed onboarding to use a group instead.

Author: KelvinTegelaar

Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ExecOnboardTenantQueue.ps1

@@ -443,38 +443,75 @@ function Push-ExecOnboardTenantQueue {
 
         if ($OnboardingSteps.Step4.Status -eq 'succeeded') {
             if ($Item.StandardsExcludeAllTenants -eq $true) {
-                $AddExclusionObj = [PSCustomObject]@{
-                    label       = '{0} ({1})' -f $Tenant.displayName, $Tenant.defaultDomainName
-                    value       = $Tenant.defaultDomainName
-                    addedFields = @{
-                        customerId        = $Tenant.customerId
-                        defaultDomainName = $Tenant.defaultDomainName
+                $GroupTable = Get-CIPPTable -tablename 'TenantGroups'
+                $MembersTable = Get-CIPPTable -tablename 'TenantGroupMembers'
+                $ExclusionGroupName = 'Excluded onboarded tenants'
+
+                # Find existing exclusion group
+                $ExclusionGroup = Get-CIPPAzDataTableEntity @GroupTable -Filter "PartitionKey eq 'TenantGroup'" | Where-Object { $_.Name -eq $ExclusionGroupName }
+                if (-not $ExclusionGroup) {
+                    $ExclusionGroupId = [guid]::NewGuid().ToString()
+                    $ExclusionGroup = @{
+                        PartitionKey = 'TenantGroup'
+                        RowKey       = $ExclusionGroupId
+                        Name         = $ExclusionGroupName
+                        Description  = 'Tenants excluded from top-level standards during onboarding'
+                        GroupType    = 'static'
                     }
+                    Add-CIPPAzDataTableEntity @GroupTable -Entity $ExclusionGroup -Force
+                    $Logs.Add([PSCustomObject]@{ Date = (Get-Date).ToUniversalTime(); Log = "Created tenant group '$ExclusionGroupName'" })
+                } else {
+                    $ExclusionGroupId = $ExclusionGroup.RowKey
+                }
+
+                # Add tenant to the exclusion group if not already a member
+                $MemberRowKey = '{0}-{1}' -f $ExclusionGroupId, $Tenant.customerId
+                $ExistingMember = Get-CIPPAzDataTableEntity @MembersTable -Filter "PartitionKey eq 'Member' and RowKey eq '$MemberRowKey'"
+                if (-not $ExistingMember) {
+                    Add-CIPPAzDataTableEntity @MembersTable -Entity @{
+                        PartitionKey = 'Member'
+                        RowKey       = $MemberRowKey
+                        GroupId      = $ExclusionGroupId
+                        customerId   = $Tenant.customerId
+                    } -Force
+                }
+
+                # Ensure the group is in excludedTenants of all AllTenants templates
+                $GroupExclusionObj = [PSCustomObject]@{
+                    label = $ExclusionGroupName
+                    value = $ExclusionGroupId
+                    type  = 'Group'
                 }
-                $Table = Get-CIPPTable -tablename 'templates'
-                $ExistingTemplates = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'StandardsTemplateV2'" | Where-Object { $_.JSON -match 'AllTenants' }
+                $TemplatesTable = Get-CIPPTable -tablename 'templates'
+                $ExistingTemplates = Get-CIPPAzDataTableEntity @TemplatesTable -Filter "PartitionKey eq 'StandardsTemplateV2'" | Where-Object { $_.JSON -match 'AllTenants' }
                 foreach ($AllTenantsTemplate in $ExistingTemplates) {
                     $object = $AllTenantsTemplate.JSON | ConvertFrom-Json
-                    $NewExcludedTenants = [System.Collections.Generic.List[object]]::new()
-                    if (!$object.excludedTenants) {
+                    if (-not $object.excludedTenants) {
                         $object | Add-Member -MemberType NoteProperty -Name 'excludedTenants' -Value @() -Force
                     }
-                    foreach ($ExcludedStandardsTenant in $object.excludedTenants) {
-                        $NewExcludedTenants.Add($ExcludedStandardsTenant)
-                    }
-                    $NewExcludedTenants.Add($AddExclusionObj)
-                    $object.excludedTenants = $NewExcludedTenants
-                    $JSON = ConvertTo-Json -InputObject $object -Compress -Depth 10
-                    $Table.Force = $true
-                    Add-CIPPAzDataTableEntity @Table -Entity @{
-                        JSON         = "$JSON"
-                        RowKey       = $AllTenantsTemplate.RowKey
-                        GUID         = $AllTenantsTemplate.GUID
-                        PartitionKey = 'StandardsTemplateV2'
+                    $AlreadyHasGroup = $object.excludedTenants | Where-Object { $_.value -eq $ExclusionGroupId -and $_.type -eq 'Group' }
+                    if (-not $AlreadyHasGroup) {
+                        $NewExcludedTenants = [System.Collections.Generic.List[object]]::new()
+                        foreach ($ExcludedEntry in $object.excludedTenants) {
+                            $NewExcludedTenants.Add($ExcludedEntry)
+                        }
+                        $NewExcludedTenants.Add($GroupExclusionObj)
+                        $object.excludedTenants = $NewExcludedTenants
+                        $JSON = ConvertTo-Json -InputObject $object -Compress -Depth 10
+                        $TemplatesTable.Force = $true
+                        Add-CIPPAzDataTableEntity @TemplatesTable -Entity @{
+                            JSON         = "$JSON"
+                            RowKey       = $AllTenantsTemplate.RowKey
+                            GUID         = $AllTenantsTemplate.GUID
+                            PartitionKey = 'StandardsTemplateV2'
+                        }
                     }
                 }
 
-                $Logs.Add([PSCustomObject]@{ Date = (Get-Date).ToUniversalTime(); Log = 'Set All Tenant Standards Exclusion' })
+                # Bust the tenant groups cache so standards pick up the new member
+                $null = Get-TenantGroups -SkipCache
+
+                $Logs.Add([PSCustomObject]@{ Date = (Get-Date).ToUniversalTime(); Log = 'Set All Tenant Standards Exclusion via group' })
             }
             $Logs.Add([PSCustomObject]@{ Date = (Get-Date).ToUniversalTime(); Log = "Testing API access for $($Tenant.defaultDomainName)" })
             $OnboardingSteps.Step5.Status = 'running'