This repository was archived by the owner on Jul 23, 2026. It is now read-only.
Support own tenant role access#6
Closed
Logan Cook (MWG-Logan) wants to merge 1 commit into
Closed
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
❌ This PR title does not follow the Conventional Commits format. Expected format: Allowed types: Examples:
Received: 🔒 This PR has been automatically closed. Please update the title to match the format above and reopen the PR. |
There was a problem hiding this comment.
Pull request overview
Adds support for an Own Tenant allowance in custom roles, intended to scope access to the tenant whose default or initial domain matches the signed-in user’s UPN. This fits into the existing centralized RBAC enforcement performed by Test-CIPPAccess, and exposes the new allowance in the custom-role listing endpoint for UI configuration.
Changes:
- Update custom role listing to surface an Own Tenant option in
AllowedTenants. - Add “own tenant” resolution logic to
Test-CIPPAccessand expandAllowedTenantsentries accordingly. - Extend tenant resolution to also match
initialDomainNamein addition todefaultDomainName.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1 | Adds UI-facing shaping for AllowedTenants to include an “Own Tenant” display entry. |
| Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 | Adds own-tenant ID resolution and enforces own-tenant scoping during allowed-tenant expansion and AllTenants handling. |
Comment on lines
64
to
+71
| $AllowedTenants = $Role.AllowedTenants | ConvertFrom-Json -ErrorAction Stop | ForEach-Object { | ||
| if ($_ -is [PSCustomObject] -and $_.type -eq 'Group') { | ||
| if ($_ -eq 'OwnTenant') { | ||
| [PSCustomObject]@{ | ||
| type = 'OwnTenant' | ||
| value = 'OwnTenant' | ||
| label = 'Own Tenant' | ||
| } | ||
| } elseif ($_ -is [PSCustomObject] -and $_.type -eq 'Group') { |
Comment on lines
+378
to
382
| } elseif ($AllowedItem -eq 'OwnTenant') { | ||
| $OwnTenantIds | ||
| } else { | ||
| $AllowedItem | ||
| } |
Comment on lines
+471
to
475
| } elseif ($AllowedItem -eq 'OwnTenant') { | ||
| $OwnTenantIds | ||
| } else { | ||
| $AllowedItem | ||
| } |
Comment on lines
+446
to
+447
| } elseif ($TenantFilter -eq 'AllTenants' -and $Role.AllowedTenants -contains 'OwnTenant' -and $Role.AllowedTenants -notcontains 'AllTenants') { | ||
| $TenantAllowed = $false |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds centralized support for the Own Tenant custom-role allowance. Access is limited to the tenant whose default or initial domain matches the signed-in user's UPN.
Testing
Untested: no build or behavioral test suite was run.