Conversation
…lt-envelope fix(scheduler): poorly formatted post-execution results Synced from CyberDrain/CIPP@f23303d
feat(standards): add external compliance trust standard Synced from CyberDrain/CIPP@2580cf8
…e-target feat(halo): add psaTicketId field to wizards/api Synced from CyberDrain/CIPP@cc1a16e
Closes a tenant-authorization gap where a scheduled task could carry a tenant-identifying parameter pointing to a different tenant than the authorized one. - Strip tenant params (TenantFilter/Tenant/TenantId) from stored Parameters at creation time in Add-CIPPScheduledTask, logging an Error when the value mismatches the picked tenant - Force-override any remaining tenant params to the authorized task tenant at execution time in Push-ExecScheduledCommand - Expand orchestrator to inject the primary tenant param alongside TenantFilter - Rename -Tenant to -TenantFilter (with Alias) in Set-CIPPAuthenticationPolicy and Set-CIPPRegistrationCampaign so the scheduler recognizes them as protected scope - Hide Tenant/TenantId from the function-parameters UI so they are never user-editable - Add Pester regression tests for both creation-time and execution-time defenses Synced from CyberDrain/CIPP@1b5523c
A tenant group request ({type:'Group', value:<guid>}) previously resolved to a null $Tenant and fell through to an unconditional allow, letting restricted roles target groups they were never granted.
Fix authorizes group requests by matching the requested group GUID against the role's explicitly granted group entries. If not matched, the request is hard-denied. Member expansion is never performed for the access decision.
Adds regression tests covering allow, deny, and no-member-expansion cases.
Synced from CyberDrain/CIPP@6b66ff7
Updated the API request for fetching permission grant policies to remove the $expand parameter, as it is auto-expanded on GET requests. This change ensures compatibility with the Microsoft Graph API. Synced from CyberDrain/CIPP@4c04d78
Add `id` to the `$select` parameter when expanding `includedGroups` on MDM policies, ensuring group IDs are returned alongside display names. fixes #357 Synced from CyberDrain/CIPP@1f02924
Include `openid profile offline_access` alongside the MCP `user_impersonation` scope in the protected-resource metadata and EasyAuth default scopes. This ensures discovery-based MCP clients request refresh tokens and avoids repeated hourly re-consent, while reusing shared scope variables for both CIPPNG and non-CIPPNG app setting updates. Synced from CyberDrain/CIPP@6b2cd0e
Regenerate backend/Config/PermissionsTranslator.json from AzAdvertizer's published Entra ID API permissions dataset (669 -> 2656 unique entries). This adds 1988 permission GUIDs that were missing, including Exchange.ManageV2 - a missing GUID is silently dropped during delegated/application grants (Add-CIPPDelegatedPermission translates required GUIDs to scope values by id), so those permissions never applied when pushing multi-tenant apps even though a manual consent resolved them. Add build/tools/Update-PermissionsTranslator.ps1: fetches the source, validates count + well-known anchor GUIDs, reshapes both delegated and application permissions, merges to preserve current-only GUIDs (e.g. Partner Center user_impersonation), dedupes to one row per GUID, and writes LF for cross-platform-stable output. Add .github/workflows/update-permissions-translator.yml: weekly + manual refresh that revalidates and opens a PR against dev when the file changes, mirroring the license SKU automation. No credentials needed - the source is unauthenticated. Synced from CyberDrain/CIPP@5c6632e
Computed CSV columns for members and owners were always included in the Select-Object call even when the corresponding expand was not requested, causing permanently blank columns in the UI and exports. Refactored to build the property list dynamically and only add membersCsv/ownersCsv when the relevant expand flag is set. Synced from CyberDrain/CIPP@158b07e
Add a "Reactivate Archived OneDrive" row action on the OneDrive page and a
new Invoke-ExecReactivateSite endpoint that unarchives a site via the Graph
beta site:unarchive endpoint (POST /beta/sites/{id}/unarchive, app-only with
Sites.FullControl.All). The composite site id is built from the row's host,
siteId and webId so no lookup is made against the locked, archived site.
The confirmation warns that reactivation is asynchronous (up to 24 hours) and
may incur Microsoft 365 Archive charges and require Unlicensed OneDrive
billing to be enabled on the tenant. Errors that look like a Locked/blocked
or billing failure surface a hint to reactivate from the SharePoint admin
center.
Refs #419
Synced from CyberDrain/CIPP@b43805b
Synced from CyberDrain/CIPP@defd932
Replace the combined EXO bulk call with two targeted `New-ExoRequest` calls and project only the fields stored in cache. This reduces payload size and keeps the merge logic the same by matching `Get-MailContact` to `Get-Contact` results via directory ID or identity. Synced from CyberDrain/CIPP@cac5767
Update MDO alerts listing to include both Microsoft Defender for Office 365 and Microsoft Defender for Endpoint by broadening the Graph `serviceSource` filter in live and all-tenant cache paths. Rename the UI/docs navigation from “MDO Alerts” to “Defender Alerts”, add `serviceSource` to visible table columns, and refresh the endpoint/openapi description to match the new scope. Synced from CyberDrain/CIPP@e434ffe
When Delete user is selected, tasks incompatible with user deletion (e.g. convert to shared mailbox, revoke sessions) are now skipped on both the backend and cleared in the frontend form. Adds Pester and Vitest tests covering the new guard logic. Synced from CyberDrain/CIPP@5d600f1
feat: Graph message trace, historical search, and mail flow statistics Synced from CyberDrain/CIPP@192ddbe
… libraries on the classic sites table Adds recycle-bin folder navigation/restore and storage cleanup fields in the site browser, and exposes top-level libraries as a nested column on the traditional SharePoint Sites table via ListSiteBrowser. Synced from CyberDrain/CIPP@d585631
Feat: Enforce per-user MFA option when creating new users Synced from CyberDrain/CIPP@608fbe2
Synced from CyberDrain/CIPP@655d454
…in Report button in Outlook Synced from CyberDrain/CIPP@53d8558
Filter out Microsoft-published rule packages when caching EXO DLP sensitive info types. The built-in catalog is large, identical across all tenants, and never read from this cache — only custom/tenant-authored packages are relevant. Synced from CyberDrain/CIPP@ee584cd
feat: MCP authentication changes allowing for refresh token and copilot compatibility Synced from CyberDrain/CIPP@727684e
feat(hudu): sync LAPS and BitLocker credentials Synced from CyberDrain/CIPP@cdd33c3
Synced from CyberDrain/CIPP@b3563a1
Synced from CyberDrain/CIPP@77713b9
…60921 chore(openapi): regenerate API spec (2026-09-21) Synced from CyberDrain/CIPP@f684f0e
…update-20260921 chore(permissions): update Entra API permission translator (2026-09-21) Synced from CyberDrain/CIPP@6dd35c9
feat(security simulations): Adds simulator and CA Gap analyser. Synced from CyberDrain/CIPP@d8f452d
Synced from CyberDrain/CIPP@4741ded
Add an "API" filter beside the severity filter in the Logbook Filters panel, each now half-width and side by side. It is a creatable multi-select whose selected values are joined with "|" and passed as the API query param, which Invoke-ListLogs already applies server-side as a regex match on the API column. Wired into the filter summary chip, query key, clear action and help text. Synced from CyberDrain/CIPP@49ad151
The Device Preparation profile's device security group is enrolled through the setEnrollmentTimeDeviceMembershipTarget action, not the enrollment_autopilot_dpp_devicesecuritygroupids settings string, which every create writes regardless of whether a group was ever applied. Adds Get/Set/Remove helpers for the membership target, backed by a CIPP-managed marker for tenants where the retrieve action doesn't route. The baseline and standard now read the applied group live, grade it as a separate dimension from settings, and repair it in place (assign/set) instead of forcing a delete-and-recreate. Also teaches Compare-CIPPIntuneAssignments and Get-CIPPIntuneAssignmentTarget to treat allLicensedUsersAssignmentTarget as equivalent to the All Users group target so a working assignment isn't flagged as drifted. Synced from CyberDrain/CIPP@6035578
Synced from CyberDrain/CIPP@47d79bf
These Exchange template endpoints were serializing the same Name/Comments fields twice when building the stored JSON payload. This change excludes the original properties after aliasing them, preserving the intended template metadata without duplicate keys. Synced from CyberDrain/CIPP@f8da32c
Add explicit validation for several query parameters across Graph, reports, and SharePoint endpoints so unsupported values return 400s instead of falling through to defaults. Regenerate the OpenAPI spec to document the accepted values and descriptions, improving MCP/tool discovery and request contracts. Synced from CyberDrain/CIPP@416a3a2
…nt-names Feat: Show Group Assignment Friendly Name on Windows Autopilot Profile Synced from CyberDrain/CIPP@a8392c5
Document and align ExecAccessChecks tenant behavior with the UI. Tenant access checks now treat single-tenant reads as cached by default, only force a refresh when SkipCache is set, and the Check Tenant action sends that flag so the requested tenant is rechecked explicitly. Synced from CyberDrain/CIPP@c268d3a
Feat: Include PIM-eligible members in Magic Dash roles table Synced from CyberDrain/CIPP@2f5bfc2
…butes Fix: user templates to retain custom attributes Synced from CyberDrain/CIPP@bcc5b10
Synced from CyberDrain/CIPP@190d76f
Entra sign-in records can reuse the same Id weeks apart, so claiming by Id alone let a stale claim swallow later events. Claims and stored rows now carry an EventCreationTime derived from the record's creation timestamp; a key conflict is only overridden when the new event is strictly newer or the existing claim is older than the 7-day reconciliation window. Also collapses duplicate keys within a single batch write (keeping the newest stamp) in both the webhook processing flush and the audit log rule flush, preventing regressions from same-Id records landing in the same pass. Synced from CyberDrain/CIPP@09cce10
Add a shared helper that caches Defender TVM software-vulnerability export SAS URLs per tenant, reducing calls to the heavily rate-limited export endpoint. Update the raw TVM reader to consume the export files directly, streaming and decompressing multiline JSON records instead of paging the older API so large tenant datasets use far less memory. Synced from CyberDrain/CIPP@16e1e4f
Replace MCP resource user_impersonation consent grants with resource pre-authorization so client setup works reliably even when user consent is disabled. Also split managed and custom redirect URIs into public vs web buckets across the API and UI, add the localhost callback, and cover the new auth flow with tests and OpenAPI updates. Synced from CyberDrain/CIPP@4ed7372
…ing or scenario lists A tenant that fails the licence gate returned situations and excluded as a single null, which crashed the situations page reading .group. The endpoint now filters nulls and every simulator page drops null entries before rendering. Synced from CyberDrain/CIPP@0e90a6c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )