Share workflow runtime with diagnostics tool

LiamWorkflowActivities/C4IT.LIAM.WorkflowActivities.cs

@@ -449,23 +449,18 @@ namespace C4IT.LIAM.Activities
 
                 EnsureDataProviders(context);
 
-                var result = cloneTeam(ConfigID.Get(context), TeamId.Get(context), Name.Get(context), Description.Get(context), Visibility.Get(context), PartsToClone.Get(context), AdditionalMembers.Get(context), AdditionalOwners.Get(context)).GetAwaiter().GetResult();
+                var providerEntry = getDataProvider(ConfigID.Get(context));
-                Success.Set(context, result != null);
+                var result = LiamWorkflowRuntime.CloneTeamAsync(
-
+                    providerEntry?.Provider,
-                if (result?.Result?.targetResourceId != null)
+                    TeamId.Get(context),
-                {
+                    Name.Get(context),
-                    string idString = result.Result.targetResourceId.ToString();
+                    Description.Get(context),
-                    if (Guid.TryParse(idString, out Guid teamGuid))
+                    Visibility.Get(context),
-                    {
+                    PartsToClone.Get(context),
-                        CreatedTeamId.Set(context, teamGuid);
+                    AdditionalMembers.Get(context),
-                    }
+                    AdditionalOwners.Get(context)).GetAwaiter().GetResult();
-                    else
+                Success.Set(context, result != null && result.Success);
-                    {
+                CreatedTeamId.Set(context, result?.CreatedTeamId ?? Guid.Empty);
-                        LogEntry($"targetResourceId '{idString}' is not a valid Guid.", LogLevels.Warning);
-                        // Optional: alternativ hier einen Fehler werfen oder Guid.Empty zuweisen
-                        CreatedTeamId.Set(context, Guid.Empty);
-                    }
-                }
             }
             catch (Exception E)
             {
@@ -606,45 +601,17 @@ namespace C4IT.LIAM.Activities
                 ErrorMessage.Set(context, string.Empty);
 
                 var entry = getDataProvider(ConfigID.Get(context));
-                if (entry != null && entry.Provider is cLiamProviderExchange ex)
+                var result = LiamWorkflowRuntime.CreateDistributionGroup(
-                {
+                    entry?.Provider,
-                    var result = ex.exchangeManager.CreateDistributionGroupWithOwnershipGroups(
                     Name.Get(context),
                     Alias.Get(context),
                     DistributionListDisplayName.Get(context),
-                        PrimarySmtpAddress.Get(context),
+                    PrimarySmtpAddress.Get(context));
-                        out string errorCode,
+                Success.Set(context, result.Success);
-                        out string errorMessage
+                ObjectGuid.Set(context, result.ObjectGuid);
-                    );
+                CreatedGroups.Set(context, result.CreatedGroups);
-                    ErrorCode.Set(context, errorCode);
+                ErrorCode.Set(context, result.ErrorCode);
-                    ErrorMessage.Set(context, errorMessage);
+                ErrorMessage.Set(context, result.ErrorMessage);
-
-                    if (result != null)
-                    {
-                        Success.Set(context, true);
-                        ObjectGuid.Set(context, result.Item1);
-                        CreatedGroups.Set(context, result.Item2);
-                        LogEntry(
-                            $"Distribution group creation succeeded. ObjectGuid='{result.Item1}', CreatedGroups='{result.Item2?.Count ?? 0}'",
-                            LogLevels.Info);
-                    }
-                    else
-                    {
-                        Success.Set(context, false);
-                        LogEntry(
-                            $"Distribution group creation failed [{errorCode}] {errorMessage}",
-                            LogLevels.Error);
-                    }
-                }
-                else
-                {
-                    Success.Set(context, false);
-                    ErrorCode.Set(context, "WF_PROVIDER_INVALID");
-                    ErrorMessage.Set(context, $"Provider is not a cLiamProviderExchange for config '{ConfigID.Get(context)}'.");
-                    LogEntry(
-                        $"Distribution group creation failed [WF_PROVIDER_INVALID] Provider is not a cLiamProviderExchange for config '{ConfigID.Get(context)}'.",
-                        LogLevels.Error);
-                }
             }
             catch (Exception e)
             {
@@ -729,45 +696,17 @@ namespace C4IT.LIAM.Activities
                 ErrorMessage.Set(context, string.Empty);
 
                 var entry = getDataProvider(ConfigID.Get(context));
-                if (entry != null && entry.Provider is cLiamProviderExchange ex)
+                var result = LiamWorkflowRuntime.CreateSharedMailbox(
-                {
+                    entry?.Provider,
-                    var result = ex.exchangeManager.CreateSharedMailboxWithOwnershipGroups(
                     Name.Get(context),
                     Alias.Get(context),
                     MailboxDisplayName.Get(context),
-                        PrimarySmtpAddress.Get(context),
+                    PrimarySmtpAddress.Get(context));
-                        out string errorCode,
+                Success.Set(context, result.Success);
-                        out string errorMessage
+                ObjectGuid.Set(context, result.ObjectGuid);
-                    );
+                CreatedGroups.Set(context, result.CreatedGroups);
-                    ErrorCode.Set(context, errorCode);
+                ErrorCode.Set(context, result.ErrorCode);
-                    ErrorMessage.Set(context, errorMessage);
+                ErrorMessage.Set(context, result.ErrorMessage);
-
-                    if (result != null)
-                    {
-                        Success.Set(context, true);
-                        ObjectGuid.Set(context, result.Item1);
-                        CreatedGroups.Set(context, result.Item2);
-                        LogEntry(
-                            $"Shared mailbox creation succeeded. ObjectGuid='{result.Item1}', CreatedGroups='{result.Item2?.Count ?? 0}'",
-                            LogLevels.Info);
-                    }
-                    else
-                    {
-                        Success.Set(context, false);
-                        LogEntry(
-                            $"Shared mailbox creation failed [{errorCode}] {errorMessage}",
-                            LogLevels.Error);
-                    }
-                }
-                else
-                {
-                    Success.Set(context, false);
-                    ErrorCode.Set(context, "WF_PROVIDER_INVALID");
-                    ErrorMessage.Set(context, $"Provider is not a cLiamProviderExchange for config '{ConfigID.Get(context)}'.");
-                    LogEntry(
-                        $"Shared mailbox creation failed [WF_PROVIDER_INVALID] Provider is not a cLiamProviderExchange for config '{ConfigID.Get(context)}'.",
-                        LogLevels.Error);
-                }
             }
             catch (Exception e)
             {
@@ -892,15 +831,16 @@ namespace C4IT.LIAM.Activities
                     var ownerList = OwnerSids.Expression != null ? OwnerSids.Get(context) : null;
                     var memberList = MemberSids.Expression != null ? MemberSids.Get(context) : null;
 
-                    var groups = adProv.CreateServiceGroups(
+                    var result = LiamWorkflowRuntime.CreateAdServiceGroups(
+                        adProv,
                         svcName,
                         desc,
                         scopeEnum,
                         typeEnum,
                         ownerList,
                         memberList);
-                    Success.Set(context, groups != null);
+                    Success.Set(context, result.Success);
-                    CreatedGroups.Set(context, groups);
+                    CreatedGroups.Set(context, result.CreatedGroups);
                 }
                 else
                 {
@@ -937,9 +877,9 @@ namespace C4IT.LIAM.Activities
         {
             EnsureDataProviders(context);
             var cfgId = ConfigID.Get(context);
-            var provider = getDataProvider(cfgId).Provider as cLiamProviderNtfs;
+            var provider = getDataProvider(cfgId)?.Provider;
-            // evtl. CustomTags, OwnerSIDs etc. aus Activity-Inputs holen
+            var result = LiamWorkflowRuntime.CreateDataAreaAsync(
-            var res = provider.CreateDataAreaAsync(
+                provider,
                 NewFolderPath.Get(context),
                 ParentFolderPath.Get(context),
                 /*customTags*/null,
@@ -947,7 +887,7 @@ namespace C4IT.LIAM.Activities
                 /*readerSids*/null,
                 /*writerSids*/null
             ).GetAwaiter().GetResult();
-            ResultToken.Set(context, JsonValue.Parse(JsonConvert.SerializeObject(res)));
+            ResultToken.Set(context, JsonValue.Parse(JsonConvert.SerializeObject(result.ResultToken)));
         }
         private void EnsureDataProviders(NativeActivityContext context)
         {
@@ -1002,45 +942,22 @@ namespace C4IT.LIAM.Activities
             EnsureDataProviders(context);
 
             var cfgId = ConfigID.Get(context);
-            var providerEntry = getDataProvider(cfgId);
-            var provider = providerEntry?.Provider as cLiamProviderNtfs;
-            var folderPath = FolderPath.Get(context);
-            if (provider == null || string.IsNullOrWhiteSpace(folderPath))
-            {
-                Success.Set(context, false);
-                ResultToken.Set(context, JsonValue.Parse(JsonConvert.SerializeObject(new ResultToken(GetType().Name)
-                {
-                    resultErrorId = 1,
-                    resultMessage = provider == null ? "Configured provider is not NTFS or not initialized." : "Folder path is missing."
-                })));
-                return;
-            }
-
             var ownerSids = OwnerSids.Expression != null ? OwnerSids.Get(context) : null;
             var readerSids = ReaderSids.Expression != null ? ReaderSids.Get(context) : null;
             var writerSids = WriterSids.Expression != null ? WriterSids.Get(context) : null;
 
-            var result = provider.EnsureMissingPermissionGroupsAsync(
+            var providerEntry = getDataProvider(cfgId);
-                folderPath,
+            var result = LiamWorkflowRuntime.EnsureNtfsPermissionGroupsAsync(
+                providerEntry?.Provider,
+                FolderPath.Get(context),
                 null,
-                NormalizeSidList(ownerSids),
+                ownerSids,
-                NormalizeSidList(readerSids),
+                readerSids,
-                NormalizeSidList(writerSids),
+                writerSids,
                 EnsureTraverse.Get(context)).GetAwaiter().GetResult();
 
-            Success.Set(context, result != null && result.resultErrorId == 0);
+            Success.Set(context, result.Success);
-            ResultToken.Set(context, JsonValue.Parse(JsonConvert.SerializeObject(result)));
+            ResultToken.Set(context, JsonValue.Parse(JsonConvert.SerializeObject(result.ResultToken)));
-        }
-
-        private IEnumerable<string> NormalizeSidList(IEnumerable<string> rawSids)
-        {
-            if (rawSids == null)
-                return Enumerable.Empty<string>();
-
-            return rawSids
-                .Select(i => i?.Trim())
-                .Where(i => !string.IsNullOrWhiteSpace(i))
-                .Distinct(StringComparer.OrdinalIgnoreCase);
         }
 
         private void EnsureDataProviders(NativeActivityContext context)

LiamWorkflowActivities/C4IT.LIAM.WorkflowactivityBase.cs

@@ -435,52 +435,20 @@ namespace LiamWorkflowActivities
                     return null;
                 }
 
-                var lstSecurityGroups = await ProviderEntry.Provider.getSecurityGroupsAsync(ProviderEntry.Provider.GroupFilter);
+                var result = await LiamWorkflowRuntime.GetSecurityGroupsFromProviderAsync(ProviderEntry.Provider);
-                if (lstSecurityGroups == null)
+                if (!result.Success)
                 {
-                    SetOperationErrorFromProvider(
+                    SetOperationError(result.ErrorCode, result.ErrorMessage);
-                        ProviderEntry.Provider,
-                        "WF_GET_SECURITYGROUPS_PROVIDER_CALL_FAILED",
-                        "Provider returned null while reading security groups.");
                     return null;
                 }
 
-                if (lstSecurityGroups.Count == 0)
+                if (result.SecurityGroups.Count == 0)
                 {
                     LogEntry($"No security groups found for Provider config class with ID {ProviderConfigClassID}", LogLevels.Warning);
                     return new List<SecurityGroupEntry>();
                 }
 
-                var SGs = new List<SecurityGroupEntry>();
+                return result.SecurityGroups;
-                foreach (var sg in lstSecurityGroups)
-                {
-                    var entry = new SecurityGroupEntry
-                    {
-                        DisplayName = sg.TechnicalName,
-                        TechnicalName = sg.UID,
-                        TargetType = ((int)sg.Provider.ProviderType).ToString()
-                    };
-
-                    switch (sg)
-                    {
-                        case cLiamAdGroup adGroup:
-                            entry.UID = adGroup.dn;
-                            entry.Scope = adGroup.scope;
-                            break;
-                        case cLiamAdGroup2 adGroup:
-                            entry.UID = adGroup.dn;
-                            entry.Scope = adGroup.scope;
-                            break;
-                        case cLiamExchangeSecurityGroup exGroup:
-                            entry.UID = exGroup.dn;  // SID der Exchange-Gruppe
-                            //entry.Scope = exGroup.dn;   // Distinguished Name der Exchange-Gruppe
-                            break;
-                    }
-
-                    SGs.Add(entry);
-                }
-
-                return SGs;
             }
             catch (Exception E)
             {
@@ -518,95 +486,22 @@ namespace LiamWorkflowActivities
                     return null;
                 }
 
-                var lstDataAreas = await ProviderEntry.Provider.getDataAreasAsync(ProviderEntry.Provider.MaxDepth);
+                var result = await LiamWorkflowRuntime.GetDataAreasFromProviderAsync(
-                if (lstDataAreas == null)
-                {
-                    SetOperationErrorFromProvider(
                     ProviderEntry.Provider,
-                        "WF_GET_DATAAREAS_PROVIDER_CALL_FAILED",
+                    ProviderEntry.ObjectID.ToString());
-                        "Provider returned null while reading data areas.");
+                if (!result.Success)
+                {
+                    SetOperationError(result.ErrorCode, result.ErrorMessage);
                     return null;
                 }
 
-                if (lstDataAreas.Count <= 0)
+                if (result.DataAreas.Count <= 0)
                 {
                     LogEntry($"No data areas found for Provider config class with ID {ProviderConfigClassID}", LogLevels.Warning);
                     return new List<DataAreaEntry>();
                 }
 
-                if (!await EnsureNtfsPermissionGroupsIfConfiguredAsync(ProviderEntry, lstDataAreas))
+                return result.DataAreas;
-                    return null;
-
-                return lstDataAreas
-                    .Select(DataArea =>
-                    {
-                        var ntfsPermissionArea = DataArea as cLiamNtfsPermissionDataAreaBase;
-                        var adGrp = DataArea as cLiamAdGroupAsDataArea;
-                        var exchMB = DataArea as cLiamExchangeSharedMailbox;
-                        var exchDL = DataArea as cLiamExchangeDistributionGroup;
-
-                        // 1) Owner
-                        //    - Shared Mailbox: OwnerGroupIdentifier
-                        //    - Distribution Group:   OwnerGroupIdentifier
-                        //    - AD-Group:             ManagedBySID
-                        //    - NTFS-Folder:          OwnerGroupIdentifier
-                        string owner = exchMB?.OwnerGroupIdentifier
-                                       ?? exchDL?.OwnerGroupIdentifier
-                                       ?? adGrp?.ManagedBySID
-                                       ?? ntfsPermissionArea?.OwnerGroupIdentifier
-                                       ?? string.Empty;
-
-                        // 2) Write‑SID
-                        //    - Shared Mailbox: FullAccessGroupSid
-                        //    - Distribution Group: MemberGroupSid
-                        //    - AD-Group:          UID
-                        //    - NTFS-Folder:       WriteGroupIdentifier
-                        string write = exchMB != null
-                                       ? exchMB.FullAccessGroupSid
-                                       : exchDL != null
-                                       ? exchDL.MemberGroupSid
-                                         : adGrp?.UID
-                                           ?? ntfsPermissionArea?.WriteGroupIdentifier
-                                           ?? string.Empty;
-
-                        // 3) Read‑SID
-                        //    - Shared Mailbox: SendAsGroupSid
-                        //    - Distribution Group: (nicht verwendet)
-                        //    - NTFS-Folder:       ReadGroupIdentifier
-                        string read = exchMB != null
-                                      ? exchMB.SendAsGroupSid
-                                      : ntfsPermissionArea?.ReadGroupIdentifier
-                                        ?? string.Empty;
-
-                        // 4) Traverse nur NTFS-Objekte
-                        string traverse = ntfsPermissionArea?.TraverseGroupIdentifier ?? string.Empty;
-
-                        // 5) CreatedDate nur NTFS-Objekte
-                        string created = ntfsPermissionArea?.CreatedDate ?? DateTime.MinValue.ToString("o");
-
-                        // 6) Description: nur AD-Group
-                        string desc = adGrp?.Description ?? string.Empty;
-
-                        return new DataAreaEntry
-                        {
-                            DisplayName = DataArea.DisplayName ?? string.Empty,
-                            UID = DataArea.UID,
-                            TechnicalName = DataArea.TechnicalName,
-                            Description = desc,
-                            TargetType = ((int)DataArea.Provider.ProviderType).ToString(),
-                            ParentUID = DataArea.ParentUID ?? string.Empty,
-                            Level = DataArea.Level.ToString(),
-                            ConfigurationId = ProviderEntry.ObjectID.ToString(),
-                            DataAreaType = DataArea.DataType.ToString(),
-
-                            Owner = owner,
-                            Write = write,
-                            Read = read,
-                            Traverse = traverse,
-                            CreatedDate = created,
-                        };
-                    })
-                    .ToList();
             }
             catch (Exception E)
             {
@@ -620,57 +515,6 @@ namespace LiamWorkflowActivities
             }
         }
 
-        private async Task<bool> EnsureNtfsPermissionGroupsIfConfiguredAsync(ProviderCacheEntry providerEntry, List<cLiamDataAreaBase> dataAreas)
-        {
-            if (!(providerEntry?.Provider is cLiamProviderNtfs ntfsProvider))
-                return true;
-
-            if (!IsAdditionalConfigurationEnabled(providerEntry.Provider, "EnsureNtfsPermissionGroups"))
-                return true;
-
-            foreach (var ntfsArea in dataAreas.OfType<cLiamNtfsFolder>())
-            {
-                var folderPath = ntfsArea.TechnicalName;
-                if (string.IsNullOrWhiteSpace(folderPath))
-                    continue;
-
-                if (!Directory.Exists(folderPath))
-                {
-                    LogEntry($"Skipping automatic NTFS permission group ensure for '{folderPath}' because the directory does not exist.", LogLevels.Warning);
-                    continue;
-                }
-
-                var result = await ntfsProvider.EnsureMissingPermissionGroupsAsync(
-                    folderPath,
-                    null,
-                    null,
-                    null,
-                    null,
-                    false);
-
-                if (result == null)
-                {
-                    SetOperationError(
-                        "WF_GET_DATAAREAS_ENSURE_NTFS_GROUPS_FAILED",
-                        $"Automatic NTFS permission group ensure failed for '{folderPath}' because the provider returned no result.");
-                    return false;
-                }
-
-                if (result.resultErrorId != 0)
-                {
-                    SetOperationError(
-                        "WF_GET_DATAAREAS_ENSURE_NTFS_GROUPS_FAILED",
-                        $"Automatic NTFS permission group ensure failed for '{folderPath}': {result.resultMessage}");
-                    return false;
-                }
-
-                await ntfsArea.ResolvePermissionGroupsAsync(folderPath);
-            }
-
-            return true;
-        }
-
-
         private async Task<cLiamDataAreaBase> getDataAreaFromUID(string UID)
         {
             var CM = MethodBase.GetCurrentMethod();

LiamWorkflowActivities/LiamWorkflowActivities.csproj

@@ -85,6 +85,7 @@
     </Compile>
     <Compile Include="C4IT.LIAM.WorkflowactivityBase.cs" />
     <Compile Include="C4IT.LIAM.WorkflowActivities.cs" />
+    <Compile Include="LiamWorkflowRuntime.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
   </ItemGroup>
   <ItemGroup>

LiamWorkflowActivities/LiamWorkflowRuntime.cs

@@ -0,0 +1,570 @@
+using C4IT.LIAM;
+using C4IT.Logging;
+using C4IT.MsGraph;
+using C4IT_IAM_Engine;
+using LiamAD;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using static C4IT.Logging.cLogManager;
+using static LiamAD.ADServiceGroupCreator;
+
+namespace LiamWorkflowActivities
+{
+    public class GetDataAreasOperationResult
+    {
+        public bool Success { get; set; }
+        public string ErrorCode { get; set; } = string.Empty;
+        public string ErrorMessage { get; set; } = string.Empty;
+        public List<DataAreaEntry> DataAreas { get; set; } = new List<DataAreaEntry>();
+    }
+
+    public class GetSecurityGroupsOperationResult
+    {
+        public bool Success { get; set; }
+        public string ErrorCode { get; set; } = string.Empty;
+        public string ErrorMessage { get; set; } = string.Empty;
+        public List<SecurityGroupEntry> SecurityGroups { get; set; } = new List<SecurityGroupEntry>();
+    }
+
+    public class NtfsOperationResult
+    {
+        public bool Success { get; set; }
+        public ResultToken ResultToken { get; set; }
+    }
+
+    public class AdServiceGroupOperationResult
+    {
+        public bool Success { get; set; }
+        public string ErrorCode { get; set; } = string.Empty;
+        public string ErrorMessage { get; set; } = string.Empty;
+        public List<Tuple<string, string, string, string>> CreatedGroups { get; set; } = new List<Tuple<string, string, string, string>>();
+    }
+
+    public class ExchangeProvisionOperationResult
+    {
+        public bool Success { get; set; }
+        public Guid ObjectGuid { get; set; } = Guid.Empty;
+        public List<Tuple<string, string, string, string>> CreatedGroups { get; set; } = new List<Tuple<string, string, string, string>>();
+        public string ErrorCode { get; set; } = string.Empty;
+        public string ErrorMessage { get; set; } = string.Empty;
+    }
+
+    public class CloneTeamOperationResult
+    {
+        public bool Success { get; set; }
+        public Guid CreatedTeamId { get; set; } = Guid.Empty;
+        public cMsGraphResultBase Result { get; set; }
+        public string ErrorCode { get; set; } = string.Empty;
+        public string ErrorMessage { get; set; } = string.Empty;
+    }
+
+    public static class LiamWorkflowRuntime
+    {
+        public static async Task<GetDataAreasOperationResult> GetDataAreasFromProviderAsync(cLiamProviderBase provider, string configurationId = null)
+        {
+            var result = new GetDataAreasOperationResult();
+            if (provider == null)
+            {
+                result.ErrorCode = "WF_GET_DATAAREAS_PROVIDER_NOT_FOUND";
+                result.ErrorMessage = "Configured provider is not initialized.";
+                return result;
+            }
+
+            try
+            {
+                var dataAreas = await provider.getDataAreasAsync(provider.MaxDepth);
+                if (dataAreas == null)
+                {
+                    SetErrorFromProvider(result, provider, "WF_GET_DATAAREAS_PROVIDER_CALL_FAILED", "Provider returned null while reading data areas.");
+                    return result;
+                }
+
+                if (!await EnsureNtfsPermissionGroupsIfConfiguredAsync(provider, dataAreas, result))
+                    return result;
+
+                result.DataAreas = dataAreas
+                    .Select(dataArea => MapDataAreaEntry(dataArea, configurationId))
+                    .ToList();
+                result.Success = true;
+                return result;
+            }
+            catch (Exception ex)
+            {
+                LogException(ex);
+                result.ErrorCode = "WF_GET_DATAAREAS_EXCEPTION";
+                result.ErrorMessage = ex.Message;
+                return result;
+            }
+        }
+
+        public static async Task<GetSecurityGroupsOperationResult> GetSecurityGroupsFromProviderAsync(cLiamProviderBase provider)
+        {
+            var result = new GetSecurityGroupsOperationResult();
+            if (provider == null)
+            {
+                result.ErrorCode = "WF_GET_SECURITYGROUPS_PROVIDER_NOT_FOUND";
+                result.ErrorMessage = "Configured provider is not initialized.";
+                return result;
+            }
+
+            try
+            {
+                var securityGroups = await provider.getSecurityGroupsAsync(provider.GroupFilter);
+                if (securityGroups == null)
+                {
+                    SetErrorFromProvider(result, provider, "WF_GET_SECURITYGROUPS_PROVIDER_CALL_FAILED", "Provider returned null while reading security groups.");
+                    return result;
+                }
+
+                result.SecurityGroups = securityGroups
+                    .Select(MapSecurityGroupEntry)
+                    .ToList();
+                result.Success = true;
+                return result;
+            }
+            catch (Exception ex)
+            {
+                LogException(ex);
+                result.ErrorCode = "WF_GET_SECURITYGROUPS_EXCEPTION";
+                result.ErrorMessage = ex.Message;
+                return result;
+            }
+        }
+
+        public static async Task<NtfsOperationResult> CreateDataAreaAsync(
+            cLiamProviderBase provider,
+            string newFolderPath,
+            string parentFolderPath,
+            IDictionary<string, string> customTags,
+            IEnumerable<string> ownerSids,
+            IEnumerable<string> readerSids,
+            IEnumerable<string> writerSids)
+        {
+            var result = new NtfsOperationResult();
+            if (!(provider is cLiamProviderNtfs ntfsProvider))
+            {
+                result.ResultToken = CreateInvalidNtfsResultToken("Configured provider is not NTFS or not initialized.");
+                return result;
+            }
+
+            var token = await ntfsProvider.CreateDataAreaAsync(
+                newFolderPath,
+                parentFolderPath,
+                customTags,
+                NormalizeIdentifierList(ownerSids),
+                NormalizeIdentifierList(readerSids),
+                NormalizeIdentifierList(writerSids));
+            if (token == null)
+                token = CreateInvalidNtfsResultToken(ntfsProvider.GetLastErrorMessage() ?? "Provider returned no result while creating the data area.");
+            result.ResultToken = token;
+            result.Success = token != null && token.resultErrorId == 0;
+            return result;
+        }
+
+        public static async Task<NtfsOperationResult> EnsureNtfsPermissionGroupsAsync(
+            cLiamProviderBase provider,
+            string folderPath,
+            IDictionary<string, string> customTags,
+            IEnumerable<string> ownerSids,
+            IEnumerable<string> readerSids,
+            IEnumerable<string> writerSids,
+            bool ensureTraverseGroups)
+        {
+            var result = new NtfsOperationResult();
+            if (!(provider is cLiamProviderNtfs ntfsProvider) || string.IsNullOrWhiteSpace(folderPath))
+            {
+                result.ResultToken = CreateInvalidNtfsResultToken(provider is cLiamProviderNtfs
+                    ? "Folder path is missing."
+                    : "Configured provider is not NTFS or not initialized.");
+                return result;
+            }
+
+            var token = await ntfsProvider.EnsureMissingPermissionGroupsAsync(
+                folderPath,
+                customTags,
+                NormalizeIdentifierList(ownerSids),
+                NormalizeIdentifierList(readerSids),
+                NormalizeIdentifierList(writerSids),
+                ensureTraverseGroups);
+            if (token == null)
+                token = CreateInvalidNtfsResultToken(ntfsProvider.GetLastErrorMessage() ?? "Provider returned no result while ensuring NTFS permission groups.");
+            result.ResultToken = token;
+            result.Success = token != null && token.resultErrorId == 0;
+            return result;
+        }
+
+        public static AdServiceGroupOperationResult CreateAdServiceGroups(
+            cLiamProviderBase provider,
+            string serviceName,
+            string description,
+            eLiamAccessRoleScopes scope,
+            ADGroupType groupType,
+            IEnumerable<string> ownerSids,
+            IEnumerable<string> memberSids)
+        {
+            var result = new AdServiceGroupOperationResult();
+            if (!(provider is cLiamProviderAD adProvider))
+            {
+                result.ErrorCode = "WF_PROVIDER_INVALID";
+                result.ErrorMessage = "Configured provider is not Active Directory or not initialized.";
+                return result;
+            }
+
+            try
+            {
+                var groups = adProvider.CreateServiceGroups(
+                    serviceName,
+                    description,
+                    scope,
+                    groupType,
+                    NormalizeIdentifierList(ownerSids),
+                    NormalizeIdentifierList(memberSids));
+                result.Success = groups != null;
+                result.CreatedGroups = groups ?? new List<Tuple<string, string, string, string>>();
+                return result;
+            }
+            catch (Exception ex)
+            {
+                LogException(ex);
+                result.ErrorCode = "WF_ACTIVITY_EXCEPTION";
+                result.ErrorMessage = ex.Message;
+                return result;
+            }
+        }
+
+        public static async Task<CloneTeamOperationResult> CloneTeamAsync(
+            cLiamProviderBase provider,
+            string teamId,
+            string name,
+            string description,
+            int visibility,
+            int partsToClone,
+            string additionalMembers,
+            string additionalOwners)
+        {
+            var result = new CloneTeamOperationResult();
+            if (!(provider is cLiamProviderMsTeams msTeamsProvider))
+            {
+                result.ErrorCode = "WF_PROVIDER_INVALID";
+                result.ErrorMessage = "Configured provider is not MsTeams or not initialized.";
+                return result;
+            }
+
+            try
+            {
+                var cloneResult = await msTeamsProvider.cloneTeam(teamId, name, description, visibility, partsToClone, additionalMembers, additionalOwners);
+                result.Result = cloneResult;
+                result.Success = cloneResult != null;
+
+                if (cloneResult?.Result?.targetResourceId != null)
+                {
+                    var idString = cloneResult.Result.targetResourceId.ToString();
+                    if (Guid.TryParse(idString, out var createdTeamId))
+                    {
+                        result.CreatedTeamId = createdTeamId;
+                    }
+                    else
+                    {
+                        LogEntry($"targetResourceId '{idString}' is not a valid Guid.", LogLevels.Warning);
+                    }
+                }
+
+                return result;
+            }
+            catch (Exception ex)
+            {
+                LogException(ex);
+                result.ErrorCode = "WF_ACTIVITY_EXCEPTION";
+                result.ErrorMessage = ex.Message;
+                return result;
+            }
+        }
+
+        public static ExchangeProvisionOperationResult CreateDistributionGroup(
+            cLiamProviderBase provider,
+            string name,
+            string alias,
+            string displayName,
+            string primarySmtpAddress)
+        {
+            var result = new ExchangeProvisionOperationResult();
+            if (!(provider is cLiamProviderExchange exchangeProvider))
+            {
+                result.ErrorCode = "WF_PROVIDER_INVALID";
+                result.ErrorMessage = "Configured provider is not Exchange or not initialized.";
+                return result;
+            }
+
+            try
+            {
+                var created = exchangeProvider.exchangeManager.CreateDistributionGroupWithOwnershipGroups(
+                    name,
+                    alias,
+                    displayName,
+                    primarySmtpAddress,
+                    out string errorCode,
+                    out string errorMessage);
+                result.ErrorCode = errorCode ?? string.Empty;
+                result.ErrorMessage = errorMessage ?? string.Empty;
+
+                if (created != null)
+                {
+                    result.Success = true;
+                    result.ObjectGuid = created.Item1;
+                    result.CreatedGroups = created.Item2 ?? new List<Tuple<string, string, string, string>>();
+                }
+
+                return result;
+            }
+            catch (Exception ex)
+            {
+                LogException(ex);
+                result.ErrorCode = "WF_ACTIVITY_EXCEPTION";
+                result.ErrorMessage = ex.Message;
+                return result;
+            }
+        }
+
+        public static ExchangeProvisionOperationResult CreateSharedMailbox(
+            cLiamProviderBase provider,
+            string name,
+            string alias,
+            string displayName,
+            string primarySmtpAddress)
+        {
+            var result = new ExchangeProvisionOperationResult();
+            if (!(provider is cLiamProviderExchange exchangeProvider))
+            {
+                result.ErrorCode = "WF_PROVIDER_INVALID";
+                result.ErrorMessage = "Configured provider is not Exchange or not initialized.";
+                return result;
+            }
+
+            try
+            {
+                var created = exchangeProvider.exchangeManager.CreateSharedMailboxWithOwnershipGroups(
+                    name,
+                    alias,
+                    displayName,
+                    primarySmtpAddress,
+                    out string errorCode,
+                    out string errorMessage);
+                result.ErrorCode = errorCode ?? string.Empty;
+                result.ErrorMessage = errorMessage ?? string.Empty;
+
+                if (created != null)
+                {
+                    result.Success = true;
+                    result.ObjectGuid = created.Item1;
+                    result.CreatedGroups = created.Item2 ?? new List<Tuple<string, string, string, string>>();
+                }
+
+                return result;
+            }
+            catch (Exception ex)
+            {
+                LogException(ex);
+                result.ErrorCode = "WF_ACTIVITY_EXCEPTION";
+                result.ErrorMessage = ex.Message;
+                return result;
+            }
+        }
+
+        private static ResultToken CreateInvalidNtfsResultToken(string message)
+        {
+            return new ResultToken("LiamWorkflowRuntime")
+            {
+                resultErrorId = 1,
+                resultMessage = message ?? string.Empty
+            };
+        }
+
+        private static IEnumerable<string> NormalizeIdentifierList(IEnumerable<string> identifiers)
+        {
+            if (identifiers == null)
+                return Enumerable.Empty<string>();
+
+            return identifiers
+                .Select(i => i?.Trim())
+                .Where(i => !string.IsNullOrWhiteSpace(i))
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .ToList();
+        }
+
+        private static async Task<bool> EnsureNtfsPermissionGroupsIfConfiguredAsync(cLiamProviderBase provider, List<cLiamDataAreaBase> dataAreas, GetDataAreasOperationResult result)
+        {
+            if (!(provider is cLiamProviderNtfs ntfsProvider))
+                return true;
+
+            if (!IsAdditionalConfigurationEnabled(provider, "EnsureNtfsPermissionGroups"))
+                return true;
+
+            foreach (var ntfsArea in dataAreas.OfType<cLiamNtfsFolder>())
+            {
+                var folderPath = ntfsArea.TechnicalName;
+                if (string.IsNullOrWhiteSpace(folderPath))
+                    continue;
+
+                if (!Directory.Exists(folderPath))
+                {
+                    LogEntry($"Skipping automatic NTFS permission group ensure for '{folderPath}' because the directory does not exist.", LogLevels.Warning);
+                    continue;
+                }
+
+                var ensureResult = await ntfsProvider.EnsureMissingPermissionGroupsAsync(
+                    folderPath,
+                    null,
+                    null,
+                    null,
+                    null,
+                    false);
+                if (ensureResult == null)
+                {
+                    result.ErrorCode = "WF_GET_DATAAREAS_ENSURE_NTFS_GROUPS_FAILED";
+                    result.ErrorMessage = $"Automatic NTFS permission group ensure failed for '{folderPath}' because the provider returned no result.";
+                    return false;
+                }
+
+                if (ensureResult.resultErrorId != 0)
+                {
+                    result.ErrorCode = "WF_GET_DATAAREAS_ENSURE_NTFS_GROUPS_FAILED";
+                    result.ErrorMessage = $"Automatic NTFS permission group ensure failed for '{folderPath}': {ensureResult.resultMessage}";
+                    return false;
+                }
+
+                await ntfsArea.ResolvePermissionGroupsAsync(folderPath);
+            }
+
+            return true;
+        }
+
+        private static bool IsAdditionalConfigurationEnabled(cLiamProviderBase provider, string key)
+        {
+            if (provider?.AdditionalConfiguration == null || string.IsNullOrWhiteSpace(key))
+                return false;
+
+            if (!provider.AdditionalConfiguration.TryGetValue(key, out var rawValue) || string.IsNullOrWhiteSpace(rawValue))
+                return false;
+
+            return rawValue.Equals("true", StringComparison.OrdinalIgnoreCase)
+                || rawValue.Equals("1", StringComparison.OrdinalIgnoreCase)
+                || rawValue.Equals("yes", StringComparison.OrdinalIgnoreCase);
+        }
+
+        private static void SetErrorFromProvider(GetDataAreasOperationResult result, cLiamProviderBase provider, string fallbackCode, string fallbackMessage)
+        {
+            var error = ExtractProviderError(provider, fallbackCode, fallbackMessage);
+            result.ErrorCode = error.Item1;
+            result.ErrorMessage = error.Item2;
+        }
+
+        private static void SetErrorFromProvider(GetSecurityGroupsOperationResult result, cLiamProviderBase provider, string fallbackCode, string fallbackMessage)
+        {
+            var error = ExtractProviderError(provider, fallbackCode, fallbackMessage);
+            result.ErrorCode = error.Item1;
+            result.ErrorMessage = error.Item2;
+        }
+
+        private static Tuple<string, string> ExtractProviderError(cLiamProviderBase provider, string fallbackCode, string fallbackMessage)
+        {
+            if (provider is cLiamProviderExchange exchangeProvider)
+            {
+                var code = exchangeProvider.GetLastErrorCode();
+                var message = exchangeProvider.GetLastErrorMessage();
+                if (!string.IsNullOrWhiteSpace(code) || !string.IsNullOrWhiteSpace(message))
+                {
+                    return Tuple.Create(
+                        string.IsNullOrWhiteSpace(code) ? fallbackCode : code,
+                        string.IsNullOrWhiteSpace(message) ? fallbackMessage : message);
+                }
+            }
+
+            var providerMessage = provider?.GetLastErrorMessage();
+            return Tuple.Create(
+                fallbackCode,
+                string.IsNullOrWhiteSpace(providerMessage) ? fallbackMessage : providerMessage);
+        }
+
+        private static DataAreaEntry MapDataAreaEntry(cLiamDataAreaBase dataArea, string configurationId)
+        {
+            var ntfsPermissionArea = dataArea as cLiamNtfsPermissionDataAreaBase;
+            var ntfsFolder = dataArea as cLiamNtfsFolder;
+            var adGroup = dataArea as cLiamAdGroupAsDataArea;
+            var exchangeMailbox = dataArea as cLiamExchangeSharedMailbox;
+            var exchangeDistribution = dataArea as cLiamExchangeDistributionGroup;
+
+            var owner = exchangeMailbox?.OwnerGroupIdentifier
+                        ?? exchangeDistribution?.OwnerGroupIdentifier
+                        ?? adGroup?.ManagedBySID
+                        ?? ntfsPermissionArea?.OwnerGroupIdentifier
+                        ?? string.Empty;
+
+            var write = exchangeMailbox != null
+                ? exchangeMailbox.FullAccessGroupSid
+                : exchangeDistribution != null
+                    ? exchangeDistribution.MemberGroupSid
+                    : adGroup?.UID
+                      ?? ntfsPermissionArea?.WriteGroupIdentifier
+                      ?? string.Empty;
+
+            var read = exchangeMailbox != null
+                ? exchangeMailbox.SendAsGroupSid
+                : ntfsPermissionArea?.ReadGroupIdentifier
+                  ?? string.Empty;
+
+            var traverse = ntfsPermissionArea?.TraverseGroupIdentifier ?? string.Empty;
+            var created = ntfsPermissionArea?.CreatedDate ?? DateTime.MinValue.ToString("o");
+            var description = adGroup?.Description ?? string.Empty;
+
+            return new DataAreaEntry
+            {
+                DisplayName = dataArea.DisplayName ?? string.Empty,
+                UID = dataArea.UID ?? string.Empty,
+                TechnicalName = dataArea.TechnicalName ?? string.Empty,
+                Description = description,
+                TargetType = ((int)dataArea.Provider.ProviderType).ToString(),
+                ParentUID = dataArea.ParentUID ?? string.Empty,
+                Level = dataArea.Level.ToString(),
+                Owner = owner,
+                Write = write,
+                Read = read,
+                Traverse = traverse,
+                CreatedDate = created,
+                ConfigurationId = configurationId ?? string.Empty,
+                BaseFolder = ntfsFolder?.Share?.TechnicalName ?? dataArea.Provider?.RootPath ?? string.Empty,
+                UniqueId = dataArea.UID ?? string.Empty,
+                DataAreaType = dataArea.DataType.ToString()
+            };
+        }
+
+        private static SecurityGroupEntry MapSecurityGroupEntry(cLiamDataAreaBase securityGroup)
+        {
+            var entry = new SecurityGroupEntry
+            {
+                DisplayName = securityGroup.TechnicalName,
+                TechnicalName = securityGroup.UID,
+                TargetType = ((int)securityGroup.Provider.ProviderType).ToString()
+            };
+
+            switch (securityGroup)
+            {
+                case cLiamAdGroup adGroup:
+                    entry.UID = adGroup.dn;
+                    entry.Scope = adGroup.scope;
+                    break;
+                case cLiamAdGroup2 adGroup2:
+                    entry.UID = adGroup2.dn;
+                    entry.Scope = adGroup2.scope;
+                    break;
+                case cLiamExchangeSecurityGroup exchangeGroup:
+                    entry.UID = exchangeGroup.dn;
+                    break;
+            }
+
+            return entry;
+        }
+    }
+}

LiamWorkflowDiagnostics/MainWindow.xaml.cs

@@ -537,39 +537,28 @@ namespace LiamWorkflowDiagnostics
 
             try
             {
-                var maxDepth = _session.Provider.MaxDepth >= 0 ? _session.Provider.MaxDepth : 1;
+                var maxDepth = _session.Provider.MaxDepth;
                 AppendLog($"Lese DataAreas (MaxDepth={maxDepth}) ...");
-                var areas = await _session.Provider.getDataAreasAsync(maxDepth);
+                var result = await LiamWorkflowRuntime.GetDataAreasFromProviderAsync(
-                if (areas == null)
+                    _session.Provider,
-                {
+                    !string.IsNullOrWhiteSpace(_session.ProviderConfigObjectId)
-                    var providerMessage = _session.Provider.GetLastErrorMessage();
+                        ? _session.ProviderConfigObjectId
-                    if (_session.Provider is cLiamProviderExchange exchangeProvider)
+                        : (_session.ProviderConfigId ?? string.Empty));
-                    {
+                ResultTextBox.Text = JsonConvert.SerializeObject(result, Formatting.Indented);
-                        var code = exchangeProvider.GetLastErrorCode();
-                        if (string.IsNullOrWhiteSpace(code))
-                            code = "EXCH_GET_DATAAREAS_FAILED";
-                        AppendLog($"DataAreas-Call fehlgeschlagen [{code}]: {providerMessage}", LogLevels.Error);
-                    }
-                    else
-                    {
-                        AppendLog($"DataAreas-Call fehlgeschlagen: {providerMessage}", LogLevels.Error);
-                    }
 
-                    ResultTextBox.Text = "[]";
+                if (!result.Success)
+                {
+                    AppendLog($"DataAreas-Call fehlgeschlagen [{result.ErrorCode}]: {result.ErrorMessage}", LogLevels.Error);
                     return;
                 }
 
-                if (areas.Count == 0)
+                if (result.DataAreas.Count == 0)
                 {
                     AppendLog("Keine DataAreas gefunden.", LogLevels.Warning);
-                    ResultTextBox.Text = "[]";
                     return;
                 }
 
-                var entries = ConvertDataAreas(areas);
+                AppendLog($"DataAreas erhalten: {result.DataAreas.Count}");
-                var json = JsonConvert.SerializeObject(entries, Formatting.Indented);
-                ResultTextBox.Text = json;
-                AppendLog($"DataAreas erhalten: {entries.Count}");
             }
             catch (Exception ex)
             {
@@ -595,16 +584,20 @@ namespace LiamWorkflowDiagnostics
                 if (ownerSids.Count == 0)
                     throw new InvalidOperationException("Owner SIDs: mindestens ein Eintrag ist fuer die Ordneranlage erforderlich.");
 
-                var result = EnsureSuccessfulResultToken(await provider.CreateDataAreaAsync(
+                var result = await LiamWorkflowRuntime.CreateDataAreaAsync(
+                    provider,
                     folderPath,
                     parentPath,
-                    ParseKeyValueLines(CustomTagsTextBox.Text, "Custom Tags"),
+                    null,
                     ownerSids,
                     ParseIdentifierList(NtfsCreateReaderSidsTextBox.Text, "Reader SIDs"),
-                    ParseIdentifierList(NtfsCreateWriterSidsTextBox.Text, "Writer SIDs")),
+                    ParseIdentifierList(NtfsCreateWriterSidsTextBox.Text, "Writer SIDs"));
-                    "NTFS Folder Create");
 
-                return MapResultToken(result);
+                return new
+                {
+                    result.Success,
+                    ResultToken = MapResultToken(result.ResultToken)
+                };
             });
         }
 
@@ -614,15 +607,20 @@ namespace LiamWorkflowDiagnostics
             {
                 var provider = EnsureInitializedProvider<cLiamProviderNtfs>("NTFS");
                 var folderPath = GetRequiredText(NtfsEnsureFolderPathTextBox.Text, "Folder Path");
-                var result = await provider.EnsureMissingPermissionGroupsAsync(
+                var result = await LiamWorkflowRuntime.EnsureNtfsPermissionGroupsAsync(
+                    provider,
                     folderPath,
-                    ParseKeyValueLines(CustomTagsTextBox.Text, "Custom Tags"),
+                    null,
                     ParseIdentifierList(NtfsEnsureOwnerSidsTextBox.Text, "Owner SIDs"),
                     ParseIdentifierList(NtfsEnsureReaderSidsTextBox.Text, "Reader SIDs"),
                     ParseIdentifierList(NtfsEnsureWriterSidsTextBox.Text, "Writer SIDs"),
                     NtfsEnsureTraverseCheckBox.IsChecked ?? false);
 
-                return MapResultToken(EnsureSuccessfulResultToken(result, "NTFS Ensure Groups / ACLs"));
+                return new
+                {
+                    result.Success,
+                    ResultToken = MapResultToken(result.ResultToken)
+                };
             });
         }
 
@@ -642,7 +640,8 @@ namespace LiamWorkflowDiagnostics
                 var ownerSids = ParseIdentifierList(AdOwnerSidsTextBox.Text, "Owner SIDs");
                 var memberSids = ParseIdentifierList(AdMemberSidsTextBox.Text, "Member SIDs");
 
-                var result = await Task.Run(() => provider.CreateServiceGroups(
+                var result = await Task.Run(() => LiamWorkflowRuntime.CreateAdServiceGroups(
+                    provider,
                     serviceName,
                     description,
                     scope,
@@ -650,7 +649,7 @@ namespace LiamWorkflowDiagnostics
                     ownerSids,
                     memberSids));
 
-                return MapSecurityGroupResults(result);
+                return result;
             });
         }
 
@@ -663,7 +662,8 @@ namespace LiamWorkflowDiagnostics
                 var newTeamName = GetRequiredText(MsTeamsNewNameTextBox.Text, "New Team Name");
                 var visibility = GetSelectedMsTeamsVisibility();
 
-                var result = await provider.cloneTeam(
+                var result = await LiamWorkflowRuntime.CloneTeamAsync(
+                    provider,
                     sourceTeamId,
                     newTeamName,
                     NormalizeOptionalText(MsTeamsDescriptionTextBox.Text),
@@ -672,7 +672,7 @@ namespace LiamWorkflowDiagnostics
                     string.Join(";", ParseIdentifierList(MsTeamsAdditionalMembersTextBox.Text, "Additional Members")),
                     string.Join(";", ParseIdentifierList(MsTeamsAdditionalOwnersTextBox.Text, "Additional Owners")));
 
-                return MapMsGraphResult(result);
+                return result;
             });
         }
 
@@ -685,17 +685,14 @@ namespace LiamWorkflowDiagnostics
                 var alias = GetRequiredText(ExchangeMailboxAliasTextBox.Text, "Alias");
                 var displayName = NormalizeOptionalText(ExchangeMailboxDisplayNameTextBox.Text);
                 var primarySmtp = NormalizeOptionalText(ExchangeMailboxPrimarySmtpTextBox.Text);
-                var result = await Task.Run(() => provider.exchangeManager.CreateSharedMailboxWithOwnershipGroups(
+                var result = await Task.Run(() => LiamWorkflowRuntime.CreateSharedMailbox(
+                    provider,
                     name,
                     alias,
                     displayName,
                     primarySmtp));
 
-                return new
+                return result;
-                {
-                    ObjectGuid = result.Item1,
-                    Groups = MapSecurityGroupResults(result.Item2)
-                };
             });
         }
 
@@ -708,17 +705,14 @@ namespace LiamWorkflowDiagnostics
                 var alias = GetRequiredText(ExchangeDistributionAliasTextBox.Text, "Alias");
                 var displayName = NormalizeOptionalText(ExchangeDistributionDisplayNameTextBox.Text);
                 var primarySmtp = NormalizeOptionalText(ExchangeDistributionPrimarySmtpTextBox.Text);
-                var result = await Task.Run(() => provider.exchangeManager.CreateDistributionGroupWithOwnershipGroups(
+                var result = await Task.Run(() => LiamWorkflowRuntime.CreateDistributionGroup(
+                    provider,
                     name,
                     alias,
                     displayName,
                     primarySmtp));
 
-                return new
+                return result;
-                {
-                    ObjectGuid = result.Item1,
-                    Groups = MapSecurityGroupResults(result.Item2)
-                };
             });
         }
 
@@ -733,37 +727,22 @@ namespace LiamWorkflowDiagnostics
             try
             {
                 AppendLog($"Lese SecurityGroups (Filter='{_session.Provider.GroupFilter}') ...");
-                var groups = await _session.Provider.getSecurityGroupsAsync(_session.Provider.GroupFilter);
+                var result = await LiamWorkflowRuntime.GetSecurityGroupsFromProviderAsync(_session.Provider);
-                if (groups == null)
+                ResultTextBox.Text = JsonConvert.SerializeObject(result, Formatting.Indented);
-                {
-                    var providerMessage = _session.Provider.GetLastErrorMessage();
-                    if (_session.Provider is cLiamProviderExchange exchangeProvider)
-                    {
-                        var code = exchangeProvider.GetLastErrorCode();
-                        if (string.IsNullOrWhiteSpace(code))
-                            code = "EXCH_GET_SECURITYGROUPS_FAILED";
-                        AppendLog($"SecurityGroups-Call fehlgeschlagen [{code}]: {providerMessage}", LogLevels.Error);
-                    }
-                    else
-                    {
-                        AppendLog($"SecurityGroups-Call fehlgeschlagen: {providerMessage}", LogLevels.Error);
-                    }
 
-                    ResultTextBox.Text = "[]";
+                if (!result.Success)
+                {
+                    AppendLog($"SecurityGroups-Call fehlgeschlagen [{result.ErrorCode}]: {result.ErrorMessage}", LogLevels.Error);
                     return;
                 }
 
-                if (groups.Count == 0)
+                if (result.SecurityGroups.Count == 0)
                 {
                     AppendLog("Keine SecurityGroups gefunden.", LogLevels.Warning);
-                    ResultTextBox.Text = "[]";
                     return;
                 }
 
-                var entries = ConvertSecurityGroups(groups);
+                AppendLog($"SecurityGroups erhalten: {result.SecurityGroups.Count}");
-                var json = JsonConvert.SerializeObject(entries, Formatting.Indented);
-                ResultTextBox.Text = json;
-                AppendLog($"SecurityGroups erhalten: {entries.Count}");
             }
             catch (Exception ex)
             {
@@ -810,6 +789,9 @@ namespace LiamWorkflowDiagnostics
                 AppendLog($"{actionName} gestartet.");
                 var result = await action();
                 ResultTextBox.Text = JsonConvert.SerializeObject(result, Formatting.Indented);
+                if (TryGetSuccessFlag(result, out var success) && !success)
+                    AppendLog($"{actionName} mit Fehlerstatus abgeschlossen.", LogLevels.Warning);
+                else
                     AppendLog($"{actionName} erfolgreich abgeschlossen.");
             }
             catch (Exception ex)
@@ -823,6 +805,24 @@ namespace LiamWorkflowDiagnostics
             }
         }
 
+        private bool TryGetSuccessFlag(object instance, out bool success)
+        {
+            success = false;
+            if (instance == null)
+                return false;
+
+            var property = instance.GetType().GetProperty("Success", BindingFlags.Instance | BindingFlags.Public);
+            if (property == null || property.PropertyType != typeof(bool))
+                return false;
+
+            var rawValue = property.GetValue(instance);
+            if (!(rawValue is bool boolValue))
+                return false;
+
+            success = boolValue;
+            return true;
+        }
+
         private TProvider EnsureInitializedProvider<TProvider>(string providerName) where TProvider : cLiamProviderBase
         {
             if (_session?.Provider == null)
@@ -914,51 +914,6 @@ namespace LiamWorkflowDiagnostics
             };
         }
 
-        private ResultToken EnsureSuccessfulResultToken(ResultToken token, string actionName)
-        {
-            if (token == null)
-                throw new InvalidOperationException($"{actionName}: kein Ergebnis vom Provider erhalten.");
-
-            if (token.resultErrorId != 0)
-            {
-                var message = string.IsNullOrWhiteSpace(token.resultMessage)
-                    ? "Unbekannter Fehler im Provider."
-                    : token.resultMessage.Trim();
-                throw new InvalidOperationException($"[{token.resultErrorId}] {message}");
-            }
-
-            return token;
-        }
-
-        private List<object> MapSecurityGroupResults(IEnumerable<Tuple<string, string, string, string>> groups)
-        {
-            return (groups ?? Enumerable.Empty<Tuple<string, string, string, string>>())
-                .Select(i => (object)new
-                {
-                    Role = i.Item1 ?? string.Empty,
-                    Sid = i.Item2 ?? string.Empty,
-                    Name = i.Item3 ?? string.Empty,
-                    DistinguishedName = i.Item4 ?? string.Empty
-                })
-                .ToList();
-        }
-
-        private object MapMsGraphResult(object result)
-        {
-            if (result == null)
-                return null;
-
-            var resultType = result.GetType();
-            return new
-            {
-                Id = ReadPropertyValue<string>(result, resultType, "ID"),
-                DisplayName = ReadPropertyValue<string>(result, resultType, "DisplayName"),
-                ODataId = ReadPropertyValue<string>(result, resultType, "ODataId"),
-                Context = ReadPropertyValue<string>(result, resultType, "Context"),
-                Result = ReadPropertyValue<object>(result, resultType, "Result")
-            };
-        }
-
         private int GetSelectedMsTeamsVisibility()
         {
             var selectedValue = MsTeamsVisibilityComboBox.SelectedValue;
@@ -978,22 +933,6 @@ namespace LiamWorkflowDiagnostics
                 || value == MsTeamsVisibilityHiddenMembership;
         }
 
-        private T ReadPropertyValue<T>(object instance, Type instanceType, string propertyName)
-        {
-            var property = instanceType.GetProperty(propertyName, BindingFlags.Instance | BindingFlags.Public);
-            if (property == null)
-                return default(T);
-
-            var value = property.GetValue(instance);
-            if (value == null)
-                return default(T);
-
-            if (value is T typedValue)
-                return typedValue;
-
-            return default(T);
-        }
-
         private cLiamProviderData ParseProviderDataFromInput(string input)
         {
             if (string.IsNullOrWhiteSpace(input))
@@ -1236,100 +1175,6 @@ namespace LiamWorkflowDiagnostics
             }
         }
 
-        private List<DataAreaEntry> ConvertDataAreas(IEnumerable<cLiamDataAreaBase> dataAreas)
-        {
-            var result = new List<DataAreaEntry>();
-            foreach (var dataArea in dataAreas ?? Enumerable.Empty<cLiamDataAreaBase>())
-            {
-                var ntfsPermissionArea = dataArea as cLiamNtfsPermissionDataAreaBase;
-                var ntfsFolder = dataArea as cLiamNtfsFolder;
-                var adGroup = dataArea as cLiamAdGroupAsDataArea;
-                var exchMailbox = dataArea as cLiamExchangeSharedMailbox;
-                var exchDistribution = dataArea as cLiamExchangeDistributionGroup;
-
-                var owner = exchMailbox?.OwnerGroupIdentifier
-                            ?? exchDistribution?.OwnerGroupIdentifier
-                            ?? adGroup?.ManagedBySID
-                            ?? ntfsPermissionArea?.OwnerGroupIdentifier
-                            ?? string.Empty;
-
-                var write = exchMailbox != null
-                    ? exchMailbox.FullAccessGroupSid
-                    : exchDistribution != null
-                        ? exchDistribution.MemberGroupSid
-                        : adGroup?.UID
-                          ?? ntfsPermissionArea?.WriteGroupIdentifier
-                          ?? string.Empty;
-
-                var read = exchMailbox != null
-                    ? exchMailbox.SendAsGroupSid
-                    : ntfsPermissionArea?.ReadGroupIdentifier
-                      ?? string.Empty;
-
-                var traverse = ntfsPermissionArea?.TraverseGroupIdentifier ?? string.Empty;
-                var created = ntfsFolder?.CreatedDate ?? string.Empty;
-                var description = adGroup?.Description ?? string.Empty;
-
-                result.Add(new DataAreaEntry
-                {
-                    DisplayName = dataArea.DisplayName ?? string.Empty,
-                    UID = dataArea.UID ?? string.Empty,
-                    TechnicalName = dataArea.TechnicalName ?? string.Empty,
-                    Description = description,
-                    TargetType = ((int)dataArea.Provider.ProviderType).ToString(),
-                    ParentUID = dataArea.ParentUID ?? string.Empty,
-                    Level = dataArea.Level.ToString(),
-                    Owner = owner,
-                    Write = write,
-                    Read = read,
-                    Traverse = traverse,
-                    CreatedDate = created,
-                    ConfigurationId = !string.IsNullOrWhiteSpace(_session?.ProviderConfigObjectId)
-                        ? _session.ProviderConfigObjectId
-                        : (!string.IsNullOrWhiteSpace(_session?.ProviderConfigId) ? _session.ProviderConfigId : string.Empty),
-                    BaseFolder = ntfsFolder?.Share?.TechnicalName ?? dataArea.Provider?.RootPath ?? string.Empty,
-                    UniqueId = dataArea.UID ?? string.Empty,
-                    DataAreaType = ((int)dataArea.DataType).ToString()
-                });
-            }
-            return result;
-        }
-
-        private List<SecurityGroupEntry> ConvertSecurityGroups(IEnumerable<cLiamDataAreaBase> groups)
-        {
-            var result = new List<SecurityGroupEntry>();
-            foreach (var sg in groups ?? Enumerable.Empty<cLiamDataAreaBase>())
-            {
-                var entry = new SecurityGroupEntry
-                {
-                    DisplayName = sg.TechnicalName ?? sg.DisplayName ?? string.Empty,
-                    TechnicalName = sg.UID ?? string.Empty,
-                    TargetType = ((int)sg.Provider.ProviderType).ToString()
-                };
-
-                switch (sg)
-                {
-                    case cLiamAdGroup adGroup:
-                        entry.UID = adGroup.dn;
-                        entry.Scope = adGroup.scope;
-                        break;
-                    case cLiamAdGroup2 adGroup2:
-                        entry.UID = adGroup2.dn;
-                        entry.Scope = adGroup2.scope;
-                        break;
-                    case cLiamExchangeSecurityGroup exchangeGroup:
-                        entry.UID = exchangeGroup.dn;
-                        break;
-                    default:
-                        entry.UID = sg.UID;
-                        break;
-                }
-
-                result.Add(entry);
-            }
-            return result;
-        }
-
         private void PopulateFields(cLiamProviderData data)
         {
             if (data == null)