diff --git a/backend/Config/BaselineStandards/Teams Standards/TeamsExternalAccessPolicy.json b/backend/Config/BaselineStandards/Teams Standards/TeamsExternalAccessPolicy.json index 6ef835626a..9c3c92fab1 100644 --- a/backend/Config/BaselineStandards/Teams Standards/TeamsExternalAccessPolicy.json +++ b/backend/Config/BaselineStandards/Teams Standards/TeamsExternalAccessPolicy.json @@ -37,11 +37,22 @@ "type": "switch", "label": "Allow communication with unmanaged Teams accounts", "default": false + }, + "EnableTeamsConsumerInbound": { + "type": "switch", + "label": "Allow unmanaged Teams users to initiate contact", + "default": false, + "condition": { + "field": "EnableTeamsConsumerAccess", + "compareType": "is", + "compareValue": true + } } }, "expected": { "EnableFederationAccess": "%EnableFederationAccess%", - "EnableTeamsConsumerAccess": "%EnableTeamsConsumerAccess%" + "EnableTeamsConsumerAccess": "%EnableTeamsConsumerAccess%", + "EnableTeamsConsumerInbound": "%EnableTeamsConsumerInbound%" }, "read": { "cacheType": "CsExternalAccessPolicy" @@ -53,7 +64,8 @@ "cmdlet": "Set-CsExternalAccessPolicy", "params": { "EnableFederationAccess": "%EnableFederationAccess%", - "EnableTeamsConsumerAccess": "%EnableTeamsConsumerAccess%" + "EnableTeamsConsumerAccess": "%EnableTeamsConsumerAccess%", + "EnableTeamsConsumerInbound": "%EnableTeamsConsumerInbound%" } } ] diff --git a/backend/Config/standards.json b/backend/Config/standards.json index 62a8932f62..b44e78ab29 100644 --- a/backend/Config/standards.json +++ b/backend/Config/standards.json @@ -6021,6 +6021,16 @@ "type": "switch", "name": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess", "label": "Allow communication with unmanaged Teams accounts" + }, + { + "type": "switch", + "name": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerInbound", + "label": "Allow unmanaged Teams users to initiate contact", + "condition": { + "field": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess", + "compareType": "is", + "compareValue": true + } } ], "label": "External Access Settings for Microsoft Teams", @@ -6045,6 +6055,16 @@ "name": "standards.TeamsFederationConfiguration.AllowTeamsConsumer", "label": "Allow users to communicate with consumer Teams accounts" }, + { + "type": "switch", + "name": "standards.TeamsFederationConfiguration.AllowTeamsConsumerInbound", + "label": "Allow unmanaged Teams users to initiate contact", + "condition": { + "field": "standards.TeamsFederationConfiguration.AllowTeamsConsumer", + "compareType": "is", + "compareValue": true + } + }, { "type": "autoComplete", "required": true, diff --git a/backend/Modules/CIPPCore/Public/Get-CippTestDataFieldManifest.ps1 b/backend/Modules/CIPPCore/Public/Get-CippTestDataFieldManifest.ps1 index a2e97e2f61..b0598ac101 100644 --- a/backend/Modules/CIPPCore/Public/Get-CippTestDataFieldManifest.ps1 +++ b/backend/Modules/CIPPCore/Public/Get-CippTestDataFieldManifest.ps1 @@ -84,12 +84,12 @@ function Get-CippTestDataFieldManifest { 'ConditionalAccessPolicies' = @('id', 'displayName', 'state', 'conditions', 'grantControls', 'sessionControls', 'createdDateTime', 'modifiedDateTime') 'CopilotReadinessActivity' = @('userPrincipalName', 'usesOutlookEmail', 'usesTeamsMeetings', 'usesTeamsChat', 'usesOfficeDocs', 'onQualifiedUpdateChannel', 'hasCopilotLicenseAssigned') 'CrossTenantAccessPolicy' = @('id', 'b2bCollaborationOutbound', 'b2bDirectConnectOutbound', 'tenantRestrictions') - 'CsExternalAccessPolicy' = @('EnableFederationAccess', 'EnableTeamsConsumerAccess') + 'CsExternalAccessPolicy' = @('EnableFederationAccess', 'EnableTeamsConsumerAccess', 'EnableTeamsConsumerInbound') 'CsTeamsAppPermissionPolicy' = @('Identity', 'GlobalCatalogAppsType', 'DefaultCatalogAppsType') 'CsTeamsClientConfiguration' = @('AllowDropbox', 'AllowBox', 'AllowGoogleDrive', 'AllowShareFile', 'AllowEgnyte', 'AllowEmailIntoChannel') 'CsTeamsMeetingPolicy' = @('AllowAnonymousUsersToJoinMeeting', 'AllowAnonymousUsersToStartMeeting', 'AutoAdmittedUsers', 'AllowPSTNUsersToBypassLobby', 'MeetingChatEnabledType', 'DesignatedPresenterRoleMode', 'AllowExternalParticipantGiveRequestControl', 'AllowExternalNonTrustedMeetingChat', 'AllowCloudRecording') 'CsTeamsMessagingPolicy' = @('UseB2BInvitesToAddExternalUsers', 'AllowSecurityEndUserReporting') - 'CsTenantFederationConfiguration' = @('AllowFederatedUsers', 'AllowedDomains', 'AllowTeamsConsumer') + 'CsTenantFederationConfiguration' = @('AllowFederatedUsers', 'AllowedDomains', 'AllowTeamsConsumer', 'AllowTeamsConsumerInbound') 'DefaultAppManagementPolicy' = @('isEnabled', 'applicationRestrictions', 'servicePrincipalRestrictions') 'DeviceRegistrationPolicy' = @('azureADJoin', 'userDeviceQuota', 'localAdminPassword', 'multiFactorAuthConfiguration') 'DeviceSettings' = @('secureByDefault') diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 index 8eb632ba19..37bd93c22a 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 @@ -18,6 +18,7 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy { ADDEDCOMPONENT {"type":"switch","name":"standards.TeamsExternalAccessPolicy.EnableFederationAccess","label":"Allow communication from trusted organizations"} {"type":"switch","name":"standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess","label":"Allow communication with unmanaged Teams accounts"} + {"type":"switch","name":"standards.TeamsExternalAccessPolicy.EnableTeamsConsumerInbound","label":"Allow unmanaged Teams users to initiate contact","condition":{"field":"standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess","compareType":"is","compareValue":true}} IMPACT Medium Impact ADDEDDATE @@ -55,18 +56,21 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy { $EnableFederationAccess = $Settings.EnableFederationAccess ?? $false $EnableTeamsConsumerAccess = $Settings.EnableTeamsConsumerAccess ?? $false + $EnableTeamsConsumerInbound = $Settings.EnableTeamsConsumerInbound ?? $false $StateIsCorrect = ($CurrentState.EnableFederationAccess -eq $EnableFederationAccess) -and - ($CurrentState.EnableTeamsConsumerAccess -eq $EnableTeamsConsumerAccess) + ($CurrentState.EnableTeamsConsumerAccess -eq $EnableTeamsConsumerAccess) -and + ($CurrentState.EnableTeamsConsumerInbound -eq $EnableTeamsConsumerInbound) if ($Settings.remediate -eq $true) { if ($StateIsCorrect -eq $true) { Write-LogMessage -API 'Standards' -tenant $Tenant -message 'External Access Policy already set.' -sev Info } else { $cmdParams = @{ - Identity = 'Global' - EnableFederationAccess = $EnableFederationAccess - EnableTeamsConsumerAccess = $EnableTeamsConsumerAccess + Identity = 'Global' + EnableFederationAccess = $EnableFederationAccess + EnableTeamsConsumerAccess = $EnableTeamsConsumerAccess + EnableTeamsConsumerInbound = $EnableTeamsConsumerInbound } try { @@ -92,12 +96,14 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy { Add-CIPPBPAField -FieldName 'TeamsExternalAccessPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant $CurrentValue = @{ - EnableFederationAccess = $CurrentState.EnableFederationAccess - EnableTeamsConsumerAccess = $CurrentState.EnableTeamsConsumerAccess + EnableFederationAccess = $CurrentState.EnableFederationAccess + EnableTeamsConsumerAccess = $CurrentState.EnableTeamsConsumerAccess + EnableTeamsConsumerInbound = $CurrentState.EnableTeamsConsumerInbound } $ExpectedValue = @{ - EnableFederationAccess = $EnableFederationAccess - EnableTeamsConsumerAccess = $EnableTeamsConsumerAccess + EnableFederationAccess = $EnableFederationAccess + EnableTeamsConsumerAccess = $EnableTeamsConsumerAccess + EnableTeamsConsumerInbound = $EnableTeamsConsumerInbound } Set-CIPPStandardsCompareField -FieldName 'standards.TeamsExternalAccessPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant } diff --git a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1 b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1 index 10639e02d8..c4e62f781d 100644 --- a/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1 +++ b/backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1 @@ -17,6 +17,7 @@ function Invoke-CIPPStandardTeamsFederationConfiguration { Configures how the organization federates with external organizations for Teams communication, controlling whether employees can communicate with specific external domains or all external organizations. This setting enables secure inter-organizational collaboration while maintaining control over external communications. ADDEDCOMPONENT {"type":"switch","name":"standards.TeamsFederationConfiguration.AllowTeamsConsumer","label":"Allow users to communicate with other organizations"} + {"type":"switch","name":"standards.TeamsFederationConfiguration.AllowTeamsConsumerInbound","label":"Allow unmanaged Teams users to initiate contact","condition":{"field":"standards.TeamsFederationConfiguration.AllowTeamsConsumer","compareType":"is","compareValue":true}} {"type":"autoComplete","required":true,"multiple":false,"creatable":false,"name":"standards.TeamsFederationConfiguration.DomainControl","label":"Communication Mode","options":[{"label":"Allow all external domains","value":"AllowAllExternal"},{"label":"Block all external domains","value":"BlockAllExternal"},{"label":"Allow specific external domains","value":"AllowSpecificExternal"},{"label":"Block specific external domains","value":"BlockSpecificExternal"}]} {"type":"textField","name":"standards.TeamsFederationConfiguration.DomainList","label":"Domains, Comma separated","required":false,"condition":{"field":"standards.TeamsFederationConfiguration.DomainControl.value","compareType":"isOneOf","compareValue":["AllowSpecificExternal","BlockSpecificExternal"]}} IMPACT @@ -60,6 +61,7 @@ function Invoke-CIPPStandardTeamsFederationConfiguration { $DomainControl = $Settings.DomainControl.value ?? $Settings.DomainControl # An untoggled switch is absent from the settings; default it to $false so we never send null to the ConfigApi $AllowTeamsConsumer = $Settings.AllowTeamsConsumer ?? $false + $AllowTeamsConsumerInbound = $Settings.AllowTeamsConsumerInbound ?? $false $AllowedDomainsAsAList = @() $BlockedDomains = @() switch ($DomainControl) { @@ -140,6 +142,7 @@ function Invoke-CIPPStandardTeamsFederationConfiguration { $ExpectedBlockedDomains = $BlockedDomains ?? @() $StateIsCorrect = ($CurrentState.AllowTeamsConsumer -eq $AllowTeamsConsumer) -and + ($CurrentState.AllowTeamsConsumerInbound -eq $AllowTeamsConsumerInbound) -and ($CurrentState.AllowFederatedUsers -eq $AllowFederatedUsers) -and $AllowedDomainsMatches -and $BlockedDomainsMatches @@ -150,8 +153,9 @@ function Invoke-CIPPStandardTeamsFederationConfiguration { } else { $cmdParams = @{ Identity = 'Global' - AllowTeamsConsumer = $AllowTeamsConsumer - AllowFederatedUsers = $AllowFederatedUsers + AllowTeamsConsumer = $AllowTeamsConsumer + AllowTeamsConsumerInbound = $AllowTeamsConsumerInbound + AllowFederatedUsers = $AllowFederatedUsers AllowedDomains = $AllowedDomainsPayload BlockedDomains = @($BlockedDomains) } @@ -210,15 +214,17 @@ function Invoke-CIPPStandardTeamsFederationConfiguration { } $CurrentValue = @{ - AllowTeamsConsumer = $CurrentState.AllowTeamsConsumer - AllowFederatedUsers = $CurrentState.AllowFederatedUsers + AllowTeamsConsumer = $CurrentState.AllowTeamsConsumer + AllowTeamsConsumerInbound = $CurrentState.AllowTeamsConsumerInbound + AllowFederatedUsers = $CurrentState.AllowFederatedUsers AllowedDomains = $CurrentAllowedDomainsForReport BlockedDomains = $CurrentBlockedDomainsForReport } $ExpectedValue = @{ - AllowTeamsConsumer = $AllowTeamsConsumer - AllowFederatedUsers = $AllowFederatedUsers - AllowedDomains = $ExpectedAllowedDomainsForReport + AllowTeamsConsumer = $AllowTeamsConsumer + AllowTeamsConsumerInbound = $AllowTeamsConsumerInbound + AllowFederatedUsers = $AllowFederatedUsers + AllowedDomains = $ExpectedAllowedDomainsForReport BlockedDomains = $ExpectedBlockedDomainsForReport } Set-CIPPStandardsCompareField -FieldName 'standards.TeamsFederationConfiguration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant diff --git a/frontend/src/data/standards.json b/frontend/src/data/standards.json index ac06341b8b..e2e74e6f0e 100644 --- a/frontend/src/data/standards.json +++ b/frontend/src/data/standards.json @@ -6021,6 +6021,16 @@ "type": "switch", "name": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess", "label": "Allow communication with unmanaged Teams accounts" + }, + { + "type": "switch", + "name": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerInbound", + "label": "Allow unmanaged Teams users to initiate contact", + "condition": { + "field": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess", + "compareType": "is", + "compareValue": true + } } ], "label": "External Access Settings for Microsoft Teams", @@ -6045,6 +6055,16 @@ "name": "standards.TeamsFederationConfiguration.AllowTeamsConsumer", "label": "Allow users to communicate with consumer Teams accounts" }, + { + "type": "switch", + "name": "standards.TeamsFederationConfiguration.AllowTeamsConsumerInbound", + "label": "Allow unmanaged Teams users to initiate contact", + "condition": { + "field": "standards.TeamsFederationConfiguration.AllowTeamsConsumer", + "compareType": "is", + "compareValue": true + } + }, { "type": "autoComplete", "required": true,