Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
  marcoandClaude Opus 4.8
|
bd73a9c3b2 | ||
|
marcoandClaude Opus 4.8
|
446c53f409 | ||
|
marcoandClaude Opus 4.8
|
5c60eacc12 | ||
|
marcoandClaude Opus 4.8
|
830dddd15a |
@@ -5,6 +5,76 @@ Versionierung folgt [Semantic Versioning](https://semver.org/lang/de/) — solan
|
||||
|
||||
---
|
||||
|
||||
## [0.1.31] - 2026-09-11
|
||||
|
||||
Policy-Konsolidierung, Geräte-Export nach Gruppe, Gruppen-in-Gruppen, Geräte-Fixes.
|
||||
|
||||
### Neu
|
||||
|
||||
- **Policies zusammenführen** (Settings Catalog): Mehrere Settings-Catalog-Policies zu **einer neuen** Policy vereinen. Gleiche Einstellungen werden einmal übernommen, **Konflikte** (gleiche `settingDefinitionId`, anderer Wert) werden vor dem Anlegen angezeigt und pro Konflikt aufgelöst. Button „Konsolidieren" im Policies-Tab (ab 2 gewählten Settings-Catalog-Policies). Neuer Endpoint `POST /api/policies/consolidate`.
|
||||
- **Geräte nach Gruppe exportieren**: Im **Geräte**-Tab neuer **Gruppen-Filter** (Live-Suche) — die Liste zeigt nur die Geräte der Gruppen-User (inkl. verschachtelter Gruppen) — plus **CSV-Export** der aktuell angezeigten Liste. Kombinierbar mit Suche/OS/Compliance. Neuer Endpoint `GET /api/groups/{id}/devices/export`.
|
||||
- **Gruppen zu Gruppen hinzufügen**: Im Group-Management-Tab „Benutzer | Gruppen hinzufügen" ein Umschalter **Benutzer / Gruppen** — eine bestehende Gruppe als Mitglied (verschachtelte Gruppe) zur gewählten Gruppe hinzufügen.
|
||||
|
||||
### Behoben
|
||||
|
||||
- **Geräte „Invalid Date"**: `lastSyncDateTime`/`enrolledDateTime` werden jetzt server-seitig als ISO 8601 normalisiert (`ConvertTo-IsoDate`) — vorher kam unter PowerShell 5.1 ein nicht parsbares Format an. Anzeige zusätzlich robust (ungültig → „—").
|
||||
- **Geräte-Sortierung**: Die Spalten-Sortierung war komplett wirkungslos (Header-Feldnamen ≠ Item-Properties). Jetzt sortieren alle Spalten korrekt, **Datums-Spalten numerisch** nach Zeitstempel (Klick auf „Letzter Sync" / „Eingeschrieben").
|
||||
|
||||
---
|
||||
|
||||
## [0.1.30] - 2026-09-03
|
||||
|
||||
Policy-Bulk-Import gehärtet, macOS-Apps, Gruppen-Suche & Direkt-Zuweisung an Apps.
|
||||
|
||||
### Neu
|
||||
|
||||
- **Bulk-Import von Policies**: Mehrere Policy-Dateien (oder eine Bundle-Datei) auf einmal importieren. Läuft server-seitig in Batches à 5 mit Fortschrittsanzeige und Fehler-Isolierung pro Batch — umgeht das 180-s-Timeout einzelner Requests.
|
||||
- **macOS-Apps** erscheinen jetzt in App-Liste und -Suche (DMG, PKG, LOB, Defender, Edge, M365, VPP) mit eigenen Typ-Labels. Neuer **Plattform-Filter** (Alle / Windows / macOS).
|
||||
- **Gruppen-Suche** im Ziel-Panel: Der frühere „Abteilung"-Tab heißt jetzt **„Gruppe"** und durchsucht per Live-Suche **alle** Tenant-Gruppen (statt nur Präfix-Gruppen). Auswahl bleibt über mehrere Suchen erhalten.
|
||||
- **Bestehende Gruppe(n) direkt einer App zuweisen**: Im Dialog „Zuweisung hinzufügen" neue Option „Bestehende Gruppe" (Required/Available) mit Gruppensuche und **Mehrfachauswahl** (Chips).
|
||||
|
||||
### Behoben
|
||||
|
||||
- **App-Zuweisung überschrieb bestehende Zuweisungen**: `Add-GraphAppAssignment` nutzte die `/assign`-Action mit nur einer Zuweisung — diese ersetzt aber die komplette Liste. Jetzt werden bestehende Zuweisungen geladen, neue gemergt (Duplikate übersprungen) und in **einem** Request geschickt. Behebt sowohl die Mehrfach-Zuweisung als auch stillen Verlust vorhandener Zuweisungen beim Einzel-Hinzufügen.
|
||||
- **Policy-Export/-Import-Treue** (Windows PowerShell 5.1): Policy-Details werden als **rohes JSON** von Graph geholt (`-OutputType Json`), sonst skalarisierte der Hashtable-Modus Ein-Element-Collections (z. B. `printerNames`) → 400 beim Re-Import.
|
||||
- **Configuration-Profile-Import**: `null`-Werte für nicht-nullbare Collections werden entfernt (400 `ModelValidationFailure`).
|
||||
- **Settings-Catalog-Import**: Reparatur leerer/verstümmelter Collections (`[""]`, `{}`), Rettung stringifizierter `*TemplateReference`-Felder und **klarer Abbruch** bei irreparabel beschädigten Quelldateien (alte Exporte mit zu geringer JSON-Tiefe).
|
||||
- **Git-Snapshot**: `git` wird jetzt auch über bekannte Installationsorte gefunden, falls es nicht im (veralteten) PATH des Server-Prozesses liegt.
|
||||
|
||||
---
|
||||
|
||||
## [0.1.29] - 2026-08-24
|
||||
|
||||
Geräte-Offboarding (v1).
|
||||
|
||||
### Neu
|
||||
|
||||
- **Geräte-Offboarding** als neue Ansicht: Geräte über **Intune, Autopilot und Entra ID** hinweg entfernen (Decommissioning). Portiert aus dem [Device Offboarding Manager](https://github.com/ugurkocde/DeviceOffboardingManager) von Ugur Koc (MIT-Lizenz).
|
||||
- Suche per Gerätename/Seriennummer, Auflösung der IDs über alle drei Dienste (`$batch`)
|
||||
- **Recovery-Keys vor dem Löschen**: BitLocker/FileVault und LAPS-Passwörter werden angezeigt
|
||||
- Bestätigungs-Dialog mit Dienst-Auswahl (Entra löschen/deaktivieren, Intune, Autopilot), Pflicht-Bestätigung und Ergebnis-Liste; **403/Multi-Admin-Approval** wird abgefangen
|
||||
- Im **Read-Only-Modus gesperrt**
|
||||
- Neue Endpoints: `GET /api/offboard/search`, `POST /api/offboard/keys`, `POST /api/offboard/execute` (neues Modul `src/Offboard.ps1`)
|
||||
- Zusätzliche Berechtigungen dokumentiert; Setup-Skript-Schalter `-IncludeOffboarding`. (MDE-Offboarding bewusst nicht in v1.)
|
||||
|
||||
---
|
||||
|
||||
## [0.1.28] - 2026-08-24
|
||||
|
||||
Umbenennen beim Import, UI-Fixes, Geräte-Export repariert.
|
||||
|
||||
### Neu
|
||||
|
||||
- **Umbenennen beim Import**: Vor dem Anlegen kann jeder importierten Policy im neuen Dialog „Policies importieren" ein anderer Name gegeben werden (das richtige Namensfeld je Typ — `name`/`displayName` — wird gesetzt).
|
||||
|
||||
### Behoben
|
||||
|
||||
- **Geräte-Export im App Report**: Der von Graph entfernte synchrone Endpoint `getDeviceInstallStatusReport` (400 „Resource not found for the segment") ist durch den asynchronen Export-Job **`DeviceInstallStatusByApp`** ersetzt (ZIP/CSV-Auswertung, tolerantes Spalten-Mapping). ZIP/CSV-Logik in `Get-IntuneReportRows` ausgelagert.
|
||||
- **Darkmode-Kontrast** im Zuweisungs-Dialog: Gruppen-Chips nutzen jetzt die Theme-Variablen (`--surface-strong`/`--ink` statt fester heller Farben) — heller Text auf hellem Chip behoben.
|
||||
- **Dialog-Breite**: Lange Policy-Namen im Zuweisungs-/Import-Dialog brechen jetzt um (`overflow-wrap`/`flex-wrap`) statt horizontal zu scrollen; das Fenster passt sich der Breite an.
|
||||
|
||||
---
|
||||
|
||||
## [0.1.27] - 2026-08-23
|
||||
|
||||
Policy-Import härter, Administrative Vorlagen, Zuweisung nach Import, Git-Snapshot, App-Registrierungs-Doku.
|
||||
|
||||
@@ -90,7 +90,7 @@ Schlaegt diese fehl, wird automatisch auf die **Read-Only-App-ID** (`clientIdRo`
|
||||
|
||||
- App-Zuweisung (Required / Available hinzufuegen und entfernen)
|
||||
- Gruppen erstellen und loeschen
|
||||
- Tab „Benutzer hinzufuegen" im Group Management
|
||||
- Tab „Benutzer | Gruppen hinzufuegen" im Group Management
|
||||
- Tab „CSV-Import" im Group Management
|
||||
- Session-Ausfuehren-Button
|
||||
- Alle Rename-/Delete-Buttons
|
||||
@@ -132,10 +132,10 @@ App-Registrierung automatisch anlegt/konfiguriert:**
|
||||
| Tab | Beschreibung |
|
||||
|--------------------|-------------------------------------------------------------|
|
||||
| App Management | Haupt-Ansicht: Apps laden, Gruppen zuweisen / entfernen |
|
||||
| Group Management | Mitglieder anzeigen, exportieren, Benutzer hinzufuegen, CSV-Import |
|
||||
| Group Management | Mitglieder anzeigen/exportieren, Benutzer **und Gruppen** hinzufuegen, CSV-Import |
|
||||
| App Report | Installationszaehler pro App, Geraete-Export als CSV |
|
||||
| Geräte | Geraete suchen, Detail-Panel, Aktionen (Sync, Wipe, …) |
|
||||
| Policies | Policies exportieren (JSON-Download) und importieren (Neuanlage) |
|
||||
| Geräte | Geraete suchen, Filter (auch nach **Gruppe**), CSV-Export, Detail-Panel, Aktionen (Sync, Wipe, …) |
|
||||
| Policies | Policies exportieren/importieren (Neuanlage) und **zusammenfuehren** (Settings Catalog) |
|
||||
|
||||
---
|
||||
|
||||
@@ -148,10 +148,11 @@ App-Registrierung automatisch anlegt/konfiguriert:**
|
||||
- Filter zum Einschraenken der Anzeige
|
||||
- **Als CSV exportieren** laedt alle Mitglieder als `members-<Gruppe>-<Datum>.csv`
|
||||
|
||||
### Benutzer hinzufuegen *(nur Read/Write)*
|
||||
### Benutzer | Gruppen hinzufuegen *(nur Read/Write)*
|
||||
|
||||
- Benutzer per Name, UPN oder E-Mail suchen
|
||||
- Mehrere Benutzer auswaehlen und gemeinsam hinzufuegen
|
||||
- Umschalter **Benutzer / Gruppen** oben im Tab
|
||||
- Benutzer per Name, UPN oder E-Mail suchen — oder Gruppen per Name (verschachtelte Gruppen)
|
||||
- Mehrere Eintraege auswaehlen und gemeinsam zur gewaehlten Gruppe hinzufuegen
|
||||
|
||||
### CSV-Import *(nur Read/Write)*
|
||||
|
||||
@@ -235,6 +236,16 @@ neu an. Unterstuetzte Typen:
|
||||
> bekommen bei Bedarf einen Default-`scheduledActionsForRule`-Block, den Graph
|
||||
> beim Anlegen zwingend verlangt.
|
||||
|
||||
### Konsolidieren *(nur Read/Write, nur Settings Catalog)*
|
||||
|
||||
- Mindestens zwei **Settings-Catalog**-Policies per Checkbox waehlen →
|
||||
**„Konsolidieren"**
|
||||
- Die Einstellungen werden zu **einer neuen** Policy vereint (Neuanlage) — gleiche
|
||||
`settingDefinitionId` mit gleichem Wert wird einmal uebernommen
|
||||
- **Konflikte** (gleiche Einstellung, unterschiedlicher Wert) werden vor dem
|
||||
Anlegen angezeigt; pro Konflikt waehlst du, welche Policy gewinnt
|
||||
- Voraussetzung: gleiche Plattform. Zuweisungen werden nicht uebernommen.
|
||||
|
||||
### Benoetigt Graph-Berechtigung
|
||||
|
||||
`DeviceManagementConfiguration.ReadWrite.All` (Import) bzw.
|
||||
@@ -295,8 +306,9 @@ Intune Manager/
|
||||
| POST | `/api/groups/resolve-upns` | Read | UPN-Liste → UserId + DisplayName |
|
||||
| GET | `/api/groups/{id}/members` | Read | Mitglieder einer Gruppe |
|
||||
| GET | `/api/groups/{id}/members/export` | Read | Mitglieder als CSV |
|
||||
| POST | `/api/groups/{id}/members` | **Write** | Benutzer zur Gruppe hinzufuegen |
|
||||
| DELETE | `/api/groups/{id}/members/{uid}` | **Write** | Benutzer aus Gruppe entfernen |
|
||||
| POST | `/api/groups/{id}/members` | **Write** | Benutzer/Gruppen zur Gruppe hinzufuegen |
|
||||
| DELETE | `/api/groups/{id}/members/{uid}` | **Write** | Benutzer/Gruppe aus Gruppe entfernen |
|
||||
| GET | `/api/groups/{id}/devices/export` | Read+MDM | Geraete der Gruppen-User als CSV |
|
||||
| GET | `/api/users?q=` | Read | Benutzer suchen |
|
||||
| GET | `/api/apps` | Read | Apps laden (cached) |
|
||||
| POST | `/api/apps/refresh` | Read | Apps neu laden |
|
||||
@@ -311,6 +323,7 @@ Intune Manager/
|
||||
| POST | `/api/policies/export` | Read+Cfg | Ausgewaehlte Policies als JSON exportieren |
|
||||
| GET | `/api/policies/exports` | — | Server-Archiv der Exporte auflisten |
|
||||
| POST | `/api/policies/import` | **Write** | Policies als Neuanlage importieren |
|
||||
| POST | `/api/policies/consolidate` | **Write** | Settings-Catalog-Policies zusammenfuehren |
|
||||
|
||||
> **Read+MDM** = benoetigt zusaetzlich `DeviceManagementManagedDevices.Read.All`
|
||||
> **Read+Cfg** = benoetigt `DeviceManagementConfiguration.Read.All` (Export) bzw. `.ReadWrite.All` (Import)
|
||||
|
||||
@@ -137,6 +137,7 @@ if (-not $SkipModuleCheck) {
|
||||
. (Join-Path $root "src/Graph.ps1")
|
||||
. (Join-Path $root "src/Api.ps1")
|
||||
. (Join-Path $root "src/PolicyIO.ps1")
|
||||
. (Join-Path $root "src/Offboard.ps1")
|
||||
. (Join-Path $root "src/Router.ps1")
|
||||
. (Join-Path $root "src/Server.ps1")
|
||||
|
||||
@@ -188,7 +189,7 @@ $script:State = [pscustomobject]@{
|
||||
Session = @() # geplante Zuweisungen
|
||||
}
|
||||
|
||||
$script:ToolVersion = "0.1.27"
|
||||
$script:ToolVersion = "0.1.31"
|
||||
$script:BuildStamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
|
||||
|
||||
Write-Host ""
|
||||
|
||||
@@ -42,6 +42,26 @@ Nur nötig, wenn der **Geräte-Tab** (Sync/Reboot/Lock/Diagnose/Wipe/Retire) gen
|
||||
| `DeviceManagementManagedDevices.ReadWrite.All` | Sync, Neustart, Remote-Lock, Diagnose, BitLocker-Key-Rotation |
|
||||
| `DeviceManagementManagedDevices.PrivilegedOperations.All` | Wipe, Retire, Autopilot-Reset |
|
||||
|
||||
### Geräte-Offboarding (optional)
|
||||
|
||||
Nur nötig, wenn die **Offboarding**-Ansicht (Geräte aus Intune + Autopilot + Entra
|
||||
entfernen, Recovery-Keys lesen) genutzt wird:
|
||||
|
||||
| Berechtigung | Wofür |
|
||||
|---|---|
|
||||
| `Device.ReadWrite.All` | Gerät aus Entra ID löschen/deaktivieren |
|
||||
| `DeviceManagementManagedDevices.ReadWrite.All` | Gerät aus Intune löschen |
|
||||
| `DeviceManagementServiceConfig.ReadWrite.All` | Gerät aus Autopilot löschen |
|
||||
| `BitlockerKey.Read.All` | BitLocker-Recovery-Keys lesen |
|
||||
| `DeviceLocalCredential.Read.All` | LAPS-Passwörter lesen |
|
||||
|
||||
> **Wichtig:** Löschen aus Entra/Intune/Autopilot benötigt bei delegierter
|
||||
> Anmeldung zusätzlich **Verzeichnis-/Intune-Rollen** (Cloud Device Administrator
|
||||
> bzw. Intune Administrator) — die Scopes allein reichen nicht, sonst `403`.
|
||||
> Diese Scopes müssen außerdem in den **Read/Write-Scopes** des Tools eingetragen
|
||||
> sein (Einstellungen → Verbindung), damit sie im Token landen.
|
||||
> Skript: `.\docs\Setup-AppRegistration.ps1 -IncludeOffboarding -GrantAdminConsent`
|
||||
|
||||
### Read-Only-Variante
|
||||
|
||||
Für eine reine Anzeige-App (im Tool als `clientIdRo` hinterlegbar) genügen die
|
||||
|
||||
@@ -61,6 +61,7 @@ param(
|
||||
[switch]$MultiTenant,
|
||||
[switch]$ReadOnly,
|
||||
[switch]$IncludeDeviceActions,
|
||||
[switch]$IncludeOffboarding,
|
||||
[switch]$GrantAdminConsent,
|
||||
[switch]$EmitManifest
|
||||
)
|
||||
@@ -85,6 +86,18 @@ if ($IncludeDeviceActions) {
|
||||
'DeviceManagementManagedDevices.PrivilegedOperations.All')
|
||||
}
|
||||
}
|
||||
if ($IncludeOffboarding) {
|
||||
# Geraete ueber Intune/Autopilot/Entra entfernen + Recovery-Keys lesen.
|
||||
# ACHTUNG: Loeschen braucht zusaetzlich Verzeichnis-/Intune-ROLLEN (Cloud
|
||||
# Device Administrator / Intune Administrator) — nicht nur diese Scopes.
|
||||
$perms += @(
|
||||
'Device.ReadWrite.All',
|
||||
'DeviceManagementManagedDevices.ReadWrite.All',
|
||||
'DeviceManagementServiceConfig.ReadWrite.All',
|
||||
'BitlockerKey.Read.All',
|
||||
'DeviceLocalCredential.Read.All'
|
||||
)
|
||||
}
|
||||
$perms = $perms | Select-Object -Unique
|
||||
|
||||
# --- Verbinden ----------------------------------------------------------------
|
||||
|
||||
@@ -12,7 +12,7 @@ if (Test-Path "$x64Dotnet\dotnet.exe") {
|
||||
$env:DOTNET_ROOT = "C:\Program Files\dotnet"
|
||||
}
|
||||
|
||||
$version = "0.1.27"
|
||||
$version = "0.1.31"
|
||||
$src = "\\Mac\Home\ClaudePRJ\Intune Manager"
|
||||
$stage = "$env:TEMP\IntuneManagerStage"
|
||||
$installerDir = "$src\installer"
|
||||
|
||||
+242
-88
@@ -58,8 +58,13 @@ function Invoke-ApiHandler {
|
||||
"GET /api/policies/exports" { return Get-PolicyExportsEndpoint }
|
||||
"POST /api/policies/import" { return Import-PoliciesEndpoint -Body $Body }
|
||||
"POST /api/policies/assign" { return Invoke-PolicyAssignEndpoint -Body $Body }
|
||||
"POST /api/policies/consolidate" { return Invoke-PolicyConsolidateEndpoint -Body $Body }
|
||||
"POST /api/policies/git-snapshot" { return Invoke-PolicyGitSnapshotEndpoint }
|
||||
"POST /api/pickfolder" { return Invoke-FolderPickerEndpoint -Body $Body }
|
||||
|
||||
"GET /api/offboard/search" { return Search-OffboardDevicesEndpoint -Query $Query }
|
||||
"POST /api/offboard/keys" { return Get-OffboardKeysEndpoint -Body $Body }
|
||||
"POST /api/offboard/execute" { return Invoke-OffboardExecuteEndpoint -Body $Body }
|
||||
}
|
||||
|
||||
# 2-segment fallbacks (z.B. /api/groups/<id>/members)
|
||||
@@ -67,6 +72,9 @@ function Invoke-ApiHandler {
|
||||
if ($Method -eq "GET" -and $Path -match "^/api/groups/([^/]+)/members/export$") {
|
||||
return Get-GroupMembersExportEndpoint -GroupId $matches[1]
|
||||
}
|
||||
if ($Method -eq "GET" -and $Path -match "^/api/groups/([^/]+)/devices/export$") {
|
||||
return Get-GroupDevicesExportEndpoint -GroupId $matches[1]
|
||||
}
|
||||
|
||||
if ($Method -eq "GET" -and $Path -match "^/api/groups/([^/]+)/members$") {
|
||||
return Get-GroupMembersEndpoint -GroupId $matches[1]
|
||||
@@ -1604,6 +1612,117 @@ function Get-GroupMembersExportEndpoint {
|
||||
}
|
||||
}
|
||||
|
||||
function Get-GroupDevicesExportEndpoint {
|
||||
# Loest die User einer Gruppe (inkl. verschachtelter Untergruppen) auf und liefert
|
||||
# deren Intune-Geraete (Geraete, deren PRIMAERER Benutzer in der Gruppe ist) fuer
|
||||
# einen CSV-Export. Geraete werden per $batch ueber userId eq '<id>' geholt.
|
||||
param([string]$GroupId)
|
||||
$err = Test-Connected
|
||||
if ($err) { return $err }
|
||||
if ([string]::IsNullOrWhiteSpace($GroupId)) { return @{ __status = 400; error = "GroupId fehlt" } }
|
||||
|
||||
$groupName = $GroupId
|
||||
try {
|
||||
$g = Get-GraphGroupById -Id $GroupId -Property @("id","displayName")
|
||||
if ($g.displayName) { $groupName = [string]$g.displayName }
|
||||
} catch {
|
||||
return @{ __status = 404; error = "Gruppe nicht gefunden: $($_.Exception.Message)" }
|
||||
}
|
||||
|
||||
Write-Host "[GRP-DEV-EXPORT] Geraete-Export fuer Gruppe '$groupName' ($GroupId)" -ForegroundColor Cyan
|
||||
$sw = [System.Diagnostics.Stopwatch]::StartNew()
|
||||
|
||||
# User aufloesen + deduplizieren (nur eindeutige Entra-User-Ids)
|
||||
$allUsers = @(Resolve-GroupMembersWithNesting -GroupId $GroupId -GroupName $groupName)
|
||||
$seen = @{}
|
||||
$userIds = [System.Collections.Generic.List[string]]::new()
|
||||
$userMap = @{} # userId -> @{ Upn; DisplayName } (aus den Gruppen-Mitgliedern)
|
||||
foreach ($u in $allUsers) {
|
||||
$uid = [string]$u.Id
|
||||
if ($uid -and -not $seen.ContainsKey($uid)) {
|
||||
$seen[$uid] = $true
|
||||
$userIds.Add($uid)
|
||||
$userMap[$uid] = @{ Upn = [string]$u.UserPrincipalName; DisplayName = [string]$u.DisplayName }
|
||||
}
|
||||
}
|
||||
if ($userIds.Count -eq 0) {
|
||||
return @{ ok = $true; groupId = $GroupId; groupName = $groupName; userCount = 0; items = @(); count = 0; resolvedMs = [int]$sw.ElapsedMilliseconds }
|
||||
}
|
||||
|
||||
$select = 'id,deviceName,userDisplayName,userPrincipalName,operatingSystem,osVersion,complianceState,serialNumber,model,manufacturer,lastSyncDateTime,enrolledDateTime'
|
||||
$batchSize = 20
|
||||
$devSeen = @{}
|
||||
$items = [System.Collections.Generic.List[object]]::new()
|
||||
$ids = $userIds.ToArray()
|
||||
$script:GrpDevErrors = @()
|
||||
|
||||
for ($i = 0; $i -lt $ids.Count; $i += $batchSize) {
|
||||
$chunk = $ids[$i .. [Math]::Min($i + $batchSize - 1, $ids.Count - 1)]
|
||||
$requests = @()
|
||||
for ($j = 0; $j -lt $chunk.Count; $j++) {
|
||||
# Kanonischer Weg: die managedDevices-Navigation des Users. Zuverlaessiger
|
||||
# als $filter=userId eq '..' auf /deviceManagement/managedDevices.
|
||||
$requests += @{ id = [string]($i + $j); method = 'GET'; url = "/users/$($chunk[$j])/managedDevices?`$select=$select" }
|
||||
}
|
||||
$body = @{ requests = $requests } | ConvertTo-Json -Depth 5 -Compress
|
||||
try {
|
||||
$resp = Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/$batch' -Method POST -Body $body -ContentType 'application/json'
|
||||
foreach ($r in @($resp.responses)) {
|
||||
if ([int]$r.status -ne 200) {
|
||||
if (@($script:GrpDevErrors).Count -lt 3) {
|
||||
$em = $null
|
||||
try { $em = [string]$r.body.error.message } catch {}
|
||||
$script:GrpDevErrors += "HTTP $($r.status)$(if ($em) { ": $em" })"
|
||||
}
|
||||
continue
|
||||
}
|
||||
# Batch-Request-Id -> Index in $ids -> Gruppen-User (fuer UPN/Name-Fallback,
|
||||
# da managedDevice.userPrincipalName bei Graph oft leer ist).
|
||||
$owner = $null
|
||||
$reqIdx = -1; if ([int]::TryParse([string]$r.id, [ref]$reqIdx)) {
|
||||
if ($reqIdx -ge 0 -and $reqIdx -lt $ids.Count) { $owner = $userMap[$ids[$reqIdx]] }
|
||||
}
|
||||
foreach ($d in @($r.body.value)) {
|
||||
$did = [string]$d.id
|
||||
if (-not $did -or $devSeen.ContainsKey($did)) { continue }
|
||||
$devSeen[$did] = $true
|
||||
$upn = if ($d.userPrincipalName) { [string]$d.userPrincipalName } elseif ($owner) { $owner.Upn } else { '' }
|
||||
$udn = if ($d.userDisplayName) { [string]$d.userDisplayName } elseif ($owner) { $owner.DisplayName } else { '' }
|
||||
$items.Add([pscustomobject]@{
|
||||
Id = $did
|
||||
DeviceName = [string]$d.deviceName
|
||||
UserDisplayName = $udn
|
||||
UserPrincipalName = $upn
|
||||
OS = [string]$d.operatingSystem
|
||||
OSVersion = [string]$d.osVersion
|
||||
ComplianceState = [string]$d.complianceState
|
||||
SerialNumber = [string]$d.serialNumber
|
||||
Model = [string]$d.model
|
||||
Manufacturer = [string]$d.manufacturer
|
||||
LastSync = ConvertTo-IsoDate $d.lastSyncDateTime
|
||||
EnrolledDateTime = ConvertTo-IsoDate $d.enrolledDateTime
|
||||
})
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
Write-Host " [GRP-DEV-EXPORT] Batch-Fehler: $($_.Exception.Message)" -ForegroundColor DarkYellow
|
||||
}
|
||||
}
|
||||
|
||||
$sw.Stop()
|
||||
Write-Host " -> $($items.Count) Geraete fuer $($userIds.Count) User, $($sw.ElapsedMilliseconds)ms" -ForegroundColor Green
|
||||
return @{
|
||||
ok = $true
|
||||
groupId = $GroupId
|
||||
groupName = $groupName
|
||||
userCount = $userIds.Count
|
||||
items = @($items.ToArray())
|
||||
count = $items.Count
|
||||
resolvedMs = [int]$sw.ElapsedMilliseconds
|
||||
errors = @($script:GrpDevErrors)
|
||||
}
|
||||
}
|
||||
|
||||
# ============================================================
|
||||
# Users
|
||||
# ============================================================
|
||||
@@ -1724,12 +1843,12 @@ function Search-DevicesEndpoint {
|
||||
OS = $d.operatingSystem
|
||||
OSVersion = $d.osVersion
|
||||
ComplianceState = $d.complianceState
|
||||
LastSync = $d.lastSyncDateTime
|
||||
LastSync = ConvertTo-IsoDate $d.lastSyncDateTime
|
||||
ManagementState = $d.managementState
|
||||
SerialNumber = $d.serialNumber
|
||||
Model = $d.model
|
||||
Manufacturer = $d.manufacturer
|
||||
EnrolledDateTime = $d.enrolledDateTime
|
||||
EnrolledDateTime = ConvertTo-IsoDate $d.enrolledDateTime
|
||||
}
|
||||
}
|
||||
return @{ items = $items; count = $items.Count }
|
||||
@@ -1754,12 +1873,12 @@ function Get-DeviceEndpoint {
|
||||
OS = $d.operatingSystem
|
||||
OSVersion = $d.osVersion
|
||||
ComplianceState = $d.complianceState
|
||||
LastSync = $d.lastSyncDateTime
|
||||
LastSync = ConvertTo-IsoDate $d.lastSyncDateTime
|
||||
ManagementState = $d.managementState
|
||||
SerialNumber = $d.serialNumber
|
||||
Model = $d.model
|
||||
Manufacturer = $d.manufacturer
|
||||
EnrolledDateTime = $d.enrolledDateTime
|
||||
EnrolledDateTime = ConvertTo-IsoDate $d.enrolledDateTime
|
||||
Imei = $d.imei
|
||||
WiFiMac = $d.wiFiMacAddress
|
||||
AzureADDeviceId = $d.azureADDeviceId
|
||||
@@ -1995,8 +2114,49 @@ function Get-AppInstallReportEndpoint {
|
||||
return @{ items = $items; count = $items.Count }
|
||||
}
|
||||
|
||||
# Intune-Report via asynchronem Export-Job (exportJobs) -> CSV-Zeilen.
|
||||
# Kein 'select' (unbekannte Spalten wuerden 400 ausloesen) — der Aufrufer
|
||||
# greift tolerant auf die tatsaechlich gelieferten Spalten zu.
|
||||
function Get-IntuneReportRows {
|
||||
param(
|
||||
[Parameter(Mandatory=$true)][string]$ReportName,
|
||||
[string]$Filter = '',
|
||||
[int]$TimeoutSec = 120
|
||||
)
|
||||
$jobBody = @{ reportName = $ReportName; filter = $Filter } | ConvertTo-Json -Compress
|
||||
$job = Invoke-MgGraphRequestRetry `
|
||||
-Uri 'https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs' `
|
||||
-Method POST -Body $jobBody -ContentType 'application/json'
|
||||
$jobId = $job.id
|
||||
$status = $job.status
|
||||
$waited = 0
|
||||
while ($status -ne 'completed' -and $status -ne 'failed' -and $waited -lt $TimeoutSec) {
|
||||
Start-Sleep -Seconds 3
|
||||
$waited += 3
|
||||
$job = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs/$jobId"
|
||||
$status = $job.status
|
||||
}
|
||||
if ($status -ne 'completed') { throw "Export-Job '$ReportName' nicht abgeschlossen (Status: $status nach $waited s)" }
|
||||
|
||||
$tmpZip = [System.IO.Path]::GetTempFileName() + '.zip'
|
||||
$tmpDir = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), "IntuneReport_$jobId")
|
||||
try {
|
||||
Invoke-WebRequest -Uri $job.url -OutFile $tmpZip -UseBasicParsing
|
||||
Add-Type -AssemblyName System.IO.Compression.FileSystem
|
||||
[System.IO.Compression.ZipFile]::ExtractToDirectory($tmpZip, $tmpDir)
|
||||
$csv = Get-ChildItem -Path $tmpDir -Filter '*.csv' | Select-Object -First 1
|
||||
if (-not $csv) { throw "Keine CSV im Export-ZIP gefunden" }
|
||||
return @(Import-Csv -Path $csv.FullName -Encoding UTF8)
|
||||
} finally {
|
||||
Remove-Item -Path $tmpZip -Force -ErrorAction SilentlyContinue
|
||||
Remove-Item -Path $tmpDir -Recurse -Force -ErrorAction SilentlyContinue
|
||||
}
|
||||
}
|
||||
|
||||
function Get-AppDeviceStatusEndpoint {
|
||||
# Verwendet getDeviceInstallStatusReport (synchron, paginiert) statt deviceStatuses.
|
||||
# Per-Device-Installationsstatus einer App via Export-Job 'DeviceInstallStatusByApp'.
|
||||
# (Der frueher genutzte synchrone Endpoint getDeviceInstallStatusReport existiert
|
||||
# nicht mehr -> 400 "Resource not found for the segment".)
|
||||
param([hashtable]$Query)
|
||||
$err = Test-Connected
|
||||
if ($err) { return $err }
|
||||
@@ -2006,58 +2166,38 @@ function Get-AppDeviceStatusEndpoint {
|
||||
return @{ __status = 400; error = "appId fehlt" }
|
||||
}
|
||||
|
||||
Write-Host "[DEVSTATUS] Lade Install-Status fuer App $appId via Reports-API..." -ForegroundColor DarkCyan
|
||||
$pageSize = 50
|
||||
$skip = 0
|
||||
$allRows = @()
|
||||
$cols = $null
|
||||
|
||||
do {
|
||||
$bodyJson = "{""filter"":""(ApplicationId eq '$appId')"",""select"":[],""skip"":$skip,""top"":$pageSize,""orderBy"":[]}"
|
||||
try {
|
||||
$resp = Invoke-MgGraphRequestRetry `
|
||||
-Uri 'https://graph.microsoft.com/beta/deviceManagement/reports/getDeviceInstallStatusReport' `
|
||||
-Method POST -Body $bodyJson -ContentType 'application/json'
|
||||
} catch {
|
||||
return @{ __status = 500; error = "Graph-Fehler: $($_.Exception.Message)" }
|
||||
}
|
||||
|
||||
if (-not $cols) {
|
||||
$cols = @($resp.Schema | ForEach-Object { $_.Column })
|
||||
Write-Host " [DEVSTATUS] Spalten: $($cols -join ',')" -ForegroundColor DarkGray
|
||||
}
|
||||
$rows = @($resp.Values)
|
||||
$allRows += $rows
|
||||
$skip += $pageSize
|
||||
} while ($rows.Count -eq $pageSize)
|
||||
|
||||
Write-Host " -> $($allRows.Count) Eintraege" -ForegroundColor DarkGray
|
||||
|
||||
if (-not $cols -or $allRows.Count -eq 0) {
|
||||
return @{ items = @(); count = 0 }
|
||||
Write-Host "[DEVSTATUS] Export-Job (DeviceInstallStatusByApp) fuer App $appId..." -ForegroundColor DarkCyan
|
||||
try {
|
||||
$rows = @(Get-IntuneReportRows -ReportName 'DeviceInstallStatusByApp' -Filter "(ApplicationId eq '$appId')")
|
||||
} catch {
|
||||
$msg = $_.Exception.Message
|
||||
try { if ($_.ErrorDetails.Message) { $msg = $_.ErrorDetails.Message } } catch {}
|
||||
return @{ __status = 500; error = "Graph-Fehler: $msg" }
|
||||
}
|
||||
Write-Host " -> $($rows.Count) Eintraege" -ForegroundColor DarkGray
|
||||
if ($rows.Count -eq 0) { return @{ items = @(); count = 0 } }
|
||||
|
||||
function ColIdx($name) { [Array]::IndexOf($cols, $name) }
|
||||
$iDevice = ColIdx 'DeviceName'
|
||||
$iUser = ColIdx 'UserName'
|
||||
$iState = ColIdx 'InstallState'
|
||||
$iDetail = ColIdx 'InstallStateDetail'
|
||||
$iErr = ColIdx 'ErrorCode'
|
||||
$iOs = ColIdx 'OSVersion'
|
||||
$iSync = ColIdx 'LastModifiedDateTime'
|
||||
if ($iOs -lt 0) { $iOs = ColIdx 'OsVersion' }
|
||||
if ($iSync -lt 0) { $iSync = ColIdx 'LastSyncDateTime' }
|
||||
Write-Host " [DEVSTATUS] Spalten: $(($rows[0].PSObject.Properties.Name) -join ',')" -ForegroundColor DarkGray
|
||||
|
||||
$result = @($allRows | ForEach-Object {
|
||||
# Spaltennamen des Reports koennen variieren -> tolerant mit Fallbacks lesen.
|
||||
$col = {
|
||||
param($row, [string[]]$names)
|
||||
foreach ($n in $names) {
|
||||
$p = $row.PSObject.Properties[$n]
|
||||
if ($p -and $null -ne $p.Value -and [string]$p.Value -ne '') { return [string]$p.Value }
|
||||
}
|
||||
return ''
|
||||
}
|
||||
$result = @($rows | ForEach-Object {
|
||||
$r = $_
|
||||
[pscustomobject]@{
|
||||
DeviceName = if ($iDevice -ge 0) { [string]$r[$iDevice] } else { '' }
|
||||
UserName = if ($iUser -ge 0) { [string]$r[$iUser] } else { '' }
|
||||
InstallState = if ($iState -ge 0) { [string]$r[$iState] } else { '' }
|
||||
InstallStateDetail = if ($iDetail -ge 0) { [string]$r[$iDetail] } else { '' }
|
||||
ErrorCode = if ($iErr -ge 0) { [string]$r[$iErr] } else { '' }
|
||||
OsVersion = if ($iOs -ge 0) { [string]$r[$iOs] } else { '' }
|
||||
LastSyncDateTime = if ($iSync -ge 0) { [string]$r[$iSync] } else { '' }
|
||||
DeviceName = & $col $r @('DeviceName')
|
||||
UserName = & $col $r @('UserName','UserPrincipalName')
|
||||
InstallState = & $col $r @('InstallState_loc','InstallState','AppInstallState_loc','AppInstallState')
|
||||
InstallStateDetail = & $col $r @('InstallStateDetail_loc','InstallStateDetail','AppInstallStateDetail_loc','AppInstallStateDetail')
|
||||
ErrorCode = & $col $r @('ErrorCode','HexErrorCode')
|
||||
OsVersion = & $col $r @('OSVersion','OsVersion','Platform')
|
||||
LastSyncDateTime = & $col $r @('LastModifiedDateTime','LastSyncDateTime')
|
||||
}
|
||||
})
|
||||
|
||||
@@ -2780,23 +2920,29 @@ function Add-AppAssignmentEndpoint {
|
||||
if ($intent -notin @("required","available")) {
|
||||
return @{ __status = 400; error = "intent muss 'required' oder 'available' sein" }
|
||||
}
|
||||
$target = [string]$Body.target
|
||||
if ([string]::IsNullOrWhiteSpace($target)) {
|
||||
return @{ __status = 400; error = "target fehlt (ALL_USERS / ALL_DEVICES / <group-guid>)" }
|
||||
# Ein ODER mehrere Ziele akzeptieren: 'targets' (Array) hat Vorrang, sonst 'target'.
|
||||
$targets = @()
|
||||
if ($Body.targets) { $targets = @($Body.targets | ForEach-Object { [string]$_ }) }
|
||||
elseif ($Body.target) { $targets = @([string]$Body.target) }
|
||||
$targets = @($targets | Where-Object { $_ -and $_.Trim() })
|
||||
if ($targets.Count -eq 0) {
|
||||
return @{ __status = 400; error = "target/targets fehlt (ALL_USERS / ALL_DEVICES / <group-guid>)" }
|
||||
}
|
||||
# Bei Group-Target: zumindest grobe Hex/GUID-Form pruefen damit wir keine
|
||||
# Garbage an Graph schicken.
|
||||
if ($target -notin @("ALL_USERS","ALL_DEVICES") -and $target -notmatch '^[0-9a-fA-F-]{8,}$') {
|
||||
return @{ __status = 400; error = "Ungueltige target-GUID: $target" }
|
||||
# Jedes Group-Target grob auf Hex/GUID-Form pruefen (keine Garbage an Graph).
|
||||
foreach ($t in $targets) {
|
||||
if ($t -notin @("ALL_USERS","ALL_DEVICES") -and $t -notmatch '^[0-9a-fA-F-]{8,}$') {
|
||||
return @{ __status = 400; error = "Ungueltige target-GUID: $t" }
|
||||
}
|
||||
}
|
||||
|
||||
# App-Cache fuer logging
|
||||
$cachedApp = $script:State.Apps | Where-Object { $_.AppId -eq $AppId } | Select-Object -First 1
|
||||
$appName = if ($cachedApp) { $cachedApp.AppName } else { $AppId }
|
||||
|
||||
Write-Host "[ADD ASSIGN] $appName -> intent=$intent target=$target" -ForegroundColor Yellow
|
||||
Write-Host "[ADD ASSIGN] $appName -> intent=$intent targets=$($targets -join ', ')" -ForegroundColor Yellow
|
||||
try {
|
||||
Add-GraphAppAssignment -AppId $AppId -Intent $intent -GroupId $target
|
||||
# EIN Request fuer alle Ziele: bestehende Zuweisungen werden gemergt.
|
||||
Add-GraphAppAssignment -AppId $AppId -Intent $intent -GroupId $targets
|
||||
} catch {
|
||||
$graphBody = $null
|
||||
try { $graphBody = $_.ErrorDetails.Message } catch {}
|
||||
@@ -2811,38 +2957,46 @@ function Add-AppAssignmentEndpoint {
|
||||
return @{ __status = $status; error = $friendly; code = $details.Code; graph = $graphBody }
|
||||
}
|
||||
|
||||
# Cache aktualisieren — neue Zuweisung im App-Eintrag ergaenzen
|
||||
# Cache aktualisieren — neue Zuweisung(en) im App-Eintrag ergaenzen.
|
||||
# (Das Frontend laedt danach ohnehin neu; das haelt die UI aber sofort konsistent.)
|
||||
if ($cachedApp) {
|
||||
$entry = if ($target -eq "ALL_USERS") {
|
||||
@{ GroupId = "ALL_USERS"; GroupName = "All Users"; IsNative = $true }
|
||||
} elseif ($target -eq "ALL_DEVICES") {
|
||||
@{ GroupId = "ALL_DEVICES"; GroupName = "All Devices"; IsNative = $true }
|
||||
} else {
|
||||
# Group-Namen aus den geladenen Gruppen oder Graph nachschlagen
|
||||
$groupName = $target
|
||||
$lookup = @{}
|
||||
foreach ($g in $script:State.Groups) { $lookup[$g.Id] = $g.DisplayName }
|
||||
foreach ($g in $script:State.RpaGroups) { $lookup[$g.Id] = $g.DisplayName }
|
||||
if ($lookup.ContainsKey($target)) { $groupName = $lookup[$target] }
|
||||
else {
|
||||
try {
|
||||
$g = Get-GraphGroupById -Id $target -Property @("id","displayName")
|
||||
if ($g.displayName) { $groupName = [string]$g.displayName }
|
||||
} catch {}
|
||||
$lookup = @{}
|
||||
foreach ($g in $script:State.Groups) { $lookup[$g.Id] = $g.DisplayName }
|
||||
foreach ($g in $script:State.RpaGroups) { $lookup[$g.Id] = $g.DisplayName }
|
||||
foreach ($target in $targets) {
|
||||
$entry = if ($target -eq "ALL_USERS") {
|
||||
@{ GroupId = "ALL_USERS"; GroupName = "All Users"; IsNative = $true }
|
||||
} elseif ($target -eq "ALL_DEVICES") {
|
||||
@{ GroupId = "ALL_DEVICES"; GroupName = "All Devices"; IsNative = $true }
|
||||
} else {
|
||||
$groupName = $target
|
||||
if ($lookup.ContainsKey($target)) { $groupName = $lookup[$target] }
|
||||
else {
|
||||
try {
|
||||
$g = Get-GraphGroupById -Id $target -Property @("id","displayName")
|
||||
if ($g.displayName) { $groupName = [string]$g.displayName }
|
||||
} catch {}
|
||||
}
|
||||
@{ GroupId = $target; GroupName = $groupName; IsNative = $false }
|
||||
}
|
||||
$exists = if ($intent -eq "available") {
|
||||
@($cachedApp.AvailableGroups | Where-Object { $_.GroupId -eq $entry.GroupId }).Count -gt 0
|
||||
} else {
|
||||
@($cachedApp.RequiredGroups | Where-Object { $_.GroupId -eq $entry.GroupId }).Count -gt 0
|
||||
}
|
||||
if ($exists) { continue }
|
||||
if ($intent -eq "available") {
|
||||
$cachedApp.AvailableGroups = @($cachedApp.AvailableGroups + $entry)
|
||||
$cachedApp.AvailableCount = $cachedApp.AvailableGroups.Count
|
||||
} else {
|
||||
$cachedApp.RequiredGroups = @($cachedApp.RequiredGroups + $entry)
|
||||
$cachedApp.RequiredCount = $cachedApp.RequiredGroups.Count
|
||||
}
|
||||
@{ GroupId = $target; GroupName = $groupName; IsNative = $false }
|
||||
}
|
||||
if ($intent -eq "available") {
|
||||
$cachedApp.AvailableGroups = @($cachedApp.AvailableGroups + $entry)
|
||||
$cachedApp.AvailableCount = $cachedApp.AvailableGroups.Count
|
||||
} else {
|
||||
$cachedApp.RequiredGroups = @($cachedApp.RequiredGroups + $entry)
|
||||
$cachedApp.RequiredCount = $cachedApp.RequiredGroups.Count
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "[ADD ASSIGN] OK" -ForegroundColor Green
|
||||
return @{ ok = $true; appId = $AppId; intent = $intent; target = $target }
|
||||
Write-Host "[ADD ASSIGN] OK ($($targets.Count) Ziel(e))" -ForegroundColor Green
|
||||
return @{ ok = $true; appId = $AppId; intent = $intent; targets = @($targets); count = $targets.Count }
|
||||
}
|
||||
|
||||
function Remove-AppAssignmentEndpoint {
|
||||
|
||||
+71
-18
@@ -33,7 +33,13 @@ function Invoke-MgGraphRequestRetry {
|
||||
$Body,
|
||||
[string]$ContentType,
|
||||
[hashtable]$Headers,
|
||||
[int]$MaxRetries = 3
|
||||
[int]$MaxRetries = 3,
|
||||
# Rohes JSON von Graph holen und selbst parsen. Noetig fuer Policy-Exporte:
|
||||
# Invoke-MgGraphRequest liefert unter Windows PowerShell 5.1 im Hashtable-
|
||||
# Modus Ein-Element-Collections als Skalar (z.B. printerNames), was beim
|
||||
# Re-Import 400 "A 'StartArray' node was expected" ausloest. -OutputType Json
|
||||
# umgeht das: ConvertFrom-Json bewahrt Arrays.
|
||||
[switch]$AsRawJson
|
||||
)
|
||||
$attempt = 0
|
||||
while ($true) {
|
||||
@@ -42,6 +48,13 @@ function Invoke-MgGraphRequestRetry {
|
||||
if ($PSBoundParameters.ContainsKey('Body') -and $null -ne $Body) { $params.Body = $Body }
|
||||
if ($ContentType) { $params.ContentType = $ContentType }
|
||||
if ($Headers) { $params.Headers = $Headers }
|
||||
if ($AsRawJson) {
|
||||
$params.OutputType = 'Json'
|
||||
$raw = Invoke-MgGraphRequest @params
|
||||
if ([string]::IsNullOrWhiteSpace([string]$raw)) { return $null }
|
||||
if ($PSVersionTable.PSVersion.Major -ge 6) { return ($raw | ConvertFrom-Json -AsHashtable) }
|
||||
return ($raw | ConvertFrom-Json)
|
||||
}
|
||||
return Invoke-MgGraphRequest @params
|
||||
} catch {
|
||||
$msg = $_.Exception.Message
|
||||
@@ -64,11 +77,15 @@ function Invoke-MgGraphRequestRetry {
|
||||
}
|
||||
|
||||
function Get-GraphPaged {
|
||||
param([Parameter(Mandatory=$true)][string]$Uri)
|
||||
param(
|
||||
[Parameter(Mandatory=$true)][string]$Uri,
|
||||
# An Invoke-MgGraphRequestRetry durchreichen: bewahrt Arrays fuer Exporte.
|
||||
[switch]$AsRawJson
|
||||
)
|
||||
$results = @()
|
||||
$next = $Uri
|
||||
do {
|
||||
$response = Invoke-MgGraphRequestRetry -Uri $next -Method GET
|
||||
$response = Invoke-MgGraphRequestRetry -Uri $next -Method GET -AsRawJson:$AsRawJson
|
||||
if ($response.value) { $results += $response.value }
|
||||
$next = $response.'@odata.nextLink'
|
||||
} while ($next)
|
||||
@@ -376,21 +393,51 @@ function Add-GraphAppAssignment {
|
||||
param(
|
||||
[string]$AppId,
|
||||
[string]$Intent, # "available" | "required"
|
||||
[string]$GroupId # GUID oder "ALL_USERS" / "ALL_DEVICES"
|
||||
[string[]]$GroupId # eine ODER mehrere: GUID(s) und/oder "ALL_USERS"/"ALL_DEVICES"
|
||||
)
|
||||
$target = switch ($GroupId) {
|
||||
"ALL_USERS" { @{ "@odata.type" = "#microsoft.graph.allLicensedUsersAssignmentTarget" } }
|
||||
"ALL_DEVICES" { @{ "@odata.type" = "#microsoft.graph.allDevicesAssignmentTarget" } }
|
||||
default { @{ "@odata.type" = "#microsoft.graph.groupAssignmentTarget"; "groupId" = $GroupId } }
|
||||
# WICHTIG: Die /assign-Action ERSETZT die komplette Zuweisungsliste der App.
|
||||
# Ein einzelnes POST wuerde also alle bestehenden Zuweisungen loeschen. Daher:
|
||||
# bestehende Zuweisungen laden, die neuen mergen (Duplikate ueberspringen) und
|
||||
# den VOLLEN Satz in EINEM Request schicken. Das haelt mehrere neue Gruppen
|
||||
# zusammen (kein Read-after-Write-Rennen) und bewahrt vorhandene Zuweisungen.
|
||||
$newTargets = @()
|
||||
foreach ($gid in @($GroupId)) {
|
||||
if ([string]::IsNullOrWhiteSpace([string]$gid)) { continue }
|
||||
$newTargets += switch ([string]$gid) {
|
||||
"ALL_USERS" { @{ "@odata.type" = "#microsoft.graph.allLicensedUsersAssignmentTarget" } }
|
||||
"ALL_DEVICES" { @{ "@odata.type" = "#microsoft.graph.allDevicesAssignmentTarget" } }
|
||||
default { @{ "@odata.type" = "#microsoft.graph.groupAssignmentTarget"; "groupId" = [string]$gid } }
|
||||
}
|
||||
}
|
||||
$body = @{
|
||||
mobileAppAssignments = @(@{
|
||||
"@odata.type" = "#microsoft.graph.mobileAppAssignment"
|
||||
|
||||
$existing = Get-GraphMobileAppAssignments -AppId $AppId
|
||||
$assignments = @()
|
||||
$seen = @{} # Schluessel intent|type|groupId -> Duplikate vermeiden
|
||||
foreach ($a in $existing) {
|
||||
$tgt = $a.target
|
||||
if (-not $tgt) { continue }
|
||||
$key = ([string]$a.intent) + '|' + ([string]$tgt.'@odata.type') + '|' + ([string]$tgt.groupId)
|
||||
$seen[$key] = $true
|
||||
$assignments += @{
|
||||
'@odata.type' = '#microsoft.graph.mobileAppAssignment'
|
||||
intent = [string]$a.intent
|
||||
target = $tgt # inkl. evtl. Filter -> unveraendert beibehalten
|
||||
settings = $a.settings # bestehende Assignment-Settings bewahren
|
||||
}
|
||||
}
|
||||
foreach ($t in $newTargets) {
|
||||
$key = $Intent + '|' + [string]$t['@odata.type'] + '|' + [string]$t['groupId']
|
||||
if ($seen.ContainsKey($key)) { continue } # bereits (mit diesem Intent) zugewiesen
|
||||
$seen[$key] = $true
|
||||
$assignments += @{
|
||||
'@odata.type' = '#microsoft.graph.mobileAppAssignment'
|
||||
intent = $Intent
|
||||
target = $target
|
||||
target = $t
|
||||
settings = $null
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
$body = @{ mobileAppAssignments = @($assignments) }
|
||||
Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps/$AppId/assign" -Method POST -Body $body
|
||||
}
|
||||
|
||||
@@ -827,16 +874,15 @@ function Remove-GraphMobileApp {
|
||||
}
|
||||
}
|
||||
|
||||
# Excluded App-Typen aus dem Original-Script
|
||||
# Ausgeschlossene App-Typen: iOS/Android bleiben ausgeblendet (dieses Tool ist auf
|
||||
# Windows + macOS ausgelegt). macOS-Typen sind bewusst NICHT mehr ausgeschlossen,
|
||||
# damit Mac-Apps in Liste/Suche erscheinen.
|
||||
$script:ExcludedAppTypes = @(
|
||||
'#microsoft.graph.iosLobApp', '#microsoft.graph.iosStoreApp', '#microsoft.graph.iosVppApp',
|
||||
'#microsoft.graph.managedIOSLobApp', '#microsoft.graph.managedIOSStoreApp',
|
||||
'#microsoft.graph.androidLobApp', '#microsoft.graph.androidStoreApp', '#microsoft.graph.androidForWorkApp',
|
||||
'#microsoft.graph.androidManagedStoreApp', '#microsoft.graph.androidManagedStoreWebApp',
|
||||
'#microsoft.graph.managedAndroidLobApp', '#microsoft.graph.managedAndroidStoreApp',
|
||||
'#microsoft.graph.macOSDmgApp', '#microsoft.graph.macOSLobApp', '#microsoft.graph.macOSMicrosoftDefenderApp',
|
||||
'#microsoft.graph.macOSMicrosoftEdgeApp', '#microsoft.graph.macOSOfficeSuiteApp', '#microsoft.graph.macOSPkgApp',
|
||||
'#microsoft.graph.macOsVppApp'
|
||||
'#microsoft.graph.managedAndroidLobApp', '#microsoft.graph.managedAndroidStoreApp'
|
||||
)
|
||||
|
||||
function Test-AppTypeAllowed {
|
||||
@@ -858,6 +904,13 @@ function ConvertTo-AppFriendlyType {
|
||||
'#microsoft.graph.windowsAppX' { 'APPX' }
|
||||
'#microsoft.graph.windowsUniversalAppX' { 'APPX' }
|
||||
'#microsoft.graph.windowsMobileMSI' { 'MSI' }
|
||||
'#microsoft.graph.macOSDmgApp' { 'macOS DMG' }
|
||||
'#microsoft.graph.macOSPkgApp' { 'macOS PKG' }
|
||||
'#microsoft.graph.macOSLobApp' { 'macOS LOB' }
|
||||
'#microsoft.graph.macOSMicrosoftDefenderApp' { 'macOS Defender' }
|
||||
'#microsoft.graph.macOSMicrosoftEdgeApp' { 'macOS Edge' }
|
||||
'#microsoft.graph.macOSOfficeSuiteApp' { 'macOS M365' }
|
||||
'#microsoft.graph.macOsVppApp' { 'macOS VPP' }
|
||||
default {
|
||||
($Type -replace '#microsoft\.graph\.','')
|
||||
}
|
||||
|
||||
@@ -0,0 +1,238 @@
|
||||
# Geraete-Offboarding: ein Geraet ueber Intune, Autopilot und Entra ID hinweg
|
||||
# entfernen (Decommissioning). Vor dem Loeschen koennen BitLocker-/FileVault-Keys
|
||||
# und LAPS-Passwoerter ausgelesen werden, damit sie nicht verloren gehen.
|
||||
#
|
||||
# Portiert aus dem "Device Offboarding Manager" (Ugur Koc, MIT-Lizenz) — dort
|
||||
# WPF, hier als Web-Endpoints in den Intune Manager integriert.
|
||||
#
|
||||
# Loeschen ist destruktiv -> im Read-Only-Modus gesperrt, harte Bestaetigung im UI.
|
||||
|
||||
# Generischer Microsoft-Graph-$batch-Helper. Nimmt Sub-Requests
|
||||
# ( @{ id; method; url; body?; headers? } ) und liefert eine Map id -> Response.
|
||||
function Invoke-GraphBatch {
|
||||
param([Parameter(Mandatory=$true)][object[]]$Requests)
|
||||
$map = @{}
|
||||
for ($i = 0; $i -lt $Requests.Count; $i += 20) {
|
||||
$chunk = $Requests[$i .. [Math]::Min($i + 19, $Requests.Count - 1)]
|
||||
$body = @{ requests = @($chunk) } | ConvertTo-Json -Depth 10 -Compress
|
||||
$resp = Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/$batch' -Method POST -Body $body -ContentType 'application/json'
|
||||
foreach ($r in @($resp.responses)) { $map[[string]$r.id] = $r }
|
||||
}
|
||||
return $map
|
||||
}
|
||||
|
||||
# Graph-Fehlermeldung aus einer Exception ziehen (Body statt generischer Text).
|
||||
function Get-OffboardGraphErr {
|
||||
param($ErrorRecord)
|
||||
$m = $ErrorRecord.Exception.Message
|
||||
try { if ($ErrorRecord.ErrorDetails.Message) { $m = $ErrorRecord.ErrorDetails.Message } } catch {}
|
||||
return $m
|
||||
}
|
||||
|
||||
# Geraete suchen und ueber die drei Dienste hinweg aufloesen.
|
||||
# Query: query=<text>, type=name|serial
|
||||
function Search-OffboardDevicesEndpoint {
|
||||
param([hashtable]$Query)
|
||||
$err = Test-Connected
|
||||
if ($err) { return $err }
|
||||
|
||||
$q = [string]$Query['query']
|
||||
$type = [string]$Query['type']
|
||||
if ([string]::IsNullOrWhiteSpace($q)) { return @{ __status = 400; error = 'Suchbegriff fehlt' } }
|
||||
$qEsc = $q -replace "'", "''"
|
||||
|
||||
# managedDevices unterstuetzt startswith(deviceName) bzw. serialNumber eq.
|
||||
$filter = if ($type -eq 'serial') { "serialNumber eq '$qEsc'" } else { "startswith(deviceName,'$qEsc')" }
|
||||
$sel = 'id,deviceName,serialNumber,operatingSystem,osVersion,userPrincipalName,lastSyncDateTime,azureADDeviceId,managedDeviceOwnerType,managementAgent'
|
||||
$uri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices?`$filter=$([Uri]::EscapeDataString($filter))&`$select=$sel&`$top=50&`$orderby=deviceName"
|
||||
try {
|
||||
$intune = @(Get-GraphPaged -Uri $uri)
|
||||
} catch {
|
||||
$m = Get-OffboardGraphErr $_
|
||||
if ($m -match '403|Forbidden') {
|
||||
return @{ __status = 403; error = 'Keine Berechtigung fuer die Geraete-Suche. Scope "DeviceManagementManagedDevices.Read.All" muss in den Read/Write-Scopes stehen UND per Admin-Consent zugestimmt sein (siehe docs/App-Registration.md). Nach dem Ergaenzen: ab- und neu anmelden.' }
|
||||
}
|
||||
return @{ __status = 500; error = "Graph-Fehler bei der Suche: $m" }
|
||||
}
|
||||
if ($intune.Count -eq 0) { return @{ items = @(); count = 0 } }
|
||||
|
||||
# Entra-Objekt (fuer Delete) + Autopilot-Identity (fuer Delete) per Batch nachladen.
|
||||
$reqs = @()
|
||||
$idx = 0
|
||||
foreach ($d in $intune) {
|
||||
$aad = [string]$d.azureADDeviceId
|
||||
$ser = [string]$d.serialNumber
|
||||
if ($aad -and $aad -ne '00000000-0000-0000-0000-000000000000') {
|
||||
$f = [Uri]::EscapeDataString("deviceId eq '$aad'")
|
||||
$reqs += @{ id = "e$idx"; method = 'GET'; url = "/devices?`$filter=$f&`$select=id,deviceId,displayName,accountEnabled&`$top=1" }
|
||||
}
|
||||
if ($ser) {
|
||||
$sf = [Uri]::EscapeDataString("contains(serialNumber,'$($ser -replace "'","''")')")
|
||||
$reqs += @{ id = "a$idx"; method = 'GET'; url = "/deviceManagement/windowsAutopilotDeviceIdentities?`$filter=$sf&`$top=1" }
|
||||
}
|
||||
$idx++
|
||||
}
|
||||
$batch = if ($reqs.Count -gt 0) { Invoke-GraphBatch -Requests $reqs } else { @{} }
|
||||
|
||||
$items = @()
|
||||
$idx = 0
|
||||
foreach ($d in $intune) {
|
||||
$entra = $null; $autop = $null
|
||||
$er = $batch["e$idx"]; if ($er -and [int]$er.status -eq 200) { $entra = @($er.body.value)[0] }
|
||||
$ar = $batch["a$idx"]; if ($ar -and [int]$ar.status -eq 200) { $autop = @($ar.body.value)[0] }
|
||||
$items += [pscustomobject]@{
|
||||
deviceName = [string]$d.deviceName
|
||||
serialNumber = [string]$d.serialNumber
|
||||
operatingSystem = [string]$d.operatingSystem
|
||||
osVersion = [string]$d.osVersion
|
||||
primaryUser = [string]$d.userPrincipalName
|
||||
lastSync = $d.lastSyncDateTime
|
||||
ownership = [string]$d.managedDeviceOwnerType
|
||||
coManaged = ([string]$d.managementAgent -match 'configurationManager')
|
||||
intuneDeviceId = [string]$d.id
|
||||
azureADDeviceId = [string]$d.azureADDeviceId
|
||||
entraObjectId = if ($entra) { [string]$entra.id } else { '' }
|
||||
entraEnabled = if ($entra) { [bool]$entra.accountEnabled } else { $null }
|
||||
autopilotId = if ($autop) { [string]$autop.id } else { '' }
|
||||
inIntune = $true
|
||||
inEntra = [bool]$entra
|
||||
inAutopilot = [bool]$autop
|
||||
}
|
||||
$idx++
|
||||
}
|
||||
return @{ items = @($items); count = $items.Count }
|
||||
}
|
||||
|
||||
# Recovery-Keys eines Geraets holen (vor dem Loeschen). Body:
|
||||
# { intuneDeviceId, azureADDeviceId, operatingSystem }
|
||||
function Get-OffboardKeysEndpoint {
|
||||
param($Body)
|
||||
$err = Test-Connected
|
||||
if ($err) { return $err }
|
||||
|
||||
$intuneId = [string](Get-PolicyProp $Body 'intuneDeviceId')
|
||||
$aad = [string](Get-PolicyProp $Body 'azureADDeviceId')
|
||||
$os = [string](Get-PolicyProp $Body 'operatingSystem')
|
||||
|
||||
$bitlocker = @()
|
||||
$fileVault = $null
|
||||
$laps = $null
|
||||
$notes = @()
|
||||
|
||||
if ($os -eq 'Windows' -and $aad) {
|
||||
try {
|
||||
$keyIds = @(Get-GraphPaged -Uri "https://graph.microsoft.com/beta/informationProtection/bitlocker/recoveryKeys?`$filter=deviceId eq '$aad'")
|
||||
foreach ($k in $keyIds) {
|
||||
try {
|
||||
$kd = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/informationProtection/bitlocker/recoveryKeys/$($k.id)?`$select=key,volumeType" -Method GET
|
||||
if ($kd.key) { $bitlocker += @{ volumeType = [string]$kd.volumeType; key = [string]$kd.key } }
|
||||
} catch {}
|
||||
}
|
||||
if ($bitlocker.Count -eq 0) { $notes += 'Kein BitLocker-Key gefunden.' }
|
||||
} catch {
|
||||
$m = Get-OffboardGraphErr $_
|
||||
$notes += if ($m -match '403') { 'BitLocker: Zugriff verweigert (BitlockerKey.Read.All noetig).' } else { "BitLocker: $m" }
|
||||
}
|
||||
}
|
||||
elseif ($os -eq 'macOS' -and $intuneId) {
|
||||
try {
|
||||
$fv = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices('$intuneId')/getFileVaultKey" -Method GET
|
||||
if ($fv.value) { $fileVault = [string]$fv.value } else { $notes += 'Kein FileVault-Key gefunden.' }
|
||||
} catch { $notes += "FileVault: $(Get-OffboardGraphErr $_)" }
|
||||
}
|
||||
|
||||
# LAPS (jede Plattform, ueber die Entra-Device-Id).
|
||||
if ($aad) {
|
||||
try {
|
||||
$resp = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/directory/deviceLocalCredentials/$aad`?`$select=credentials" -Method GET
|
||||
$creds = @($resp.credentials)
|
||||
if ($creds.Count -gt 0) {
|
||||
$latest = $creds | Sort-Object -Property backupDateTime -Descending | Select-Object -First 1
|
||||
$pw = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([string]$latest.passwordBase64))
|
||||
$laps = @{ account = [string]$latest.accountName; password = $pw }
|
||||
}
|
||||
} catch {
|
||||
$m = Get-OffboardGraphErr $_
|
||||
if ($m -notmatch '404') { $notes += "LAPS: $m" }
|
||||
}
|
||||
}
|
||||
|
||||
return @{ ok = $true; keys = @{ bitlocker = @($bitlocker); fileVault = $fileVault; laps = $laps; notes = @($notes) } }
|
||||
}
|
||||
|
||||
# Offboarding ausfuehren. Body:
|
||||
# devices = [ { deviceName, intuneDeviceId, entraObjectId, autopilotId } ]
|
||||
# services = { entra: 'delete'|'disable'|'none', intune: bool, autopilot: bool }
|
||||
function Invoke-OffboardExecuteEndpoint {
|
||||
param($Body)
|
||||
$err = Test-Connected
|
||||
if ($err) { return $err }
|
||||
if ($script:State.ReadOnly) { return @{ __status = 403; error = 'Read-Only-Modus: Offboarding ist deaktiviert.' } }
|
||||
|
||||
$devices = @(Get-PolicyProp $Body 'devices') | Where-Object { $_ }
|
||||
$svc = Get-PolicyProp $Body 'services'
|
||||
if (@($devices).Count -eq 0) { return @{ __status = 400; error = 'Keine Geraete uebergeben' } }
|
||||
|
||||
$entraAction = [string](Get-PolicyProp $svc 'entra')
|
||||
$doIntune = [bool](Get-PolicyProp $svc 'intune')
|
||||
$doAutopilot = [bool](Get-PolicyProp $svc 'autopilot')
|
||||
|
||||
$reqs = @()
|
||||
$meta = @{}
|
||||
$n = 0
|
||||
foreach ($d in $devices) {
|
||||
$name = [string](Get-PolicyProp $d 'deviceName')
|
||||
$iid = [string](Get-PolicyProp $d 'intuneDeviceId')
|
||||
$eid = [string](Get-PolicyProp $d 'entraObjectId')
|
||||
$aid = [string](Get-PolicyProp $d 'autopilotId')
|
||||
|
||||
if ($entraAction -eq 'delete' -and $eid) {
|
||||
$rid = "r$n"; $reqs += @{ id = $rid; method = 'DELETE'; url = "/devices/$eid" }
|
||||
$meta[$rid] = @{ name = $name; svc = 'Entra ID'; action = 'geloescht' }; $n++
|
||||
} elseif ($entraAction -eq 'disable' -and $eid) {
|
||||
$rid = "r$n"; $reqs += @{ id = $rid; method = 'PATCH'; url = "/devices/$eid"; body = @{ accountEnabled = $false }; headers = @{ 'Content-Type' = 'application/json' } }
|
||||
$meta[$rid] = @{ name = $name; svc = 'Entra ID'; action = 'deaktiviert' }; $n++
|
||||
}
|
||||
if ($doIntune -and $iid) {
|
||||
$rid = "r$n"; $reqs += @{ id = $rid; method = 'DELETE'; url = "/deviceManagement/managedDevices/$iid" }
|
||||
$meta[$rid] = @{ name = $name; svc = 'Intune'; action = 'geloescht' }; $n++
|
||||
}
|
||||
if ($doAutopilot -and $aid) {
|
||||
$rid = "r$n"; $reqs += @{ id = $rid; method = 'DELETE'; url = "/deviceManagement/windowsAutopilotDeviceIdentities/$aid" }
|
||||
$meta[$rid] = @{ name = $name; svc = 'Autopilot'; action = 'geloescht' }; $n++
|
||||
}
|
||||
}
|
||||
if ($reqs.Count -eq 0) { return @{ __status = 400; error = 'Keine ausfuehrbaren Aktionen (fehlende IDs oder nichts ausgewaehlt).' } }
|
||||
|
||||
Write-Host "[OFFBOARD] Fuehre $($reqs.Count) Aktion(en) fuer $(@($devices).Count) Geraet(e) aus..." -ForegroundColor Yellow
|
||||
$batch = Invoke-GraphBatch -Requests $reqs
|
||||
|
||||
$results = @()
|
||||
foreach ($rid in ($meta.Keys | Sort-Object { [int]($_ -replace '\D','') })) {
|
||||
$m = $meta[$rid]
|
||||
$r = $batch[$rid]
|
||||
$status = if ($r) { [int]$r.status } else { 0 }
|
||||
$ok = $status -in @(200, 204)
|
||||
$errMsg = ''
|
||||
if (-not $ok) {
|
||||
$code = ''
|
||||
try { $code = [string]$r.body.error.code } catch {}
|
||||
if ($status -eq 403 -and $code -match 'multipleAdminApproval|protectedOperation') {
|
||||
$errMsg = 'Erfordert Multi-Admin-Approval'
|
||||
} elseif ($status -eq 403) {
|
||||
$errMsg = "403 - fehlende Rolle/Berechtigung fuer $($m.svc)"
|
||||
} elseif ($status -eq 0) {
|
||||
$errMsg = 'Keine Antwort'
|
||||
} else {
|
||||
$errMsg = "HTTP $status" + $(if ($code) { " ($code)" } else { '' })
|
||||
}
|
||||
}
|
||||
$results += [pscustomobject]@{
|
||||
deviceName = $m.name; service = $m.svc; action = $m.action
|
||||
success = $ok; error = $errMsg
|
||||
}
|
||||
}
|
||||
$okCount = @($results | Where-Object { $_.success }).Count
|
||||
Write-Host " -> $okCount/$($results.Count) erfolgreich" -ForegroundColor DarkGray
|
||||
return @{ ok = $true; successCount = $okCount; total = $results.Count; results = @($results) }
|
||||
}
|
||||
+270
-10
@@ -119,6 +119,15 @@ function Get-PolicyProp {
|
||||
return $null
|
||||
}
|
||||
|
||||
# Property setzen — Hashtable ODER PSCustomObject (fuer Import-Umbenennung).
|
||||
function Set-PolicyProp {
|
||||
param($Obj, [string]$Name, $Value)
|
||||
if ($null -eq $Obj) { return }
|
||||
if ($Obj -is [System.Collections.IDictionary]) { $Obj[$Name] = $Value; return }
|
||||
if ($Obj.PSObject.Properties[$Name]) { $Obj.$Name = $Value }
|
||||
else { $Obj | Add-Member -NotePropertyName $Name -NotePropertyValue $Value -Force }
|
||||
}
|
||||
|
||||
# Grobe Plattform-Bezeichnung fuer die Listenanzeige.
|
||||
function Get-PolicyPlatformLabel {
|
||||
param($Raw, [string]$Type)
|
||||
@@ -177,10 +186,12 @@ function Get-GraphPolicyDetail {
|
||||
|
||||
# Administrative Vorlagen: Basis-Objekt holen und die konfigurierten Werte
|
||||
# (definitionValues inkl. Definition + Presentation-Werten) separat expandieren.
|
||||
# -AsRawJson durchgaengig: bewahrt Ein-Element-Collections als Array (PS-5.1-
|
||||
# Hashtable-Modus wuerde sie skalarisieren -> 400 beim Re-Import).
|
||||
if ($cfg.Key -eq 'administrativetemplate') {
|
||||
$base = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id" -Method GET
|
||||
$base = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id" -Method GET -AsRawJson
|
||||
$dvUri = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id/definitionValues?`$expand=definition(`$select=id,classType,displayName,policyType,version),presentationValues(`$expand=presentation)"
|
||||
$dvs = @(Get-GraphPaged -Uri $dvUri)
|
||||
$dvs = @(Get-GraphPaged -Uri $dvUri -AsRawJson)
|
||||
if ($base -is [System.Collections.IDictionary]) { $base['definitionValues'] = $dvs }
|
||||
else { $base | Add-Member -NotePropertyName definitionValues -NotePropertyValue $dvs -Force }
|
||||
return $base
|
||||
@@ -188,7 +199,7 @@ function Get-GraphPolicyDetail {
|
||||
|
||||
$uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$Id"
|
||||
if ($cfg.ExportExpand) { $uri += "?`$expand=$($cfg.ExportExpand)" }
|
||||
return Invoke-MgGraphRequestRetry -Uri $uri -Method GET
|
||||
return Invoke-MgGraphRequestRetry -Uri $uri -Method GET -AsRawJson
|
||||
}
|
||||
|
||||
# PSCustomObject/Hashtable -> bereinigte Hashtable ohne Read-Only-Felder.
|
||||
@@ -220,10 +231,23 @@ function ConvertTo-ImportBody {
|
||||
function Repair-SettingsCatalogArrays {
|
||||
param($Node)
|
||||
$arrayKeys = @('settings','children','groupSettingCollectionValue','simpleSettingCollectionValue','values')
|
||||
# *TemplateReference-Keys tragen ein Objekt ODER null. Ein alter Export mit zu
|
||||
# geringer ConvertTo-Json-Tiefe hat solche (tief liegenden) Objekte zu ".ToString()"
|
||||
# stringifiziert -> "System.Collections.Hashtable". Graph lehnt das ab
|
||||
# ('Property settingValueTemplateReference ... does not match schema'). Der bloße
|
||||
# String ist eindeutig korrupt und nicht rekonstruierbar -> auf null setzen; die
|
||||
# (optionale) Template-Bindung entfaellt, die eigentlichen Werte bleiben erhalten.
|
||||
$refKeys = @('settingInstanceTemplateReference','settingValueTemplateReference')
|
||||
|
||||
# Array-Property normalisieren: $null -> @() (Graph-Schema: Collections sind
|
||||
# Nullable=False, ein 'children': null wird abgelehnt), Einzelobjekt -> @(obj).
|
||||
# Inline (nicht als Funktion), sonst entpackt der Return ein Ein-Element-Array.
|
||||
# Array-Property normalisieren — WICHTIG inline (Zuweisung, KEIN Funktions-
|
||||
# Return): ein leeres Array aus einer Funktion zurueckzugeben entpackt PS zu
|
||||
# $null, was zu 'children: {}' statt '[]' fuehrt. Als Zuweisung bleibt @() ein @().
|
||||
# $null -> @() (Graph-Schema: Collections sind Nullable=False)
|
||||
# Einzelobjekt -> @(obj) (Ein-Element-Array wurde vom Roundtrip skalarisiert)
|
||||
# leere/Whitespace-STRING-Elemente entfernen: ein PS-JSON-Roundtrip macht aus
|
||||
# einer leeren Collection [] teils ""/[""] -> Graph lehnt das als
|
||||
# 'Property children ... does not match schema' ab. Diese Keys tragen nie bare
|
||||
# Strings -> gefahrlos filtern; wird die Collection dadurch leer, bleibt [].
|
||||
if ($Node -is [System.Collections.IDictionary]) {
|
||||
$out = [ordered]@{}
|
||||
foreach ($k in @($Node.Keys)) {
|
||||
@@ -231,7 +255,9 @@ function Repair-SettingsCatalogArrays {
|
||||
if ($k -in $arrayKeys) {
|
||||
if ($null -eq $fixed) { $fixed = @() }
|
||||
elseif (-not ($fixed -is [System.Collections.IList])) { $fixed = @($fixed) }
|
||||
$fixed = @($fixed | Where-Object { -not (($_ -is [string]) -and [string]::IsNullOrWhiteSpace($_)) })
|
||||
}
|
||||
elseif ($k -in $refKeys -and ($fixed -is [string])) { $fixed = $null }
|
||||
$out[$k] = $fixed
|
||||
}
|
||||
return $out
|
||||
@@ -243,7 +269,9 @@ function Repair-SettingsCatalogArrays {
|
||||
if ($p.Name -in $arrayKeys) {
|
||||
if ($null -eq $fixed) { $fixed = @() }
|
||||
elseif (-not ($fixed -is [System.Collections.IList])) { $fixed = @($fixed) }
|
||||
$fixed = @($fixed | Where-Object { -not (($_ -is [string]) -and [string]::IsNullOrWhiteSpace($_)) })
|
||||
}
|
||||
elseif ($p.Name -in $refKeys -and ($fixed -is [string])) { $fixed = $null }
|
||||
$out[$p.Name] = $fixed
|
||||
}
|
||||
return $out
|
||||
@@ -258,6 +286,43 @@ function Repair-SettingsCatalogArrays {
|
||||
return $Node
|
||||
}
|
||||
|
||||
# Entfernt rekursiv alle Properties mit $null-Wert. Configuration Profiles
|
||||
# exportieren nicht genutzte Collection-Properties als null; beim POST lehnt Graph
|
||||
# null fuer 'Collection(...)[Nullable=False]' ab (400 ModelValidationFailure, z.B.
|
||||
# 'defenderAdditionalGuardedFolders'). Weggelassene Properties belegt Graph mit
|
||||
# Defaults -> sicheres Strippen. Array-Typen werden am Parent wieder in @()
|
||||
# gewrappt, damit ein Ein-Element-Array beim Return nicht zum Skalar entpackt wird.
|
||||
function Remove-PolicyNullProps {
|
||||
param($Node)
|
||||
if ($Node -is [System.Collections.IDictionary]) {
|
||||
$out = @{}
|
||||
foreach ($k in @($Node.Keys)) {
|
||||
$v = $Node[$k]
|
||||
if ($null -eq $v) { continue }
|
||||
$fixed = Remove-PolicyNullProps $v
|
||||
if (($v -is [System.Collections.IEnumerable]) -and -not ($v -is [string]) -and -not ($v -is [System.Collections.IDictionary])) {
|
||||
$out[$k] = @($fixed)
|
||||
} else { $out[$k] = $fixed }
|
||||
}
|
||||
return $out
|
||||
}
|
||||
if ($Node -is [System.Management.Automation.PSCustomObject]) {
|
||||
$out = @{}
|
||||
foreach ($p in $Node.PSObject.Properties) {
|
||||
if ($null -eq $p.Value) { continue }
|
||||
$fixed = Remove-PolicyNullProps $p.Value
|
||||
if (($p.Value -is [System.Collections.IEnumerable]) -and -not ($p.Value -is [string]) -and -not ($p.Value -is [System.Collections.IDictionary])) {
|
||||
$out[$p.Name] = @($fixed)
|
||||
} else { $out[$p.Name] = $fixed }
|
||||
}
|
||||
return $out
|
||||
}
|
||||
if (($Node -is [System.Collections.IEnumerable]) -and -not ($Node -is [string])) {
|
||||
return @($Node | ForEach-Object { Remove-PolicyNullProps $_ })
|
||||
}
|
||||
return $Node
|
||||
}
|
||||
|
||||
function New-DefaultComplianceScheduledActions {
|
||||
# Compliance Policies verlangen beim Anlegen mindestens einen
|
||||
# scheduledActionsForRule-Block, sonst antwortet Graph mit 400.
|
||||
@@ -311,6 +376,8 @@ function Import-GraphConfigurationProfile {
|
||||
if (-not $body['@odata.type']) {
|
||||
throw 'Configuration Profile benoetigt @odata.type fuer den Import.'
|
||||
}
|
||||
# null-Properties strippen: Graph lehnt null fuer nicht-nullbare Collections ab.
|
||||
$body = Remove-PolicyNullProps $body
|
||||
$json = $body | ConvertTo-Json -Depth 50
|
||||
return Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations' -Method POST -Body $json -ContentType 'application/json'
|
||||
}
|
||||
@@ -341,6 +408,17 @@ function Import-GraphSettingsCatalogPolicy {
|
||||
$body['settings'] = @()
|
||||
}
|
||||
$json = $body | ConvertTo-Json -Depth 50
|
||||
|
||||
# Korruptions-Check: enthaelt der Payload noch stringifizierte .NET-Objekte
|
||||
# ("System.Collections.Hashtable" / "System.Object[]"), stammt die Quelldatei aus
|
||||
# einem alten Export mit zu geringer ConvertTo-Json-Tiefe. *TemplateReference
|
||||
# (optionale Metadaten) wurde oben bereits gerettet; verbleibende Marker sitzen in
|
||||
# WERT-tragenden Feldern (z.B. groupSettingCollectionValue) -> echte Konfiguration
|
||||
# ist verloren und nicht rekonstruierbar. Klar abbrechen statt kaputt zu importieren.
|
||||
if ($json -match 'System\.Collections\.Hashtable|System\.Object\[\]') {
|
||||
throw 'Quelldatei beschaedigt: Teile der Konfiguration wurden von einem alten Export (zu geringe JSON-Tiefe) zu ".ToString()" verstuemmelt und sind nicht wiederherstellbar. Bitte die Policy neu aus Graph exportieren und die frische Datei importieren.'
|
||||
}
|
||||
|
||||
return Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -Method POST -Body $json -ContentType 'application/json'
|
||||
}
|
||||
|
||||
@@ -563,6 +641,14 @@ function Import-PoliciesEndpoint {
|
||||
$results += @{ policyName = [string]$policyName; success = $false; error = 'Envelope ohne "policy"-Feld' }
|
||||
continue
|
||||
}
|
||||
# Optionale Umbenennung: das richtige Namensfeld je Typ setzen.
|
||||
$newName = [string](Get-PolicyProp $env 'newName')
|
||||
if ($newName -and $newName.Trim()) {
|
||||
$cfg = Get-PolicyTypeConfigByExportType $exportType
|
||||
$nameField = if ($cfg) { $cfg.NameField } else { 'displayName' }
|
||||
Set-PolicyProp $policy $nameField $newName.Trim()
|
||||
$policyName = $newName.Trim()
|
||||
}
|
||||
try {
|
||||
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
||||
$results += @{ policyName = [string]$policyName; exportType = $exportType; success = $true; newId = [string](Get-PolicyProp $imported 'id') }
|
||||
@@ -652,6 +738,161 @@ function Invoke-PolicyAssignEndpoint {
|
||||
return @{ ok = $true; assignedCount = $ok; results = @($results) }
|
||||
}
|
||||
|
||||
# ============================================================
|
||||
# Settings-Catalog-Policies zu EINER neuen Policy zusammenfuehren
|
||||
# ============================================================
|
||||
|
||||
# settingDefinitionId eines Settings-Elements (Wrapper { settingInstance, id }).
|
||||
function Get-SettingDefinitionId {
|
||||
param($SettingElement)
|
||||
$si = Get-PolicyProp $SettingElement 'settingInstance'
|
||||
if (-not $si) { $si = $SettingElement }
|
||||
return [string](Get-PolicyProp $si 'settingDefinitionId')
|
||||
}
|
||||
|
||||
# Kanonische, stabil sortierte JSON-Darstellung der settingInstance -> Wert-Vergleich
|
||||
# fuer die Konflikt-Erkennung (gleiche Definition, unterschiedlicher Wert = Konflikt).
|
||||
function Get-SettingCanonicalJson {
|
||||
param($SettingElement)
|
||||
$si = Get-PolicyProp $SettingElement 'settingInstance'
|
||||
if (-not $si) { $si = $SettingElement }
|
||||
return ((ConvertTo-StableObject $si) | ConvertTo-Json -Depth 50 -Compress)
|
||||
}
|
||||
|
||||
# Body: { ids:[...], mode:"preview"|"create", name?, description?, resolutions?:{ <defId>:<sourceId> } }
|
||||
# Nur Settings Catalog. Fuehrt die 'settings' mehrerer Policies zu einer neuen zusammen.
|
||||
# Gleiche settingDefinitionId + gleicher Wert -> einmal uebernommen. Gleiche Definition,
|
||||
# anderer Wert -> Konflikt: Default gewinnt die zuerst gewaehlte Policy, per 'resolutions'
|
||||
# ueberschreibbar. Import erfolgt als Neuanlage (nie Ueberschreiben).
|
||||
function Invoke-PolicyConsolidateEndpoint {
|
||||
param($Body)
|
||||
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||
|
||||
$ids = @(Get-PolicyProp $Body 'ids') | Where-Object { $_ }
|
||||
if (@($ids).Count -lt 2) { return @{ __status = 400; error = 'Bitte mindestens zwei Settings-Catalog-Policies auswaehlen.' } }
|
||||
|
||||
$mode = [string](Get-PolicyProp $Body 'mode'); if (-not $mode) { $mode = 'preview' }
|
||||
$resolutions = Get-PolicyProp $Body 'resolutions'
|
||||
|
||||
# Details laden (Reihenfolge = Auswahlreihenfolge = Default-Konfliktgewinner)
|
||||
$sources = @()
|
||||
foreach ($id in $ids) {
|
||||
$detail = $null
|
||||
try { $detail = Get-GraphPolicyDetail -Type 'settingscatalog' -Id ([string]$id) } catch {}
|
||||
if (-not $detail) { return @{ __status = 400; error = "Policy $id konnte nicht geladen werden." } }
|
||||
$sources += @{
|
||||
id = [string]$id
|
||||
name = [string](Get-PolicyProp $detail 'name')
|
||||
platforms = [string](Get-PolicyProp $detail 'platforms')
|
||||
technologies = [string](Get-PolicyProp $detail 'technologies')
|
||||
settings = @(Get-PolicyProp $detail 'settings')
|
||||
}
|
||||
}
|
||||
|
||||
# Plattform muss uebereinstimmen - sonst kein sinnvoller Merge.
|
||||
$platforms = @($sources | ForEach-Object { $_.platforms } | Where-Object { $_ } | Sort-Object -Unique)
|
||||
if ($platforms.Count -gt 1) {
|
||||
return @{ __status = 400; error = "Unterschiedliche Plattformen ($($platforms -join ', ')) - Zusammenfuehren nicht moeglich." }
|
||||
}
|
||||
$mergedPlatform = if ($platforms.Count -ge 1) { $platforms[0] } else { 'windows10' }
|
||||
# Technologies vereinen (Union).
|
||||
$techSet = [ordered]@{}
|
||||
foreach ($s in $sources) { foreach ($t in ($s.technologies -split ',')) { $tt = $t.Trim(); if ($tt) { $techSet[$tt] = $true } } }
|
||||
$mergedTech = (@($techSet.Keys) -join ','); if (-not $mergedTech) { $mergedTech = 'mdm' }
|
||||
|
||||
# Nach settingDefinitionId gruppieren (Reihenfolge der Definitionen beibehalten).
|
||||
$groups = [ordered]@{}
|
||||
foreach ($s in $sources) {
|
||||
foreach ($el in @($s.settings)) {
|
||||
if (-not $el) { continue }
|
||||
$defId = Get-SettingDefinitionId $el
|
||||
if (-not $defId) { continue }
|
||||
if (-not $groups.Contains($defId)) { $groups[$defId] = @() }
|
||||
$groups[$defId] += @{ sourceId = $s.id; sourceName = $s.name; element = $el; canon = (Get-SettingCanonicalJson $el) }
|
||||
}
|
||||
}
|
||||
|
||||
$mergedSettings = @()
|
||||
$conflicts = @()
|
||||
foreach ($defId in @($groups.Keys)) {
|
||||
$entries = @($groups[$defId])
|
||||
$distinct = @($entries | Group-Object -Property { $_.canon })
|
||||
if ($distinct.Count -eq 1) {
|
||||
$mergedSettings += $entries[0].element
|
||||
continue
|
||||
}
|
||||
# Konflikt: Gewinner bestimmen (resolutions[defId] = sourceId, sonst erste Quelle).
|
||||
$resSource = if ($resolutions) { [string](Get-PolicyProp $resolutions $defId) } else { '' }
|
||||
$chosen = $null
|
||||
if ($resSource) { $chosen = @($entries | Where-Object { $_.sourceId -eq $resSource })[0] }
|
||||
if (-not $chosen) { $chosen = $entries[0] }
|
||||
$mergedSettings += $chosen.element
|
||||
$conflicts += @{
|
||||
settingDefinitionId = $defId
|
||||
chosenSourceId = $chosen.sourceId
|
||||
variants = @($distinct | ForEach-Object {
|
||||
@{
|
||||
sourceIds = @($_.Group | ForEach-Object { $_.sourceId })
|
||||
sourceNames = @($_.Group | ForEach-Object { $_.sourceName } | Select-Object -Unique)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
if ($mode -ne 'create') {
|
||||
return @{
|
||||
ok = $true
|
||||
mode = 'preview'
|
||||
platform = $mergedPlatform
|
||||
technologies = $mergedTech
|
||||
totalSettings = @($mergedSettings).Count
|
||||
conflictCount = @($conflicts).Count
|
||||
conflicts = @($conflicts)
|
||||
sources = @($sources | ForEach-Object { @{ id = $_.id; name = $_.name; settingCount = @($_.settings).Count } })
|
||||
}
|
||||
}
|
||||
|
||||
# --- create ---
|
||||
if ($script:State.ReadOnly) { return @{ __status = 403; error = 'Read-Only-Modus: Zusammenfuehren ist deaktiviert.' } }
|
||||
$name = [string](Get-PolicyProp $Body 'name')
|
||||
if ([string]::IsNullOrWhiteSpace($name)) { return @{ __status = 400; error = 'Name fuer die neue Policy fehlt.' } }
|
||||
$desc = [string](Get-PolicyProp $Body 'description')
|
||||
|
||||
# settings fuer den POST vorbereiten: Wrapper mit @odata.type, read-only 'id' weg,
|
||||
# Arrays reparieren (gleiche Behandlung wie beim Import).
|
||||
$outSettings = @()
|
||||
foreach ($el in $mergedSettings) {
|
||||
$si = Get-PolicyProp $el 'settingInstance'
|
||||
if (-not $si) { $si = $el }
|
||||
$outSettings += [ordered]@{
|
||||
'@odata.type' = '#microsoft.graph.deviceManagementConfigurationSetting'
|
||||
settingInstance = $si
|
||||
}
|
||||
}
|
||||
$outSettings = @(Repair-SettingsCatalogArrays $outSettings)
|
||||
|
||||
$newBody = [ordered]@{
|
||||
name = $name
|
||||
description = $desc
|
||||
platforms = $mergedPlatform
|
||||
technologies = $mergedTech
|
||||
templateReference = @{ templateFamily = 'none'; templateId = '' }
|
||||
settings = $outSettings
|
||||
}
|
||||
$json = $newBody | ConvertTo-Json -Depth 50
|
||||
if ($json -match 'System\.Collections\.Hashtable|System\.Object\[\]') {
|
||||
return @{ __status = 500; error = 'Interner Serialisierungsfehler beim Zusammenfuehren (stringifizierte Objekte).' }
|
||||
}
|
||||
try {
|
||||
$created = Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -Method POST -Body $json -ContentType 'application/json'
|
||||
return @{ ok = $true; mode = 'create'; newId = [string](Get-PolicyProp $created 'id'); name = $name; settingsCount = @($outSettings).Count; conflictCount = @($conflicts).Count }
|
||||
} catch {
|
||||
$msg = $_.Exception.Message
|
||||
try { if ($_.ErrorDetails.Message) { $msg = $_.ErrorDetails.Message } } catch {}
|
||||
return @{ __status = 500; error = $msg }
|
||||
}
|
||||
}
|
||||
|
||||
# ============================================================
|
||||
# Policy-Snapshot nach Git (voller Export, stabile Dateinamen)
|
||||
# ============================================================
|
||||
@@ -675,9 +916,27 @@ function ConvertTo-StableObject {
|
||||
return $InputObject
|
||||
}
|
||||
|
||||
# git muss nicht im PATH des Server-Prozesses liegen (haeufig, wenn der Server vor
|
||||
# der Git-Installation gestartet wurde oder mit eingefrorener Umgebung laeuft).
|
||||
# Erst PATH probieren, dann bekannte Installationsorte. Ergebnis wird gecacht.
|
||||
function Get-GitExe {
|
||||
if ($script:GitExe -and (Test-Path $script:GitExe)) { return $script:GitExe }
|
||||
$cmd = Get-Command git -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
|
||||
if ($cmd) { $script:GitExe = $cmd.Source; return $script:GitExe }
|
||||
$cands = @()
|
||||
if ($env:ProgramFiles) { $cands += (Join-Path $env:ProgramFiles 'Git\cmd\git.exe') }
|
||||
if (${env:ProgramFiles(x86)}) { $cands += (Join-Path ${env:ProgramFiles(x86)} 'Git\cmd\git.exe') }
|
||||
if ($env:LOCALAPPDATA) { $cands += (Join-Path $env:LOCALAPPDATA 'Programs\Git\cmd\git.exe') }
|
||||
if ($env:LOCALAPPDATA) { $cands += (Join-Path $env:LOCALAPPDATA 'Microsoft\WinGet\Links\git.exe') }
|
||||
foreach ($c in $cands) { if ($c -and (Test-Path $c)) { $script:GitExe = $c; return $c } }
|
||||
return $null
|
||||
}
|
||||
|
||||
function Invoke-Git {
|
||||
param([Parameter(Mandatory=$true)][string]$RepoPath, [Parameter(Mandatory=$true)][string[]]$GitArgs)
|
||||
$out = & git -C $RepoPath @GitArgs 2>&1
|
||||
$exe = Get-GitExe
|
||||
if (-not $exe) { return @{ exit = 9009; out = 'git nicht gefunden (weder im PATH noch an bekannten Installationsorten).' } }
|
||||
$out = & $exe -C $RepoPath @GitArgs 2>&1
|
||||
return @{ exit = $LASTEXITCODE; out = (@($out) -join "`n").Trim() }
|
||||
}
|
||||
|
||||
@@ -700,9 +959,10 @@ function Invoke-PolicyGitSnapshotEndpoint {
|
||||
return @{ __status = 400; error = 'Kein Git-Repo-Pfad konfiguriert (Einstellungen -> Policy-Backup).' }
|
||||
}
|
||||
|
||||
# git verfuegbar?
|
||||
try { $null = & git --version 2>&1; if ($LASTEXITCODE -ne 0) { throw 'x' } }
|
||||
catch { return @{ __status = 500; error = 'git ist nicht installiert oder nicht im PATH.' } }
|
||||
# git verfuegbar? (PATH + bekannte Installationsorte)
|
||||
if (-not (Get-GitExe)) {
|
||||
return @{ __status = 500; error = 'git ist nicht auffindbar (weder im PATH des Server-Prozesses noch an den Standard-Installationsorten). Ggf. Server nach der Git-Installation neu starten.' }
|
||||
}
|
||||
|
||||
# Repo-Ordner + .git sicherstellen
|
||||
if (-not (Test-Path $repo)) { New-Item -ItemType Directory -Path $repo -Force | Out-Null }
|
||||
|
||||
+864
-64
File diff suppressed because it is too large
Load Diff
+230
-21
@@ -37,6 +37,7 @@
|
||||
<button class="nav-tab" data-view="report" aria-selected="false">App Report</button>
|
||||
<button class="nav-tab" data-view="devices" aria-selected="false">Geräte</button>
|
||||
<button class="nav-tab" data-view="policies" aria-selected="false">Policies</button>
|
||||
<button class="nav-tab" data-view="offboard" aria-selected="false">Offboarding</button>
|
||||
</nav>
|
||||
|
||||
<div class="header-actions">
|
||||
@@ -125,7 +126,7 @@
|
||||
<section class="panel panel-targets">
|
||||
<div class="panel-head">
|
||||
<div class="panel-title">
|
||||
<h2>Abteilungen & Benutzer</h2>
|
||||
<h2>Gruppen & Benutzer</h2>
|
||||
<span id="targetCount" class="count-badge">0</span>
|
||||
</div>
|
||||
<button id="btnReloadTargets" class="icon-btn" title="Neu laden" aria-label="Neu laden">
|
||||
@@ -134,7 +135,7 @@
|
||||
</div>
|
||||
|
||||
<div class="mode-segment" role="tablist">
|
||||
<button class="seg active" data-mode="dept" role="tab">Abteilung</button>
|
||||
<button class="seg active" data-mode="dept" role="tab">Gruppe</button>
|
||||
<button class="seg" data-mode="user" role="tab">Benutzer</button>
|
||||
</div>
|
||||
|
||||
@@ -192,6 +193,11 @@
|
||||
<option value="srcIntune">Nur Intune-Apps</option>
|
||||
<!-- Vendor-Optionen werden dynamisch von rebuildVendorFilterOptions() ergaenzt -->
|
||||
</select>
|
||||
<select id="appPlatformFilter" class="select" title="Nach Plattform filtern">
|
||||
<option value="all">Alle Plattformen</option>
|
||||
<option value="windows">Windows</option>
|
||||
<option value="macos">macOS</option>
|
||||
</select>
|
||||
<select id="appCategoryFilter" class="select" title="Nach App-Kategorie filtern">
|
||||
<option value="">Alle Kategorien</option>
|
||||
<!-- Kategorie-Optionen werden dynamisch von rebuildCategoryFilterOptions() befuellt -->
|
||||
@@ -243,7 +249,7 @@
|
||||
<div class="summary-section">
|
||||
<div class="summary-section-title">Ausgewählte Empfänger</div>
|
||||
<div class="summary-row sub">
|
||||
<span class="muted">Abteilungsgruppen</span>
|
||||
<span class="muted">Gruppen</span>
|
||||
<span id="sumGroupsSel">0</span>
|
||||
</div>
|
||||
<div class="summary-row sub">
|
||||
@@ -254,7 +260,7 @@
|
||||
<div class="summary-section">
|
||||
<div class="summary-section-title">Zuweisungen erhalten</div>
|
||||
<div class="summary-row sub">
|
||||
<span class="muted">Abteilungsgruppen</span>
|
||||
<span class="muted">Gruppen</span>
|
||||
<span id="sumGroupsOps">0</span>
|
||||
</div>
|
||||
<div class="summary-row sub">
|
||||
@@ -291,7 +297,7 @@
|
||||
<!-- Tab-Leiste -->
|
||||
<div class="gex-tab-bar group-mgmt-tabs">
|
||||
<button class="gex-tab active" data-tab="export">Mitglieder & Export</button>
|
||||
<button class="gex-tab gex-add-pane" data-tab="add">Benutzer hinzufügen</button>
|
||||
<button class="gex-tab gex-add-pane" data-tab="add">Benutzer | Gruppen hinzufügen</button>
|
||||
<button class="gex-tab gex-add-pane" data-tab="import">CSV-Import</button>
|
||||
<button class="gex-tab" data-tab="user">Benutzer</button>
|
||||
</div>
|
||||
@@ -380,7 +386,11 @@
|
||||
|
||||
<!-- Rechte Spalte: Benutzer hinzufügen -->
|
||||
<div class="gex-right hidden" id="gexPaneAdd">
|
||||
<div class="gex-section-title">Benutzer suchen</div>
|
||||
<div class="gex-addmode">
|
||||
<button type="button" class="gex-addmode-btn active" data-addmode="user">Benutzer</button>
|
||||
<button type="button" class="gex-addmode-btn" data-addmode="group">Gruppen</button>
|
||||
</div>
|
||||
<div class="gex-section-title" id="gexAddSearchTitle">Benutzer suchen</div>
|
||||
<div class="search-wrap" style="margin-bottom:10px;">
|
||||
<svg class="search-ico" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="11" cy="11" r="7"/><path d="M21 21l-4.3-4.3"/></svg>
|
||||
<input type="search" id="gexUserSearch" class="input input-search" placeholder="Name, UPN oder E-Mail…" autocomplete="off">
|
||||
@@ -486,6 +496,17 @@
|
||||
<option value="noncompliant">Non-Compliant</option>
|
||||
<option value="unknown">Unbekannt</option>
|
||||
</select>
|
||||
<div id="devGroupWrap" style="position:relative;">
|
||||
<input type="search" id="devGroupSearch" placeholder="Nach Gruppe filtern…" autocomplete="off"
|
||||
style="height:34px;padding:0 24px 0 10px;border:1px solid var(--hairline);border-radius:6px;background:var(--canvas);color:var(--ink);font-size:12.5px;width:200px;box-sizing:border-box;">
|
||||
<button id="devGroupClear" type="button" title="Gruppen-Filter entfernen" hidden
|
||||
style="position:absolute;right:6px;top:50%;transform:translateY(-50%);background:none;border:none;color:var(--muted);cursor:pointer;font-size:16px;line-height:1;padding:0;">×</button>
|
||||
<div id="devGroupResults" class="dev-group-results hidden"></div>
|
||||
</div>
|
||||
<button id="btnDevExport" class="btn btn-secondary btn-sm" disabled title="Angezeigte Geräte als CSV exportieren">
|
||||
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
|
||||
CSV
|
||||
</button>
|
||||
</div>
|
||||
|
||||
<div class="dev-layout">
|
||||
@@ -588,6 +609,10 @@
|
||||
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><line x1="12" y1="3" x2="12" y2="9"/><line x1="12" y1="15" x2="12" y2="21"/><circle cx="12" cy="3" r="1"/><circle cx="12" cy="21" r="1"/></svg>
|
||||
Git-Snapshot
|
||||
</button>
|
||||
<button class="btn btn-secondary btn-sm pol-write" id="btnPolConsolidate" disabled title="Ausgewählte Settings-Catalog-Policies zu einer neuen Policy zusammenführen">
|
||||
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M7 3v6a3 3 0 0 0 3 3h4a3 3 0 0 1 3 3v6"/><polyline points="3 7 7 3 11 7"/><polyline points="13 17 17 21 21 17"/></svg>
|
||||
Konsolidieren
|
||||
</button>
|
||||
<button class="btn btn-primary btn-sm" id="btnPolExport" disabled title="Ausgewählte Policies als JSON exportieren">
|
||||
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
|
||||
Export (<span id="polSelCount">0</span>)
|
||||
@@ -611,6 +636,44 @@
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<!-- ======================= OFFBOARDING ======================= -->
|
||||
<section class="off-view hidden" id="offView">
|
||||
<div class="off-bar">
|
||||
<select id="offSearchType" class="input" style="height:34px;max-width:170px;">
|
||||
<option value="name">Gerätename</option>
|
||||
<option value="serial">Seriennummer</option>
|
||||
</select>
|
||||
<input id="offSearch" class="input" placeholder="Suchen… (Enter)" style="max-width:320px;height:34px;">
|
||||
<button class="btn btn-secondary btn-sm" id="offSearchBtn">Suchen</button>
|
||||
<span class="off-bar-spacer" style="flex:1;"></span>
|
||||
<span id="offSelCount" class="muted">0 ausgewählt</span>
|
||||
<button class="btn btn-danger btn-sm" id="offBtn" disabled>Offboarding…</button>
|
||||
</div>
|
||||
<div class="off-note muted">
|
||||
Entfernt Geräte aus <b>Intune</b>, <b>Autopilot</b> und <b>Entra ID</b>. BitLocker-/FileVault-Keys und
|
||||
LAPS-Passwörter werden vor dem Löschen angezeigt. Benötigt zusätzliche Berechtigungen & Admin-Rollen
|
||||
(siehe <code>docs/App-Registration.md</code>) — im Read-Only-Modus gesperrt.
|
||||
</div>
|
||||
<div class="off-table-wrap">
|
||||
<table class="pol-table off-table" id="offTable">
|
||||
<thead>
|
||||
<tr>
|
||||
<th style="width:34px;"><input type="checkbox" id="offCheckAll"></th>
|
||||
<th>Gerät</th>
|
||||
<th>Seriennr.</th>
|
||||
<th>OS</th>
|
||||
<th>Benutzer</th>
|
||||
<th>Letzter Sync</th>
|
||||
<th>Dienste</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody id="offBody">
|
||||
<tr><td colspan="7" class="pol-hint">Nach Geräten suchen…</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<!-- MODAL: Wipe -->
|
||||
<div class="modal-backdrop hidden" id="wipeModalBackdrop">
|
||||
<div class="modal" style="max-width:420px;">
|
||||
@@ -672,6 +735,13 @@
|
||||
<span class="cg-mode-desc">Neue Required-Gruppe nach Naming-Schema erstellen und zuweisen.</span>
|
||||
</span>
|
||||
</label>
|
||||
<label class="cg-mode">
|
||||
<input type="radio" name="cgMode" value="req-existing">
|
||||
<span class="cg-mode-body">
|
||||
<span class="cg-mode-title">Bestehende Gruppe</span>
|
||||
<span class="cg-mode-desc">Eine vorhandene Entra-Gruppe als Required zuweisen.</span>
|
||||
</span>
|
||||
</label>
|
||||
<label class="cg-mode">
|
||||
<input type="radio" name="cgMode" value="req-allusers">
|
||||
<span class="cg-mode-body">
|
||||
@@ -700,6 +770,13 @@
|
||||
<span class="cg-mode-desc">Neue Available-Gruppe nach Naming-Schema erstellen und zuweisen.</span>
|
||||
</span>
|
||||
</label>
|
||||
<label class="cg-mode">
|
||||
<input type="radio" name="cgMode" value="avail-existing">
|
||||
<span class="cg-mode-body">
|
||||
<span class="cg-mode-title">Bestehende Gruppe</span>
|
||||
<span class="cg-mode-desc">Eine vorhandene Entra-Gruppe als Available zuweisen.</span>
|
||||
</span>
|
||||
</label>
|
||||
<label class="cg-mode">
|
||||
<input type="radio" name="cgMode" value="avail-allusers">
|
||||
<span class="cg-mode-body">
|
||||
@@ -723,6 +800,12 @@
|
||||
<input type="text" id="cgGroupName" class="input">
|
||||
<div id="cgStatus" class="form-hint"></div>
|
||||
</div>
|
||||
<div class="form-group" id="cgExistingGroup" hidden>
|
||||
<label class="lbl" for="cgExistingSearch">Bestehende Gruppe suchen</label>
|
||||
<input type="search" id="cgExistingSearch" class="input" placeholder="Gruppenname… (min. 2 Zeichen)" autocomplete="off">
|
||||
<div id="cgExistingResults" class="cg-existing-results"></div>
|
||||
<div id="cgExistingSelected" class="form-hint"></div>
|
||||
</div>
|
||||
<label class="check-chip" id="cgAssignToAppWrap">
|
||||
<input type="checkbox" id="cgAssignToApp" checked>
|
||||
<span>Gruppe direkt der App zuweisen</span>
|
||||
@@ -813,6 +896,61 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- MODAL: Policy-Import (optional umbenennen) -->
|
||||
<div id="modalPolImport" class="modal hidden">
|
||||
<div class="modal-backdrop" data-close></div>
|
||||
<div class="modal-box modal-lg">
|
||||
<div class="modal-head">
|
||||
<h3>Policies importieren</h3>
|
||||
<button class="modal-close" data-close aria-label="Schließen">×</button>
|
||||
</div>
|
||||
<div class="modal-body">
|
||||
<div class="form-hint" style="margin-bottom:12px;">
|
||||
Namen können vor dem Import angepasst werden. Die Policies werden als
|
||||
<b>Neuanlage</b> im verbundenen Tenant erstellt — bestehende bleiben unverändert.
|
||||
</div>
|
||||
<div id="polImportList"></div>
|
||||
</div>
|
||||
<div class="modal-foot">
|
||||
<span id="polImportInfo" class="muted" style="margin-right:auto;"></span>
|
||||
<button class="btn btn-secondary" data-close>Abbrechen</button>
|
||||
<button class="btn btn-primary" id="polImportConfirm">Importieren</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- MODAL: Policies konsolidieren (Settings Catalog) -->
|
||||
<div id="modalPolConsolidate" class="modal hidden">
|
||||
<div class="modal-backdrop" data-close></div>
|
||||
<div class="modal-box modal-lg">
|
||||
<div class="modal-head">
|
||||
<h3>Policies zusammenführen</h3>
|
||||
<button class="modal-close" data-close aria-label="Schließen">×</button>
|
||||
</div>
|
||||
<div class="modal-body">
|
||||
<div class="form-hint" style="margin-bottom:12px;">
|
||||
Die Einstellungen der ausgewählten <b>Settings-Catalog</b>-Policies werden zu
|
||||
<b>einer neuen</b> Policy vereint (Neuanlage — die Originale bleiben unverändert).
|
||||
</div>
|
||||
<div id="polConsSummary" class="pol-cons-summary"></div>
|
||||
<div id="polConsConflicts"></div>
|
||||
<div class="form-group" style="margin-top:12px;">
|
||||
<label class="lbl" for="polConsName">Name der neuen Policy</label>
|
||||
<input type="text" id="polConsName" class="input" placeholder="z. B. Konsolidiert – Defender macOS">
|
||||
</div>
|
||||
<div class="form-group">
|
||||
<label class="lbl" for="polConsDesc">Beschreibung (optional)</label>
|
||||
<input type="text" id="polConsDesc" class="input">
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal-foot">
|
||||
<span id="polConsInfo" class="muted" style="margin-right:auto;"></span>
|
||||
<button class="btn btn-secondary" data-close>Abbrechen</button>
|
||||
<button class="btn btn-primary" id="polConsConfirm" disabled>Zusammenführen</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- MODAL: Policy-Zuweisung nach Import -->
|
||||
<div id="modalPolAssign" class="modal hidden">
|
||||
<div class="modal-backdrop" data-close></div>
|
||||
@@ -835,28 +973,99 @@
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- MODAL: Geräte-Offboarding -->
|
||||
<div id="modalOffboard" class="modal hidden">
|
||||
<div class="modal-backdrop" data-close></div>
|
||||
<div class="modal-box modal-lg">
|
||||
<div class="modal-head">
|
||||
<h3>Geräte offboarden</h3>
|
||||
<button class="modal-close" data-close aria-label="Schließen">×</button>
|
||||
</div>
|
||||
<div class="modal-body">
|
||||
<div class="off-warn">⚠ Entfernt die Geräte aus den gewählten Diensten. Löschen ist <b>nicht umkehrbar</b>. Recovery-Keys unbedingt vorher sichern.</div>
|
||||
<div id="offConfirmList" class="off-confirm-list"></div>
|
||||
|
||||
<div class="off-services">
|
||||
<div class="lbl">Dienste</div>
|
||||
<div class="off-svc-row">
|
||||
<span class="off-svc-label">Entra ID:</span>
|
||||
<label class="off-radio"><input type="radio" name="offEntra" value="none" checked> nichts tun</label>
|
||||
<label class="off-radio"><input type="radio" name="offEntra" value="disable"> deaktivieren</label>
|
||||
<label class="off-radio"><input type="radio" name="offEntra" value="delete"> löschen</label>
|
||||
</div>
|
||||
<label class="check-chip"><input type="checkbox" id="offSvcIntune" checked><span>Aus Intune löschen</span></label>
|
||||
<label class="check-chip"><input type="checkbox" id="offSvcAutopilot"><span>Aus Autopilot löschen</span></label>
|
||||
</div>
|
||||
|
||||
<div id="offKeys" class="off-keys"></div>
|
||||
|
||||
<label class="check-chip off-confirm-chip"><input type="checkbox" id="offConfirmChk"><span>Ich verstehe, dass die Geräte gelöscht/entfernt werden.</span></label>
|
||||
<div id="offResults"></div>
|
||||
</div>
|
||||
<div class="modal-foot">
|
||||
<span id="offModalInfo" class="muted" style="margin-right:auto;"></span>
|
||||
<button class="btn btn-secondary" data-close>Abbrechen</button>
|
||||
<button class="btn btn-danger" id="offExecuteBtn" disabled>Offboarding ausführen</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<style>
|
||||
.pol-assign-row { border:1px solid var(--border, #d9dce3); border-radius:8px; padding:12px 14px; margin-bottom:12px; }
|
||||
.pol-assign-head { display:flex; align-items:center; gap:8px; margin-bottom:10px; }
|
||||
.pol-assign-head .pol-name { font-weight:600; }
|
||||
/* Nutzt die Theme-Variablen der App -> passt sich Light/Dark automatisch an. */
|
||||
.pol-assign-row { border:1px solid var(--hairline); border-radius:8px; padding:12px 14px; margin-bottom:12px; overflow-wrap:anywhere; }
|
||||
.pol-assign-head { display:flex; align-items:baseline; gap:8px; margin-bottom:10px; flex-wrap:wrap; }
|
||||
.pol-assign-head .pol-name { font-weight:600; color:var(--ink); min-width:0; word-break:break-word; overflow-wrap:anywhere; }
|
||||
.pol-assign-head .pol-type-badge { flex:0 0 auto; }
|
||||
.pol-assign-pickers { display:flex; gap:16px; flex-wrap:wrap; }
|
||||
.pol-assign-picker { flex:1; min-width:220px; }
|
||||
.pol-assign-picker > .lbl { display:block; font-size:12px; margin-bottom:4px; opacity:.85; }
|
||||
.pol-assign-picker[data-kind="exclude"] > .lbl { color:#cb2a7a; }
|
||||
.pol-assign-picker > .lbl { display:block; font-size:12px; margin-bottom:4px; color:var(--body); }
|
||||
.pol-assign-picker[data-kind="exclude"] > .lbl { color:var(--pink); }
|
||||
.pol-assign-chips { display:flex; flex-wrap:wrap; gap:6px; margin-bottom:6px; }
|
||||
.pol-assign-chip { display:inline-flex; align-items:center; gap:6px; padding:2px 8px; border-radius:12px;
|
||||
background:var(--chip-bg, #eef0f5); font-size:12px; }
|
||||
.pol-assign-chip.exclude { background:#fbe3ef; }
|
||||
.pol-assign-chip button { border:none; background:none; cursor:pointer; font-size:14px; line-height:1; padding:0; opacity:.6; }
|
||||
.pol-assign-chip button:hover { opacity:1; }
|
||||
background:var(--surface-strong); color:var(--ink); font-size:12px; }
|
||||
.pol-assign-chip.exclude { background:rgba(236,72,153,0.18); color:var(--ink); }
|
||||
.pol-assign-chip button { border:none; background:none; cursor:pointer; font-size:14px; line-height:1; padding:0; color:var(--muted); }
|
||||
.pol-assign-chip button:hover { color:var(--ink); }
|
||||
.pol-assign-search-wrap { position:relative; }
|
||||
.pol-assign-dropdown { position:absolute; z-index:20; left:0; right:0; top:100%; margin-top:2px;
|
||||
background:var(--panel, #fff); border:1px solid var(--border, #d9dce3); border-radius:6px;
|
||||
max-height:200px; overflow-y:auto; box-shadow:0 6px 18px rgba(0,0,0,.12); }
|
||||
.pol-assign-dropdown .opt { padding:6px 10px; cursor:pointer; font-size:13px; }
|
||||
.pol-assign-dropdown .opt:hover { background:var(--chip-bg, #eef0f5); }
|
||||
.pol-assign-dropdown .opt .desc { font-size:11px; opacity:.6; }
|
||||
.pol-assign-dropdown .msg { padding:6px 10px; font-size:12px; opacity:.6; }
|
||||
background:var(--canvas); border:1px solid var(--hairline); border-radius:6px;
|
||||
max-height:200px; overflow-y:auto; box-shadow:0 6px 18px rgba(0,0,0,.25); }
|
||||
.pol-assign-dropdown .opt { padding:6px 10px; cursor:pointer; font-size:13px; color:var(--body); }
|
||||
.pol-assign-dropdown .opt:hover { background:var(--surface-soft); }
|
||||
.pol-assign-dropdown .opt .desc { font-size:11px; color:var(--muted); }
|
||||
.pol-assign-dropdown .msg { padding:6px 10px; font-size:12px; color:var(--muted); }
|
||||
.pol-import-row { display:flex; align-items:center; gap:10px; padding:8px 0; border-bottom:1px solid var(--hairline); }
|
||||
.pol-import-row:last-child { border-bottom:none; }
|
||||
.pol-import-name { flex:1; min-width:0; }
|
||||
.pol-import-row .pol-type-badge { flex:0 0 auto; }
|
||||
/* Offboarding */
|
||||
.off-view { padding:16px 20px; }
|
||||
.off-bar { display:flex; align-items:center; gap:10px; margin-bottom:10px; flex-wrap:wrap; }
|
||||
.off-note { font-size:12.5px; margin-bottom:12px; line-height:1.5; }
|
||||
.off-table-wrap { overflow-x:auto; }
|
||||
.off-table td, .off-table th { white-space:nowrap; }
|
||||
.off-badge { display:inline-block; padding:1px 7px; border-radius:10px; font-size:11px; background:var(--surface-strong); color:var(--ink); margin-right:3px; }
|
||||
.off-badge.warn { background:rgba(245,158,11,0.22); }
|
||||
.off-warn { background:rgba(239,68,68,0.14); border:1px solid rgba(239,68,68,0.35); color:var(--ink);
|
||||
border-radius:8px; padding:10px 12px; font-size:13px; margin-bottom:12px; }
|
||||
.off-confirm-list { margin-bottom:12px; }
|
||||
.off-confirm-row { font-size:13px; padding:4px 0; border-bottom:1px solid var(--hairline); overflow-wrap:anywhere; }
|
||||
.off-confirm-row:last-child { border-bottom:none; }
|
||||
.off-services { margin:12px 0; padding:12px; border:1px solid var(--hairline); border-radius:8px; }
|
||||
.off-services .lbl { display:block; font-size:12px; color:var(--body); margin-bottom:8px; }
|
||||
.off-svc-row { display:flex; align-items:center; gap:14px; flex-wrap:wrap; margin-bottom:10px; }
|
||||
.off-svc-label { font-size:13px; color:var(--ink); font-weight:600; }
|
||||
.off-radio { display:inline-flex; align-items:center; gap:5px; font-size:13px; cursor:pointer; }
|
||||
.off-keys { margin:12px 0; }
|
||||
.off-keys .lbl { display:block; font-size:12px; color:var(--pink); margin-bottom:6px; }
|
||||
.off-key-dev { border:1px solid var(--hairline); border-radius:6px; padding:8px 10px; margin-bottom:6px; font-size:12.5px; overflow-wrap:anywhere; }
|
||||
.off-key { margin-top:3px; }
|
||||
.off-key code { background:var(--surface-strong); color:var(--ink); padding:1px 5px; border-radius:4px; user-select:all; }
|
||||
.off-confirm-chip { margin-top:8px; }
|
||||
.off-result { font-size:13px; padding:3px 0; overflow-wrap:anywhere; }
|
||||
.off-result.ok { color:var(--success); }
|
||||
.off-result.fail { color:var(--error); }
|
||||
#offResults .lbl { display:block; font-size:12px; color:var(--body); margin:10px 0 4px; }
|
||||
</style>
|
||||
|
||||
<!-- MODAL: Hilfe -->
|
||||
|
||||
+121
@@ -1129,6 +1129,21 @@ a.target-link:hover {
|
||||
}
|
||||
.target-row:hover .entra-link,
|
||||
.ex-member-row:hover .entra-link { opacity: 1; }
|
||||
|
||||
/* Gruppen-Filter-Dropdown im Geraete-Tab (nutzt .cg-existing-item fuer die Zeilen) */
|
||||
.dev-group-results {
|
||||
position: absolute;
|
||||
z-index: 40;
|
||||
top: 38px;
|
||||
left: 0;
|
||||
min-width: 220px;
|
||||
max-height: 260px;
|
||||
overflow-y: auto;
|
||||
background: var(--canvas);
|
||||
border: 1px solid var(--hairline);
|
||||
border-radius: 6px;
|
||||
box-shadow: 0 8px 24px rgba(0,0,0,0.28);
|
||||
}
|
||||
.entra-link:hover {
|
||||
background: var(--surface-soft);
|
||||
color: var(--brand-accent);
|
||||
@@ -1327,6 +1342,7 @@ html[data-theme="dark"] .entra-link.teams-link:hover {
|
||||
border-radius: var(--r-md);
|
||||
}
|
||||
|
||||
|
||||
.member-row {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
@@ -4020,6 +4036,67 @@ body.members-page {
|
||||
color: var(--muted);
|
||||
}
|
||||
|
||||
/* "Bestehende Gruppe" — Suchergebnis-Liste im Zuweisungs-Dialog */
|
||||
.cg-existing-results {
|
||||
margin-top: 8px;
|
||||
max-height: 220px;
|
||||
overflow-y: auto;
|
||||
border: 1px solid var(--hairline-soft);
|
||||
border-radius: var(--r-xs);
|
||||
}
|
||||
.cg-existing-results:empty { display: none; }
|
||||
.cg-existing-item {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 2px;
|
||||
width: 100%;
|
||||
text-align: left;
|
||||
padding: 8px 12px;
|
||||
background: transparent;
|
||||
border: none;
|
||||
border-bottom: 1px solid var(--hairline-soft);
|
||||
cursor: pointer;
|
||||
color: inherit;
|
||||
}
|
||||
.cg-existing-item:last-child { border-bottom: none; }
|
||||
.cg-existing-item:hover { background: var(--hover, rgba(127,127,127,0.08)); }
|
||||
.cg-existing-item.is-selected { background: var(--accent-soft); }
|
||||
.cg-existing-name { font-size: 13px; font-weight: 600; }
|
||||
.cg-existing-desc { font-size: 11px; color: var(--muted); }
|
||||
.cg-existing-empty { padding: 10px 12px; font-size: 12px; color: var(--muted); }
|
||||
|
||||
/* Ausgewaehlte Gruppen als Chips (Mehrfachauswahl) */
|
||||
.cg-existing-chips {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
gap: 6px;
|
||||
margin-top: 8px;
|
||||
}
|
||||
.cg-chip {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
gap: 6px;
|
||||
padding: 3px 6px 3px 10px;
|
||||
background: var(--accent-soft);
|
||||
color: var(--brand-accent);
|
||||
border-radius: 999px;
|
||||
font-size: 12px;
|
||||
font-weight: 600;
|
||||
max-width: 100%;
|
||||
}
|
||||
.cg-chip-name { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 220px; }
|
||||
.cg-chip-x {
|
||||
border: none;
|
||||
background: transparent;
|
||||
color: inherit;
|
||||
cursor: pointer;
|
||||
font-size: 15px;
|
||||
line-height: 1;
|
||||
padding: 0 2px;
|
||||
opacity: 0.75;
|
||||
}
|
||||
.cg-chip-x:hover { opacity: 1; }
|
||||
|
||||
.cg-mode {
|
||||
display: flex;
|
||||
align-items: flex-start;
|
||||
@@ -4554,6 +4631,25 @@ html[data-theme="dark"] .numInputWrapper span.arrowDown {
|
||||
flex-shrink: 0;
|
||||
}
|
||||
|
||||
/* Umschalter Benutzer/Gruppen im "Hinzufuegen"-Pane */
|
||||
.gex-addmode { display: flex; gap: 6px; margin-bottom: 12px; }
|
||||
.gex-addmode-btn {
|
||||
flex: 1;
|
||||
padding: 6px 10px;
|
||||
border: 1px solid var(--hairline);
|
||||
border-radius: var(--r-sm, 6px);
|
||||
background: var(--canvas);
|
||||
color: var(--muted);
|
||||
font-size: 12.5px;
|
||||
font-weight: 600;
|
||||
cursor: pointer;
|
||||
}
|
||||
.gex-addmode-btn.active {
|
||||
background: var(--accent-soft);
|
||||
color: var(--brand-accent);
|
||||
border-color: var(--brand-accent);
|
||||
}
|
||||
|
||||
.gex-tab {
|
||||
padding: 10px 18px;
|
||||
font-size: 13px;
|
||||
@@ -5367,6 +5463,31 @@ body.read-only .app-row {
|
||||
border: 1px solid var(--border);
|
||||
border-radius: 6px;
|
||||
}
|
||||
|
||||
/* Policies konsolidieren — Modal */
|
||||
.pol-cons-summary { font-size: 13px; line-height: 1.6; }
|
||||
.pol-cons-summary .pol-cons-warn { color: var(--pink, #e0567a); }
|
||||
.pol-cons-err { color: var(--pink, #e0567a); font-size: 13px; }
|
||||
.pol-cons-src { margin: 6px 0 0; padding-left: 18px; font-size: 12px; }
|
||||
.pol-cons-src li { margin: 1px 0; }
|
||||
.pol-cons-conf-head { margin: 14px 0 6px; font-weight: 600; font-size: 13px; }
|
||||
.pol-cons-conf {
|
||||
border: 1px solid var(--hairline-soft, var(--border));
|
||||
border-radius: var(--r-xs, 6px);
|
||||
padding: 8px 10px;
|
||||
margin-bottom: 6px;
|
||||
}
|
||||
.pol-cons-def {
|
||||
font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
|
||||
font-size: 11px;
|
||||
color: var(--muted);
|
||||
overflow: hidden;
|
||||
text-overflow: ellipsis;
|
||||
white-space: nowrap;
|
||||
margin-bottom: 6px;
|
||||
}
|
||||
.pol-cons-opts { display: flex; flex-wrap: wrap; gap: 6px 16px; }
|
||||
.pol-cons-opt { display: inline-flex; align-items: center; gap: 6px; font-size: 12px; cursor: pointer; }
|
||||
.pol-table { width: 100%; border-collapse: collapse; font-size: 13px; }
|
||||
.pol-table thead { position: sticky; top: 0; z-index: 2; background: var(--bg2); }
|
||||
.pol-table th {
|
||||
|
||||
Reference in New Issue
Block a user