updated auditlog texts

KelvinTegelaar · Dec 29, 2023 · 4240592 · 4240592
1 parent 74cb6e2
commit 4240592
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 5 deletions.
diff --git a/Modules/CIPPCore/Public/Invoke-RemoveWebhookAlert.ps1 b/Modules/CIPPCore/Public/Invoke-RemoveWebhookAlert.ps1
@@ -36,7 +36,7 @@ Function Invoke-RemoveWebhookAlert {
             }
 
             $Results = foreach ($Tenant in $Tenants) {
-                Remove-CIPPGraphSubscription -TenantFilter $Tenant -CIPPID $Request.query.CIPPID
+                Remove-CIPPGraphSubscription -TenantFilter $Tenant -Type 'AuditLog'
                 $Entity = $WebhookRow | Where-Object -Property RowKey -EQ $Request.query.ID
                 Remove-AzDataTableEntity @WebhookTable -Entity $Entity | Out-Null
                 "Removed Alert Rule for $($Request.query.TenantFilter)"

diff --git a/Modules/CIPPCore/Public/Remove-CIPPGraphSubscription.ps1 b/Modules/CIPPCore/Public/Remove-CIPPGraphSubscription.ps1
@@ -4,17 +4,24 @@ function Remove-CIPPGraphSubscription {
         $TenantFilter,
         $CIPPID,
         $APIName = 'Remove Graph Webhook',
+        $Type,
         $ExecutingUser
     )
     try {
         $WebhookTable = Get-CIPPTable -TableName webhookTable
-        $WebhookRow = Get-CIPPAzDataTableEntity @WebhookTable | Where-Object { $_.RowKey -eq $CIPPID }
+        if ($type -eq 'AuditLog') {
+            $WebhookRow = Get-CIPPAzDataTableEntity @WebhookTable | Where-Object { $_.PartitionKey -eq $TenantFilter }
+        } else {
+            $WebhookRow = Get-CIPPAzDataTableEntity @WebhookTable | Where-Object { $_.RowKey -eq $CIPPID }
+        }
         $Entity = $WebhookRow | Select-Object PartitionKey, RowKey
-        if ($WebhookRow.Resource -in @('Audit.AzureActiveDirectory', 'Audit.Exchange', 'Audit.SharePoint', 'Audit.General')) {
+        if ($Type -eq 'AuditLog') {
             try {
-                $AuditLog = New-GraphPOSTRequest -uri "https://manage.office.com/api/v1.0/$($TenantFilter)/activity/feed/subscriptions/stop?contentType=$($WebhookRow.EventType)" -scope 'https://manage.office.com/.default' -tenantid $TenantFilter -type POST -body '{}' -verbose
+                foreach ($EventType in $WebhookRow.EventType) {
+                    $AuditLog = New-GraphPOSTRequest -uri "https://manage.office.com/api/v1.0/$($TenantFilter)/activity/feed/subscriptions/stop?contentType=$($EventType)" -scope 'https://manage.office.com/.default' -tenantid $TenantFilter -type POST -body '{}' -verbose
+                }            
             } catch {
-                #allowed to fail if the subscription is already removed
+                Write-LogMessage -user $ExecutingUser -API $APIName -message "Failed to remove webhook subscription at Microsoft's side: $($_.Exception.Message)" -Sev 'Error' -tenant $TenantFilter
             }
             $null = Remove-AzDataTableEntity @WebhookTable -Entity $Entity
         } else {