feat(tenant configuration view): Tenant configuration view

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListAdminAuditLogConfig.ps1

@@ -0,0 +1,21 @@
+function Invoke-ListAdminAuditLogConfig {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Config.Read
+    .DESCRIPTION
+        Returns the tenant's Exchange Online admin audit log configuration (notably whether the
+        Unified Audit Log is enabled). Read live from Exchange Online so the value is always current.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $Tenant = $Request.Query.tenantFilter
+    $AuditConfig = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AdminAuditLogConfig'
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = @($AuditConfig)
+        })
+}

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListAdminReportSettings.ps1

@@ -0,0 +1,21 @@
+function Invoke-ListAdminReportSettings {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Config.Read
+    .DESCRIPTION
+        Returns the tenant's admin report settings (currently whether usage-report user, group
+        and site names are concealed). Read live from Graph so the value is always current.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $Tenant = $Request.Query.tenantFilter
+    $ReportSettings = New-GraphGetRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/beta/admin/reportSettings' -AsApp $true
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = @($ReportSettings)
+        })
+}

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListCrossTenantAccess.ps1

@@ -0,0 +1,29 @@
+function Invoke-ListCrossTenantAccess {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Config.Read
+    .DESCRIPTION
+        Returns the default cross-tenant access policy inbound-trust settings (whether MFA,
+        compliant-device and hybrid-joined claims from other Entra tenants are trusted).
+        Read live from Graph, flattened for the Configuration UI.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $Tenant = $Request.Query.tenantFilter
+    $Policy = New-GraphGetRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default' -AsApp $true
+    $Trust = $Policy.inboundTrust
+
+    $Flat = [PSCustomObject]@{
+        isMfaAccepted                       = $Trust.isMfaAccepted
+        isCompliantDeviceAccepted           = $Trust.isCompliantDeviceAccepted
+        isHybridAzureADJoinedDeviceAccepted = $Trust.isHybridAzureADJoinedDeviceAccepted
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = @($Flat)
+        })
+}

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListDeviceRegistrationPolicy.ps1

@@ -0,0 +1,26 @@
+function Invoke-ListDeviceRegistrationPolicy {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Config.Read
+    .DESCRIPTION
+        Returns the Entra device registration policy settings surfaced here (Windows LAPS and the
+        per-user device quota), flattened for the Configuration UI. Read live from Graph.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $Tenant = $Request.Query.tenantFilter
+    $Policy = New-GraphGetRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy' -AsApp $true
+
+    $Flat = [PSCustomObject]@{
+        lapsEnabled     = $Policy.localAdminPassword.isEnabled
+        userDeviceQuota = $Policy.userDeviceQuota
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = @($Flat)
+        })
+}

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListEntraAuthPolicy.ps1

@@ -0,0 +1,35 @@
+function Invoke-ListEntraAuthPolicy {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Config.Read
+    .DESCRIPTION
+        Returns the Entra authorization policy settings (guest invite scope, SSPR, and the
+        default-user-role permissions) flattened for the Configuration UI. Read live from Graph.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $Tenant = $Request.Query.tenantFilter
+    $Policy = New-GraphGetRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -AsApp $true
+    $Defaults = $Policy.defaultUserRolePermissions
+
+    # Flatten defaultUserRolePermissions.* to top level so the UI binds simple fields.
+    $Flat = [PSCustomObject]@{
+        allowInvitesFrom                         = $Policy.allowInvitesFrom
+        allowedToUseSSPR                         = $Policy.allowedToUseSSPR
+        guestUserRoleId                          = $Policy.guestUserRoleId
+        blockMsolPowerShell                      = $Policy.blockMsolPowerShell
+        allowedToCreateApps                      = $Defaults.allowedToCreateApps
+        allowedToCreateSecurityGroups            = $Defaults.allowedToCreateSecurityGroups
+        allowedToCreateTenants                   = $Defaults.allowedToCreateTenants
+        allowedToReadBitLockerKeysForOwnedDevice = $Defaults.allowedToReadBitLockerKeysForOwnedDevice
+        allowedToReadOtherUsers                  = $Defaults.allowedToReadOtherUsers
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = @($Flat)
+        })
+}

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListExchangeOrgConfig.ps1

@@ -0,0 +1,23 @@
+function Invoke-ListExchangeOrgConfig {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Config.Read
+    .DESCRIPTION
+        Returns tenant-wide Exchange Online organization settings (Get-OrganizationConfig).
+        Read live so values are always current before a change.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $Tenant = $Request.Query.tenantFilter
+    $Select = 'BookingsEnabled,MessageRecallEnabled,FocusedInboxOn,SendFromAliasEnabled,OnlineMeetingsByDefaultEnabled,TwoClickMailPreviewEnabled,EwsEnabled,AuditDisabled,CustomerLockboxEnabled,AppsForOfficeEnabled,OAuth2ClientProfileEnabled,ConnectorsEnabled,LinkPreviewEnabled,ReadTrackingEnabled,PublicComputersDetectionEnabled,SmtpActionableMessagesEnabled,OutlookPayEnabled'
+
+    $Config = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig' -Select $Select
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = @($Config)
+        })
+}

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListOrgContacts.ps1

@@ -0,0 +1,27 @@
+function Invoke-ListOrgContacts {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Config.Read
+    .DESCRIPTION
+        Returns the organization notification contact addresses (marketing, technical and
+        security/compliance notification emails). Read live from Graph.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $Tenant = $Request.Query.tenantFilter
+    $Org = @(New-GraphGetRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/v1.0/organization' -AsApp $true)[0]
+
+    $Flat = [PSCustomObject]@{
+        marketingNotificationEmails         = @($Org.marketingNotificationEmails)
+        technicalNotificationMails          = @($Org.technicalNotificationMails)
+        securityComplianceNotificationMails = @($Org.securityComplianceNotificationMails)
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = @($Flat)
+        })
+}

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListOwaMailboxPolicy.ps1

@@ -0,0 +1,21 @@
+function Invoke-ListOwaMailboxPolicy {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Config.Read
+    .DESCRIPTION
+        Returns the default OWA mailbox policy settings (third-party storage providers, direct
+        file access). Read live from Exchange Online.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $Tenant = $Request.Query.tenantFilter
+    $Policy = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OwaMailboxPolicy' -cmdParams @{ Identity = 'OwaMailboxPolicy-Default' } -Select 'AdditionalStorageProvidersAvailable,DirectFileAccessOnPublicComputersEnabled,DirectFileAccessOnPrivateComputersEnabled'
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = @($Policy)
+        })
+}

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListSpoTenantSettings.ps1

@@ -0,0 +1,42 @@
+function Invoke-ListSpoTenantSettings {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Sharepoint.Admin.Read
+    .DESCRIPTION
+        Returns the SharePoint Online tenant admin (CSOM) settings - sharing link defaults,
+        sync, guest access and related toggles that are not on the Graph sharepoint/settings
+        object. Read live (-SkipCache) so values are always current before a change.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $Tenant = $Request.Query.tenantFilter
+
+    # One CSOM call hydrates the whole tenant object; project the fields this section renders.
+    $Fields = @(
+        'DefaultSharingLinkType'
+        'DefaultLinkPermission'
+        'DisableAddToOneDrive'
+        'EnableAzureADB2BIntegration'
+        'CustomScriptsRestrictMode'
+        'DisableSharePointStoreAccess'
+        'DisallowInfectedFileDownload'
+        'ShowPeoplePickerSuggestionsForGuestUsers'
+        'HideSyncButtonOnDocLib'
+        'ConditionalAccessPolicy'
+        'ExternalUserExpirationRequired'
+        'ExternalUserExpireInDays'
+        'EmailAttestationRequired'
+        'EmailAttestationReAuthDays'
+        'SharingCapability'
+    )
+
+    $Settings = Get-CIPPSPOTenant -TenantFilter $Tenant -SkipCache | Select-Object -Property $Fields
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = @($Settings)
+        })
+}

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListTeamsConfig.ps1

@@ -0,0 +1,32 @@
+function Invoke-ListTeamsConfig {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Config.Read
+    .DESCRIPTION
+        Returns a tenant-wide Teams Global policy/configuration object for the Configuration UI.
+        The policyType query parameter selects which one (meeting, messaging, client, external
+        access). Read live via the Teams admin ConfigAPI.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $Tenant = $Request.Query.tenantFilter
+    $PolicyType = $Request.Query.policyType
+    $Allowed = @('TeamsMeetingPolicy', 'TeamsMessagingPolicy', 'TeamsClientConfiguration', 'ExternalAccessPolicy')
+
+    if ($PolicyType -notin $Allowed) {
+        return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::BadRequest
+                Body       = @{ Results = "Unsupported policyType '$PolicyType'." }
+            })
+    }
+
+    $Config = New-TeamsRequestV2 -TenantFilter $Tenant -Type $PolicyType -Action Get -Identity 'Global'
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = @($Config)
+        })
+}

backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Configuration/Invoke-ListTenantConfigFleet.ps1

@@ -0,0 +1,62 @@
+function Invoke-ListTenantConfigFleet {
+    <#
+    .FUNCTIONALITY
+        Entrypoint,AnyTenant
+    .ROLE
+        Tenant.Config.Read
+    .DESCRIPTION
+        Fleet (All Tenants) view for the Tenant Configuration page: returns one cached row per
+        tenant for a given reporting-cache type, so a single request renders every tenant's
+        current values. Live per-tenant reads are done by each area's own List endpoint; the
+        fleet view is cache-backed because live-calling every tenant is not feasible.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    # The reporting-cache type to project across all tenants
+    $Type = $Request.Query.type
+
+    # Only tenant-configuration cache types may be projected here
+    $AllowedTypes = @(
+        'SharePointAdminSettings'
+        'ExoOrganizationConfig'
+        'ExoAdminAuditLogConfig'
+        'AdminReportSettings'
+        'AuthorizationPolicy'
+        'CrossTenantAccessPolicy'
+        'CsTeamsMeetingPolicy'
+        'CsTeamsMessagingPolicy'
+        'CsExternalAccessPolicy'
+        'CsTeamsClientConfiguration'
+    )
+
+    try {
+        if (-not $Type) { throw 'A type is required.' }
+        if ($Type -notin $AllowedTypes) { throw "Unsupported configuration type '$Type'." }
+
+        $Table = Get-CippTable -TableName 'CippReportingDB'
+        # RowKeys are '<Type>-<id>'; the range bounds the scan to this type across all partitions.
+        $Filter = "RowKey ge '{0}-' and RowKey lt '{0}.'" -f $Type
+        $Rows = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+
+        $Result = foreach ($Row in $Rows) {
+            if ($Row.RowKey -eq "$Type-Count") { continue }
+            if (-not $Row.Data) { continue }
+            $Object = $Row.Data | ConvertFrom-Json
+            # Stamp the owning tenant so the fleet table can key each row
+            $Object | Add-Member -NotePropertyName Tenant -NotePropertyValue $Row.PartitionKey -Force
+            $Object
+        }
+
+        $StatusCode = [HttpStatusCode]::OK
+        $Body = @($Result)
+    } catch {
+        $StatusCode = [HttpStatusCode]::InternalServerError
+        $Body = @{ Results = $_.Exception.Message }
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}