From c34b50d5d347d6b95619e1dce62018f060ee79ee Mon Sep 17 00:00:00 2001 From: Nik Charlebois Date: Fri, 28 Jul 2023 12:04:34 -0400 Subject: [PATCH] Fixes #3492 --- CHANGELOG.md | 5 ++ .../MSFT_AADAuthorizationPolicy.psm1 | 71 +++++++++++++------ .../MSFT_AADAuthorizationPolicy.schema.mof | 2 + .../Dependencies/Manifest.psd1 | 2 +- 4 files changed, 58 insertions(+), 22 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7293527291..761e9ff474 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ # UNRELEASED +* AADAuthorizationPolicy + * Added support for the AllowedToCreateTenants & + AllowedToReadBitlockerKeysForOwnedDevice properties. + FIXES [#3492](https://github.com/microsoft/Microsoft365DSC/issues/3492) * AADGroup, AADUser and O365Group * Add support to use function endsWith as filter FIXES [#3518](https://github.com/microsoft/Microsoft365DSC/issues/3518) @@ -24,6 +28,7 @@ FIXES [#3478](https://github.com/microsoft/Microsoft365DSC/issues/3478) * DEPENDENCIES * Updated Microsoft.Graph.* dependencies to version 2.2.0. + * Updated MSCloudLoginAssistant to version 1.0.119. * Updated dependency Microsoft.PowerApps.Administration.PowerShell to version 2.0.170. # 1.23.726.1 diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.psm1 b/Modules/Microsoft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.psm1 index 7bd39d2a47..f78db6224f 100644 --- a/Modules/Microsoft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.psm1 +++ b/Modules/Microsoft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.psm1 @@ -46,6 +46,14 @@ function Get-TargetResource [System.Boolean] $DefaultUserRoleAllowedToCreateSecurityGroups, + [Parameter()] + [System.Boolean] + $DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice, + + [Parameter()] + [System.Boolean] + $DefaultUserRoleAllowedToCreateTenants, + [Parameter()] [System.Boolean] $DefaultUserRoleAllowedToReadOtherUsers, @@ -143,26 +151,28 @@ function Get-TargetResource Write-Verbose -Message 'Get-TargetResource: Found existing authorization policy' $result = @{ - IsSingleInstance = 'Yes' - DisplayName = $Policy.DisplayName - Description = $Policy.Description - AllowedToSignUpEmailBasedSubscriptions = $Policy.AllowedToSignUpEmailBasedSubscriptions - AllowedToUseSSPR = $Policy.AllowedToUseSSPR - AllowEmailVerifiedUsersToJoinOrganization = $Policy.AllowEmailVerifiedUsersToJoinOrganization - AllowInvitesFrom = $Policy.AllowInvitesFrom - BlockMsolPowerShell = $Policy.BlockMsolPowerShell - DefaultUserRoleAllowedToCreateApps = $Policy.DefaultUserRolePermissions.AllowedToCreateApps - DefaultUserRoleAllowedToCreateSecurityGroups = $Policy.DefaultUserRolePermissions.AllowedToCreateSecurityGroups - DefaultUserRoleAllowedToReadOtherUsers = $Policy.DefaultUserRolePermissions.AllowedToReadOtherUsers - PermissionGrantPolicyIdsAssignedToDefaultUserRole = $Policy.DefaultUserRolePermissions.PermissionGrantPoliciesAssigned - GuestUserRole = Get-GuestUserRoleNameFromId -GuestUserRoleId $Policy.GuestUserRoleId - Ensure = 'Present' - Credential = $Credential - ApplicationSecret = $ApplicationSecret - ApplicationId = $ApplicationId - TenantId = $TenantId - CertificateThumbprint = $CertificateThumbprint - Managedidentity = $ManagedIdentity.IsPresent + IsSingleInstance = 'Yes' + DisplayName = $Policy.DisplayName + Description = $Policy.Description + AllowedToSignUpEmailBasedSubscriptions = $Policy.AllowedToSignUpEmailBasedSubscriptions + AllowedToUseSSPR = $Policy.AllowedToUseSSPR + AllowEmailVerifiedUsersToJoinOrganization = $Policy.AllowEmailVerifiedUsersToJoinOrganization + AllowInvitesFrom = $Policy.AllowInvitesFrom + BlockMsolPowerShell = $Policy.BlockMsolPowerShell + DefaultUserRoleAllowedToCreateApps = $Policy.DefaultUserRolePermissions.AllowedToCreateApps + DefaultUserRoleAllowedToCreateSecurityGroups = $Policy.DefaultUserRolePermissions.AllowedToCreateSecurityGroups + DefaultUserRoleAllowedToReadOtherUsers = $Policy.DefaultUserRolePermissions.AllowedToReadOtherUsers + DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice = $Policy.DefaultUserRolePermissions.AllowedToReadBitlockerKeysForOwnedDevice + DefaultUserRoleAllowedToCreateTenants = $Policy.DefaultUserRolePermissions.AllowedToCreateTenants + PermissionGrantPolicyIdsAssignedToDefaultUserRole = $Policy.DefaultUserRolePermissions.PermissionGrantPoliciesAssigned + GuestUserRole = Get-GuestUserRoleNameFromId -GuestUserRoleId $Policy.GuestUserRoleId + Ensure = 'Present' + Credential = $Credential + ApplicationSecret = $ApplicationSecret + ApplicationId = $ApplicationId + TenantId = $TenantId + CertificateThumbprint = $CertificateThumbprint + Managedidentity = $ManagedIdentity.IsPresent } Write-Verbose -Message "Get-TargetResource Result: `n $(Convert-M365DscHashtableToString -Hashtable $result)" @@ -217,6 +227,14 @@ function Set-TargetResource [System.Boolean] $DefaultUserRoleAllowedToCreateSecurityGroups, + [Parameter()] + [System.Boolean] + $DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice, + + [Parameter()] + [System.Boolean] + $DefaultUserRoleAllowedToCreateTenants, + [Parameter()] [System.Boolean] $DefaultUserRoleAllowedToReadOtherUsers, @@ -289,7 +307,9 @@ function Set-TargetResource $currentParameters.Remove('ManagedIdentity') | Out-Null Write-Verbose -Message 'Set-Targetresource: Authorization Policy Ensure Present' - $UpdateParameters = @{} + $UpdateParameters = @{ + AuthorizationPolicyId = 'authorizationPolicy' + } # update policy with supplied parameters that are different from existing policy # prepare object for default user role permissions @@ -361,6 +381,7 @@ function Set-TargetResource -Credential $Credential Write-Verbose -Message "Set-Targetresource: Failed change policy $DisplayName" + Write-Verbose -Message $_ } Write-Verbose -Message "Set-Targetresource: finished processing Policy $Displayname" } @@ -413,6 +434,14 @@ function Test-TargetResource [System.Boolean] $DefaultUserRoleAllowedToCreateSecurityGroups, + [Parameter()] + [System.Boolean] + $DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice, + + [Parameter()] + [System.Boolean] + $DefaultUserRoleAllowedToCreateTenants, + [Parameter()] [System.Boolean] $DefaultUserRoleAllowedToReadOtherUsers, diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.schema.mof b/Modules/Microsoft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.schema.mof index fcfda60048..7df435fcbf 100644 --- a/Modules/Microsoft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.schema.mof +++ b/Modules/Microsoft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.schema.mof @@ -11,6 +11,8 @@ class MSFT_AADAuthorizationPolicy : OMI_BaseResource [Write, Description("Boolean To disable the use of MSOL PowerShell, set this property to true. This will also disable user-based access to the legacy service endpoint used by MSOL PowerShell. This does not affect Azure AD Connect or Microsoft Graph.")] Boolean BlockMsolPowershell; [Write, Description("Boolean Indicates whether the default user role can create applications.")] Boolean DefaultUserRoleAllowedToCreateApps; [Write, Description("Boolean Indicates whether the default user role can create security groups.")] Boolean DefaultUserRoleAllowedToCreateSecurityGroups; + [Write, Description("Indicates whether the registered owners of a device can read their own BitLocker recovery keys with default user role.")] Boolean DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice; + [Write, Description("Indicates whether the default user role can create tenants. This setting corresponds to the Restrict non-admin users from creating tenants setting in the User settings menu in the Azure portal. When this setting is false, users assigned the Tenant Creator role can still create tenants.")] Boolean DefaultUserRoleAllowedToCreateTenants; [Write, Description("Boolean Indicates whether the default user role can read other users.")] Boolean DefaultUserRoleAllowedToReadOtherUsers; [Write, Description("The role that should be granted to guest users. Refer to List unifiedRoleDefinitions to find the list of available role templates. Only supported roles today are User, Guest User, and Restricted Guest User (2af84b1e-32c8-42b7-82bc-daa82404023b)."), ValueMap{"Guest","RestrictedGuest","User"}, Values{"Guest","RestrictedGuest","User"}] String GuestUserRole; [Write, Description("String collection Indicates if user consent to apps is allowed, and if it is, which permission to grant consent and which app consent policy (permissionGrantPolicy) govern the permission for users to grant consent. Value should be in the format managePermissionGrantsForSelf.{id}, where {id} is the id of a built-in or custom app consent policy. An empty list indicates user consent to apps is disabled.")] String PermissionGrantPolicyIdsAssignedToDefaultUserRole[]; diff --git a/Modules/Microsoft365DSC/Dependencies/Manifest.psd1 b/Modules/Microsoft365DSC/Dependencies/Manifest.psd1 index 645d65e6e0..c0a6b8d3a2 100644 --- a/Modules/Microsoft365DSC/Dependencies/Manifest.psd1 +++ b/Modules/Microsoft365DSC/Dependencies/Manifest.psd1 @@ -82,7 +82,7 @@ }, @{ ModuleName = "MSCloudLoginAssistant" - RequiredVersion = "1.0.118" + RequiredVersion = "1.0.119" }, @{ ModuleName = 'PnP.PowerShell'