feat: apply site version policy only on drift + app-only limitation - #14
Merged
Conversation
Add Test-SiteVersionPolicyDrift, which reads the current policy with Get-PnPSiteVersionPolicy and compares it against the desired settings using the real returned fields (DefaultTrimMode, DefaultExpireAfterDays, MajorVersionLimit). Set-PnPSiteVersionPolicy is now called only when a drift is detected; compliant sites are skipped. Reading fails safe: unreadable policy is treated as drift. Also fix a constraint validated live against a tenant: MajorWithMinorVersions must not be passed for a new-libraries-only request when auto expiration is off, so it is only added when the request targets existing libraries. Refs #13
Add static assertions for Test-SiteVersionPolicyDrift and the drift-gated apply, plus a functional context exercising the comparison against the exact Get-PnPSiteVersionPolicy field shapes captured from a live tenant (no policy, matching ExpireAfter 180/100, differing values, fail-safe on read error). 91 tests pass. Refs #13
Note in CHANGELOG/RELEASE-NOTES that Set-PnPSiteVersionPolicy is applied only on drift (via Get-PnPSiteVersionPolicy), that reading fails safe, and the MajorWithMinorVersions constraint. Add a drift-based apply note to the Configuration wiki. Refs #13
Get-/Set-PnPSiteVersionPolicy require a delegated user context that is site collection administrator, which is not available in Azure Automation with a Managed Identity (app-only). Emit a warning in that context so the likely 'unauthorized' failure is explained, and document the limitation in the Configuration wiki (prefer tenant-level Set-PnPTenant or interactive runs). Refs #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #13
Summary
Makes the site version policy modes (added in #11) idempotent by only calling
Set-PnPSiteVersionPolicywhen the current policy differs from the desired settings, and documents/guards the Azure Automation app-only limitation. Validated live against a demo tenant.Changes
Test-SiteVersionPolicyDrift): reads the current policy withGet-PnPSiteVersionPolicyand compares using the real returned fields —DefaultTrimMode(e.g.ExpireAfter),DefaultExpireAfterDays,MajorVersionLimit. Compliant sites are skipped; unreadable policy fails safe (treated as drift).MajorWithMinorVersionsis only passed when the request targets existing libraries. A live test showedSet-PnPSiteVersionPolicyrejects it for a new-libraries-only request when auto expiration is off.Get-/Set-PnPSiteVersionPolicyneed a delegated user context that is site collection admin. Emits a warning in Azure Automation (Managed Identity) and documents preferring tenant-levelSet-PnPTenantor interactive runs there.Testing
Field shapes and constraints were captured from a live tenant (device-code login):
Description= 'No Site Level Policy Set...'ExpireAfter180/100 ->DefaultTrimMode=ExpireAfter,DefaultExpireAfterDays=180,MajorVersionLimit=100Invoke-Pester-> 92 passed, 0 failed, including a functional drift context using those exact shapes.Notes
Builds on #12. No breaking change; default
Legacymode unaffected.