Skip to content

Commit 762c6a0

Browse files
subray2014subray2014
committed
commit
1 parent 429fca1 commit 762c6a0

File tree

5 files changed

+56
-206
lines changed

5 files changed

+56
-206
lines changed

‎src/Teams/beta/custom/GetMgBetaTeamRscConfiguration_Get.cs‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -242,11 +242,6 @@ protected override void ProcessRecord()
242242

243243
WriteVerbose($"Fetched permission grant policies for tenant.");
244244

245-
// Get Group consent settings
246-
MGTeamsInternalTenantConsentSettingsCollection tenantConsentSettingCollection = await this.Client.GetTenantConsentSettings(this, Pipeline);
247-
248-
WriteVerbose($"Fetched Tenant App Settings for tenant.");
249-
250245
if (((Microsoft.Graph.Beta.PowerShell.Runtime.IEventListener)this).Token.IsCancellationRequested) { return; }
251246

252247
// Get authorization policy
@@ -259,7 +254,6 @@ protected override void ProcessRecord()
259254
RscConfigurationSynthesizer rscConfigurationConverter = new RscConfigurationSynthesizer();
260255
Models.IMicrosoftGraphRscConfiguration microsoftGraphRscConfiguration = rscConfigurationConverter.ConvertToTeamRscConfiguration(
261256
permissionGrantPolicyCollection,
262-
tenantConsentSettingCollection,
263257
authorizationPolicy,
264258
this);
265259

‎src/Teams/beta/custom/MicrosoftGraphRscConfigurationState.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,9 @@ public enum MicrosoftGraphRscConfigurationState
2424
EnabledForAllApps,
2525

2626
/// <summary>
27-
/// Enabled for selected group of users.
27+
/// RSC configuration is managed by Microsoft.
2828
/// </summary>
29-
EnabledForSelectedGroupOfUsers,
29+
ManagedByMicrosoft,
3030

3131
/// <summary>
3232
/// Custom configuration not understood by the sdk.

‎src/Teams/beta/custom/RscConfigurationSynthesizer.cs‎

Lines changed: 36 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,19 @@
1313
/// </summary>
1414
internal class RscConfigurationSynthesizer
1515
{
16-
internal const string MicrosoftCreatedPermissionGrantPolicyForChatRscPreApproval = "ManagePermissionGrantsForOwnedResource.microsoft-pre-approval-apps-for-chat";
16+
internal const string GroupConsentSettingsTemplateId = "dffd5d46-495d-40a9-8e21-954ff55e198a";
1717

18-
internal const string MicrosoftCreatedPermissionGrantPolicyForTeamRscPreApproval = "ManagePermissionGrantsForOwnedResource.microsoft-pre-approval-apps-for-group";
18+
internal const string MicrosoftCreatedPermissionGrantPolicyEnabledForPreapprovedAppsForChats = "ManagePermissionGrantsForOwnedResource.microsoft-pre-approval-apps-for-chat";
1919

20-
internal const string MicrosoftCreatedPermissionGrantPolicyForUserConsentLegacy = "ManagePermissionGrantsForSelf.microsoft-user-default-legacy";
20+
internal const string MicrosoftCreatedPermissionGrantPolicyEnabledForAllAppsForChats = "ManagePermissionGrantsForOwnedResource.microsoft-pre-approval-apps-for-chat";
2121

22-
internal const string GroupConsentSettingsTemplateId = "dffd5d46-495d-40a9-8e21-954ff55e198a";
22+
internal const string MicrosoftCreatedPermissionGrantPolicyManagedByMicrosoftForChats = "ManagePermissionGrantsForOwnedResource.microsoft-dynamically-managed-permissions-for-chat";
2323

24-
internal const string EnableGroupSpecificConsentKey = "EnableGroupSpecificConsent";
24+
internal const string MicrosoftCreatedPermissionGrantPolicyEnabledForPreapprovedAppsForTeams = "ManagePermissionGrantsForOwnedResource.microsoft-pre-approval-apps-for-team";
2525

26-
internal const string ConstrainGroupSpecificConsentToMembersOfGroupIdKey = "ConstrainGroupSpecificConsentToMembersOfGroupId";
26+
internal const string MicrosoftCreatedPermissionGrantPolicyEnabledForAllAppsForTeams = "ManagePermissionGrantsForOwnedResource.microsoft-all-application-permissions-for-team";
27+
28+
internal const string MicrosoftCreatedPermissionGrantPolicyManagedByMicrosoftForTeams = "ManagePermissionGrantsForOwnedResource.microsoft-dynamically-managed-permissions-for-team";
2729

2830
/// <summary>
2931
/// Initializes a new instance of the <see cref="RscConfigurationSynthesizer"/> class.
@@ -99,7 +101,7 @@ internal MicrosoftGraphRscConfiguration ConvertToChatRscConfiguration(
99101
{
100102
if (assignedPermissionGrantPoliciesApplicableToChatScope.Any(pgp => !string.Equals(
101103
pgp.ManagePermissionGrantsForOwnedResourcePrefixedId,
102-
RscConfigurationSynthesizer.MicrosoftCreatedPermissionGrantPolicyForChatRscPreApproval,
104+
RscConfigurationSynthesizer.MicrosoftCreatedPermissionGrantPolicyEnabledForPreapprovedAppsForChats,
103105
StringComparison.OrdinalIgnoreCase)))
104106
{
105107
this.LogVerbose("Unknown chat scoped permission grant policies are enabled. Not a supported scenario.", eventListener);
@@ -124,12 +126,10 @@ internal MicrosoftGraphRscConfiguration ConvertToChatRscConfiguration(
124126
/// Convert the given tenant settings to Team RSC configuration.
125127
/// </summary>
126128
/// <param name="permissionGrantPolicyCollection">Permission grant policy collection.</param>
127-
/// <param name="tenantConsentSettingCollection">Tenant consent setting collection.</param>
128129
/// <param name="authorizationPolicy">Authorization policy.</param>
129130
/// <returns>Rsc configuration.</returns>
130131
internal IMicrosoftGraphRscConfiguration ConvertToTeamRscConfiguration(
131132
MGTeamsInternalPermissionGrantPolicyCollection permissionGrantPolicyCollection,
132-
MGTeamsInternalTenantConsentSettingsCollection tenantConsentSettingCollection,
133133
MGTeamsInternalAuthorizationPolicy authorizationPolicy,
134134
Runtime.IEventListener eventListener)
135135
{
@@ -140,13 +140,6 @@ internal IMicrosoftGraphRscConfiguration ConvertToTeamRscConfiguration(
140140
"Permission grant policies were not found.");
141141
}
142142

143-
if (tenantConsentSettingCollection?.Value == null)
144-
{
145-
throw new MGTeamsInternalException(
146-
MGTeamsInternalErrorType.ResourceNotFound,
147-
"Tenant consent settings were not found.");
148-
}
149-
150143
if (authorizationPolicy == null)
151144
{
152145
throw new MGTeamsInternalException(
@@ -161,57 +154,48 @@ internal IMicrosoftGraphRscConfiguration ConvertToTeamRscConfiguration(
161154
State = MicrosoftGraphRscConfigurationState.Custom
162155
};
163156

164-
(string isGroupConsentSettingEnabled, string groupConsentConstrainedToGroupId) projectedGroupConsentSettings = this.GetProjectedGroupConsentSettings(
165-
tenantConsentSettingCollection,
166-
authorizationPolicy,
167-
eventListener);
168-
169157
IEnumerable<MGTeamsInternalPermissionGrantPolicy> assignedPermissionGrantPoliciesApplicableToGroupScope =
170158
this.GetAssignedPermissionGrantPoliciesApplicableToGivenScopeType(
171159
permissionGrantPolicyCollection,
172160
authorizationPolicy,
173161
MicrosoftGraphRscConfigurationScopeType.Team);
174162

175-
if (string.Equals(projectedGroupConsentSettings.isGroupConsentSettingEnabled, true.ToString(), StringComparison.OrdinalIgnoreCase))
163+
int interestingPermissionGrantPolicyCount = assignedPermissionGrantPoliciesApplicableToGroupScope.Count();
164+
165+
if (interestingPermissionGrantPolicyCount > 1)
176166
{
177-
if (assignedPermissionGrantPoliciesApplicableToGroupScope.Any())
178-
{
179-
this.LogVerbose(
180-
"Projected group consent setting value is enabled and group scoped permission grant policies are enabled. Not a supported scenario.",
181-
eventListener);
182-
microsoftGraphRscConfiguration.State = MicrosoftGraphRscConfigurationState.Custom;
183-
}
184-
else if (string.IsNullOrWhiteSpace(projectedGroupConsentSettings.groupConsentConstrainedToGroupId))
167+
this.LogVerbose("Multiple group scoped permission grant policies are enabled. Not a supported scenario.", eventListener);
168+
microsoftGraphRscConfiguration.State = MicrosoftGraphRscConfigurationState.Custom;
169+
}
170+
else if (interestingPermissionGrantPolicyCount == 0)
171+
{
172+
this.LogVerbose("Team scope RSC is disabled.", eventListener);
173+
microsoftGraphRscConfiguration.State = MicrosoftGraphRscConfigurationState.DisabledForAllApps;
174+
}
175+
else
176+
{
177+
MGTeamsInternalPermissionGrantPolicy interestingPermissionGrantPolicy = assignedPermissionGrantPoliciesApplicableToGroupScope.Single();
178+
if (string.Equals(
179+
interestingPermissionGrantPolicy.ManagePermissionGrantsForOwnedResourcePrefixedId,
180+
RscConfigurationSynthesizer.MicrosoftCreatedPermissionGrantPolicyEnabledForAllAppsForTeams,
181+
StringComparison.OrdinalIgnoreCase))
185182
{
186-
this.LogVerbose("Projected group consent setting value is enabled. No constraints on users able to grant consent.", eventListener);
183+
this.LogVerbose("Authorization policy contains permission grant policy for all application permissions for teams.", eventListener);
187184
microsoftGraphRscConfiguration.State = MicrosoftGraphRscConfigurationState.EnabledForAllApps;
188185
}
189-
else
186+
else if (string.Equals(
187+
interestingPermissionGrantPolicy.ManagePermissionGrantsForOwnedResourcePrefixedId,
188+
RscConfigurationSynthesizer.MicrosoftCreatedPermissionGrantPolicyEnabledForPreapprovedAppsForTeams,
189+
StringComparison.OrdinalIgnoreCase))
190190
{
191-
this.LogVerbose($"Projected group consent setting value is enabled. Consent is constrained to users belonging to group '{projectedGroupConsentSettings.groupConsentConstrainedToGroupId}'.", eventListener);
192-
microsoftGraphRscConfiguration.State = MicrosoftGraphRscConfigurationState.EnabledForSelectedGroupOfUsers;
191+
this.LogVerbose("Authorization policy contains permission grant policy for team RSC preapprovals.", eventListener);
192+
microsoftGraphRscConfiguration.State = MicrosoftGraphRscConfigurationState.EnabledForPreApprovedAppsOnly;
193193
}
194-
}
195-
else if (assignedPermissionGrantPoliciesApplicableToGroupScope.Any())
196-
{
197-
if (assignedPermissionGrantPoliciesApplicableToGroupScope.Any(pgp => !string.Equals(
198-
pgp.ManagePermissionGrantsForOwnedResourcePrefixedId,
199-
RscConfigurationSynthesizer.MicrosoftCreatedPermissionGrantPolicyForTeamRscPreApproval,
200-
StringComparison.OrdinalIgnoreCase)))
194+
else
201195
{
202196
this.LogVerbose("Unknown group scoped permission grant policies are enabled. Not a supported scenario.", eventListener);
203197
microsoftGraphRscConfiguration.State = MicrosoftGraphRscConfigurationState.Custom;
204198
}
205-
else
206-
{
207-
this.LogVerbose("Authorization policy contains permission grant policy for team RSC preapprovals.", eventListener);
208-
microsoftGraphRscConfiguration.State = MicrosoftGraphRscConfigurationState.EnabledForPreApprovedAppsOnly;
209-
}
210-
}
211-
else
212-
{
213-
this.LogVerbose("Team RSC is disabled.", eventListener);
214-
microsoftGraphRscConfiguration.State = MicrosoftGraphRscConfigurationState.DisabledForAllApps;
215199
}
216200

217201
return microsoftGraphRscConfiguration;
@@ -233,7 +217,7 @@ internal IEnumerable<MGTeamsInternalPermissionGrantPolicy> GetAssignedPermission
233217
switch (rscConfigurationScopeType)
234218
{
235219
case MicrosoftGraphRscConfigurationScopeType.Team:
236-
identitySpecificScopeType = "group";
220+
identitySpecificScopeType = "team";
237221
break;
238222

239223
case MicrosoftGraphRscConfigurationScopeType.Chat:
@@ -262,51 +246,6 @@ internal IEnumerable<MGTeamsInternalPermissionGrantPolicy> GetAssignedPermission
262246
return assignedPermissionGrantPoliciesApplicableToGivenScope;
263247
}
264248

265-
/// <summary>
266-
/// Get the projected value of group consent settings. i.e.
267-
/// 1. Whether group consent is enabled. This is derived from group consent and user consent settings.
268-
/// 2. Specific groups that group consent is restricted to.
269-
/// </summary>
270-
/// <param name="tenantConsentSettingCollection">Tenant consent setting collection.</param>
271-
/// <param name="authorizationPolicy">The authorization policy.</param>
272-
/// <param name="eventListener">The event listener.</param>
273-
/// <returns>Projected value of group consent settings.</returns>
274-
private (string isGroupConsentSettingEnabled, string groupConsentConstrainedToGroupId) GetProjectedGroupConsentSettings(
275-
MGTeamsInternalTenantConsentSettingsCollection tenantConsentSettingCollection,
276-
MGTeamsInternalAuthorizationPolicy authorizationPolicy,
277-
IEventListener eventListener)
278-
{
279-
MGTeamsInternalTenantConsentSettings groupConsentSettings = tenantConsentSettingCollection.Value?.FirstOrDefault(
280-
v => string.Equals(v.TemplateId, RscConfigurationSynthesizer.GroupConsentSettingsTemplateId, StringComparison.OrdinalIgnoreCase));
281-
282-
if (groupConsentSettings == null)
283-
{
284-
this.LogVerbose("Group Consent settings were not found.", eventListener);
285-
286-
if (authorizationPolicy
287-
?.DefaultUserRolePermissions
288-
?.PermissionGrantPoliciesAssigned
289-
?.Contains(
290-
RscConfigurationSynthesizer.MicrosoftCreatedPermissionGrantPolicyForUserConsentLegacy, StringComparer.OrdinalIgnoreCase) == true)
291-
{
292-
this.LogVerbose("Legacy policy for user consent was found in default user role permissions. Projecting group consent to be true.", eventListener);
293-
return (isGroupConsentSettingEnabled: true.ToString(), groupConsentConstrainedToGroupId: null);
294-
}
295-
296-
return (isGroupConsentSettingEnabled: false.ToString(), groupConsentConstrainedToGroupId: null);
297-
}
298-
299-
MGTeamsInternalTenantConsentSettingValue isGroupConsentEnabledSettingValue = groupConsentSettings.Values?.SingleOrDefault(
300-
v => string.Equals(v.Name, RscConfigurationSynthesizer.EnableGroupSpecificConsentKey, StringComparison.OrdinalIgnoreCase));
301-
302-
MGTeamsInternalTenantConsentSettingValue groupConsentConstrainedToGroupId = groupConsentSettings.Values?.SingleOrDefault(
303-
v => string.Equals(v.Name, RscConfigurationSynthesizer.ConstrainGroupSpecificConsentToMembersOfGroupIdKey, StringComparison.OrdinalIgnoreCase));
304-
305-
return
306-
(isGroupConsentSettingEnabled: isGroupConsentEnabledSettingValue?.Value,
307-
groupConsentConstrainedToGroupId: groupConsentConstrainedToGroupId?.Value);
308-
}
309-
310249
/// <summary>
311250
/// Log verbose.
312251
/// </summary>

‎src/Teams/beta/custom/SetMgBetaChatRscConfiguration_Update.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ await this.Client.UpdateDefaultUserRolePermissionGrantPoliciesAssigned(
297297
.Except(
298298
assignedPermissionGrantPoliciesApplicableToChatScope.Select(p => p.ManagePermissionGrantsForOwnedResourcePrefixedId),
299299
StringComparer.OrdinalIgnoreCase)
300-
.Union(new string[] { RscConfigurationSynthesizer.MicrosoftCreatedPermissionGrantPolicyForChatRscPreApproval }, StringComparer.OrdinalIgnoreCase);
300+
.Union(new string[] { RscConfigurationSynthesizer.MicrosoftCreatedPermissionGrantPolicyEnabledForPreapprovedAppsForChats }, StringComparer.OrdinalIgnoreCase);
301301
await this.Client.UpdateDefaultUserRolePermissionGrantPoliciesAssigned(
302302
updatedPermissionGrantPolicies,
303303
this,

0 commit comments

Comments
 (0)