fix(standards): support plain-string displayName in QuarantineTemplate

Drift remediation and hand-built templates can pass displayName as a plain string rather than an autoComplete object with a .value property. This caused QuarantineTemplate comparisons to fail silently.

Also adds drift deviation resolution for QuarantineTemplate (hex-encoded policy name) and ReusableSettingsTemplate, and improves the error message when a setting cannot be resolved from drift template settings.

Synced from CyberDrain/CIPP@8cee804

Author: github-actions[bot]

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecUpdateDriftDeviation.ps1

@@ -123,6 +123,40 @@ function Invoke-ExecUpdateDriftDeviation {
                                 $MatchedTemplate | Add-Member -MemberType NoteProperty -Name 'report' -Value $true -Force
                                 $Settings = $MatchedTemplate
                             }
+                        } elseif ($Setting -like '*QuarantineTemplate*') {
+                            $Setting = 'QuarantineTemplate'
+                            # The suffix is the quarantine policy display name, hex encoded because '\', '#'
+                            # and '?' are legal in a quarantine name but not in an Azure Table RowKey.
+                            # See the matching encoder in Invoke-CIPPStandardQuarantineTemplate.
+                            $HexName = $Deviation.standardName -replace '^(standards\.)?QuarantineTemplates?\.', ''
+                            $PolicyName = $null
+                            if ($HexName -match '^[0-9A-Fa-f]+$' -and $HexName.Length % 2 -eq 0) {
+                                $Chars = for ($i = 0; $i -lt $HexName.Length; $i += 2) {
+                                    [char][Convert]::ToInt32($HexName.Substring($i, 2), 16)
+                                }
+                                $PolicyName = -join $Chars
+                            }
+                            $MatchedTemplate = $StandardTemplate.standardSettings.QuarantineTemplate | Where-Object {
+                                ($_.displayName.value ?? [string]$_.displayName) -eq $PolicyName
+                            } | Select-Object -First 1
+                            if (-not $MatchedTemplate) {
+                                Write-LogMessage -tenant $TenantFilter -Headers $Request.Headers -API $APINAME -message "Could not find QuarantineTemplate '$PolicyName' in drift standard settings for remediation" -Sev 'Warning'
+                            } else {
+                                $MatchedTemplate | Add-Member -MemberType NoteProperty -Name 'remediate' -Value $true -Force
+                                $MatchedTemplate | Add-Member -MemberType NoteProperty -Name 'report' -Value $true -Force
+                                $Settings = $MatchedTemplate
+                            }
+                        } elseif ($Setting -like '*ReusableSettingsTemplate*') {
+                            $Setting = 'ReusableSettingsTemplate'
+                            $TemplateId = $Deviation.standardName -replace '^(standards\.)?ReusableSettingsTemplates?\.', ''
+                            $MatchedTemplate = $StandardTemplate.standardSettings.ReusableSettingsTemplate | Where-Object { $_.TemplateList.value -like "*$TemplateId*" } | Select-Object -First 1
+                            if (-not $MatchedTemplate) {
+                                Write-LogMessage -tenant $TenantFilter -Headers $Request.Headers -API $APINAME -message "Could not find ReusableSettingsTemplate $TemplateId in drift standard settings for remediation" -Sev 'Warning'
+                            } else {
+                                $MatchedTemplate | Add-Member -MemberType NoteProperty -Name 'remediate' -Value $true -Force
+                                $MatchedTemplate | Add-Member -MemberType NoteProperty -Name 'report' -Value $true -Force
+                                $Settings = $MatchedTemplate
+                            }
                         } else {
                             $StandardTemplate = $StandardTemplate.standardSettings.$Setting
                             # If the addedComponent values are stored nested under standards.<setting> instead of
@@ -191,7 +225,7 @@ function Invoke-ExecUpdateDriftDeviation {
                             [PSCustomObject]@{
                                 standardName = $Deviation.standardName
                                 success      = $false
-                                error        = "The deviation status was updated, but no remediation task was scheduled: the template could not be resolved from the drift template settings. Verify the template still exists in the template library, or re-save the drift template."
+                                error        = "The deviation status was updated, but no remediation task was scheduled: '$Setting' could not be resolved from the drift template settings. Verify the template still exists in the template library and is included in the drift template, or re-save the drift template."
                             }
                         }
                     }

Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineTemplate.ps1

@@ -63,6 +63,14 @@ function Invoke-CIPPStandardQuarantineTemplate {
         # Compare the settings from standard with the current policies
         $CompareList = foreach ($Policy in $Settings) {
             try {
+                # displayName comes from an autoComplete, so it is normally an object with a .value.
+                # Drift remediation and hand-built templates can pass it as a plain string.
+                $PolicyDisplayName = $Policy.displayName.value ?? [string]$Policy.displayName
+                if ([string]::IsNullOrWhiteSpace($PolicyDisplayName)) {
+                    Write-LogMessage -API $APIName -tenant $Tenant -message 'Skipping a Quarantine policy entry with no display name.' -sev 'Warning'
+                    continue
+                }
+
                 # Create hashtable with desired Quarantine Setting
                 $EndUserQuarantinePermissions = @{
                     # ViewHeader and Download are set to false because the value 0 or 1 does nothing per Microsoft documentation
@@ -77,13 +85,13 @@ function Invoke-CIPPStandardQuarantineTemplate {
                 }
 
                 # If the Quarantine Policy already exists
-                if ($Policy.displayName.value -in $CurrentPolicies.Name) {
+                if ($PolicyDisplayName -in $CurrentPolicies.Name) {
                     #Get the current policy and convert EndUserQuarantinePermissions from string to hashtable for compare
-                    $ExistingPolicy = $CurrentPolicies | Where-Object -Property Name -EQ $Policy.displayName.value
+                    $ExistingPolicy = $CurrentPolicies | Where-Object -Property Name -EQ $PolicyDisplayName
                     $ExistingPolicyEndUserQuarantinePermissions = Convert-QuarantinePermissionsValue -InputObject $ExistingPolicy.EndUserQuarantinePermissions -ErrorAction Stop
 
                     #Compare the current policy
-                    $StateIsCorrect = ($ExistingPolicy.Name -eq $Policy.displayName.value) -and
+                    $StateIsCorrect = ($ExistingPolicy.Name -eq $PolicyDisplayName) -and
                     ($ExistingPolicy.ESNEnabled -eq $Policy.ESNEnabled) -and
                     ($ExistingPolicy.IncludeMessagesFromBlockedSenderAddress -eq $Policy.IncludeMessagesFromBlockedSenderAddress) -and
                     (!(Compare-Object @($ExistingPolicyEndUserQuarantinePermissions.values) @($EndUserQuarantinePermissions.values)))
@@ -94,7 +102,7 @@ function Invoke-CIPPStandardQuarantineTemplate {
                             missing                                 = $false
                             StateIsCorrect                          = $StateIsCorrect
                             Action                                  = 'None'
-                            displayName                             = $Policy.displayName.value
+                            displayName                             = $PolicyDisplayName
                             EndUserQuarantinePermissions            = $EndUserQuarantinePermissions
                             ESNEnabled                              = $Policy.ESNEnabled
                             IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress
@@ -109,7 +117,7 @@ function Invoke-CIPPStandardQuarantineTemplate {
                             missing                                 = $false
                             StateIsCorrect                          = $StateIsCorrect
                             Action                                  = 'Update'
-                            displayName                             = $Policy.displayName.value
+                            displayName                             = $PolicyDisplayName
                             EndUserQuarantinePermissions            = $EndUserQuarantinePermissions
                             ESNEnabled                              = $Policy.ESNEnabled
                             IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress
@@ -125,7 +133,7 @@ function Invoke-CIPPStandardQuarantineTemplate {
                         missing                                 = $true
                         StateIsCorrect                          = $false
                         Action                                  = 'Create'
-                        displayName                             = $Policy.displayName.value
+                        displayName                             = $PolicyDisplayName
                         EndUserQuarantinePermissions            = $EndUserQuarantinePermissions
                         ESNEnabled                              = $Policy.ESNEnabled
                         IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress
@@ -136,7 +144,7 @@ function Invoke-CIPPStandardQuarantineTemplate {
                 }
             } catch {
                 $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-                $Message = "Failed to compare Quarantine policy $($Policy.displayName.value), Error: $ErrorMessage"
+                $Message = "Failed to compare Quarantine policy $PolicyDisplayName, Error: $ErrorMessage"
                 Write-LogMessage -API $APIName -tenant $tenant -message $Message -sev 'Error'
                 return $Message
             }