Fix for ORCA107 and add Exchange Global Quarantine policy to cache

Author: Zacgoose

Config/CIPPDBCacheTypes.json

@@ -214,6 +214,11 @@
     "friendlyName": "Exchange Quarantine Policy",
     "description": "Exchange Online quarantine policy"
   },
+  {
+    "type": "ExoGlobalQuarantinePolicy",
+    "friendlyName": "Exchange Global Quarantine Policy",
+    "description": "Exchange Online tenant-wide Global Quarantine policy (end-user notification settings)"
+  },
   {
     "type": "ExoRemoteDomain",
     "friendlyName": "Exchange Remote Domain",

Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoQuarantinePolicy.ps1

@@ -29,4 +29,18 @@ function Set-CIPPDBCacheExoQuarantinePolicy {
     } catch {
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Quarantine policy data: $($_.Exception.Message)" -sev Error
     }
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Global Quarantine policy' -sev Debug
+
+        $GlobalQuarantinePolicy = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantinePolicy' -cmdParams @{ QuarantinePolicyType = 'GlobalQuarantinePolicy' }
+        if ($GlobalQuarantinePolicy) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoGlobalQuarantinePolicy' -Data $GlobalQuarantinePolicy -AddCount
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Global Quarantine policy' -sev Debug
+        }
+        $GlobalQuarantinePolicy = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Global Quarantine policy data: $($_.Exception.Message)" -sev Error
+    }
 }

Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.ps1

@@ -6,45 +6,59 @@ function Invoke-CippTestORCA107 {
     param($Tenant)
 
     try {
-        $Policies = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoQuarantinePolicy'
+        $Policies = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoGlobalQuarantinePolicy'
 
         if (-not $Policies) {
             Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA107' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'End-user spam notification is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Quarantine'
             return
         }
 
+        # Exo returns EndUserSpamNotificationFrequency as an ISO 8601 duration string ('PT4H', 'P1D', 'P7D').
+        # 'PT0S' or null means notifications are disabled. The placeholder policy name 'DefaultGlobalPolicy'
+        # indicates the global policy has never been configured.
         $FailedPolicies = [System.Collections.Generic.List[object]]::new()
         $PassedPolicies = [System.Collections.Generic.List[object]]::new()
 
         foreach ($Policy in $Policies) {
-            if ($Policy.EndUserSpamNotificationFrequency -gt 0) {
-                $PassedPolicies.Add($Policy) | Out-Null
+            $Frequency = $Policy.EndUserSpamNotificationFrequency
+            $IsConfigured = $Policy.Name -ne 'DefaultGlobalPolicy'
+            $IsEnabled = $false
+            if ($IsConfigured -and $Frequency) {
+                try {
+                    $TimeSpan = [System.Xml.XmlConvert]::ToTimeSpan([string]$Frequency)
+                    $IsEnabled = $TimeSpan.TotalSeconds -gt 0
+                } catch {
+                    $IsEnabled = $false
+                }
+            }
+
+            $DisplayFrequency = if ($Frequency) { [string]$Frequency } else { 'Not set' }
+            $Annotated = $Policy | Select-Object *, @{ Name = 'DisplayFrequency'; Expression = { $DisplayFrequency } }
+
+            if ($IsEnabled) {
+                $PassedPolicies.Add($Annotated) | Out-Null
             } else {
-                $FailedPolicies.Add($Policy) | Out-Null
+                $FailedPolicies.Add($Annotated) | Out-Null
             }
         }
 
         if ($FailedPolicies.Count -eq 0 -and $PassedPolicies.Count -gt 0) {
             $Status = 'Passed'
-            $Result = [System.Text.StringBuilder]::new("All quarantine policies have end-user spam notifications enabled.`n`n")
-            $null = $Result.Append("**Compliant Policies:** $($PassedPolicies.Count)`n`n")
-            $null = $Result.Append("| Policy Name | Notification Frequency (days) |`n")
-            $null = $Result.Append("|------------|-------------------------------|`n")
+            $Result = [System.Text.StringBuilder]::new("The Global Quarantine policy has end-user spam notifications enabled.`n`n")
+            $null = $Result.Append("| Policy Name | Notification Frequency |`n")
+            $null = $Result.Append("|------------|------------------------|`n")
             foreach ($Policy in $PassedPolicies) {
-                $null = $Result.Append("| $($Policy.Identity) | $($Policy.EndUserSpamNotificationFrequency) |`n")
+                $null = $Result.Append("| $($Policy.Identity) | $($Policy.DisplayFrequency) |`n")
             }
-        } elseif ($PassedPolicies.Count -eq 0) {
-            $Status = 'Failed'
-            $Result = [System.Text.StringBuilder]::new("No quarantine policies have end-user spam notifications enabled.`n`n")
         } else {
             $Status = 'Failed'
-            $Result = [System.Text.StringBuilder]::new("$($FailedPolicies.Count) quarantine policies do not have end-user spam notifications enabled.`n`n")
-            $null = $Result.Append("**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n")
+            $Result = [System.Text.StringBuilder]::new("The Global Quarantine policy does not have end-user spam notifications enabled.`n`n")
             $null = $Result.Append("| Policy Name | Notification Frequency |`n")
-            $null = $Result.Append("|------------|----------------------|`n")
+            $null = $Result.Append("|------------|------------------------|`n")
             foreach ($Policy in $FailedPolicies) {
-                $null = $Result.Append("| $($Policy.Identity) | Disabled |`n")
+                $null = $Result.Append("| $($Policy.Identity) | $($Policy.DisplayFrequency) |`n")
             }
+            $null = $Result.Append("`n**Remediation:** Configure the Global Quarantine policy with a notification frequency (e.g. PT4H, P1D, or P7D) via `Set-QuarantinePolicy -EndUserSpamNotificationFrequency`.")
         }
 
         Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA107' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'End-user spam notification is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Quarantine'