Conversation
Right-click opens a context menu with declaration-ordered pinned actions (View/Edit, Entra/Intune), More Info, and the rest scrollable; also add View in Entra for users. Synced from CyberDrain/CIPP@99b9c19
Adds a condition to hide the 'Add Member' action for groups that use dynamic membership rules or are synced from on-premises AD, as manual member additions are rejected for these group types. Synced from CyberDrain/CIPP@460b7a9
When the backend signals a missing SecurityAnalyzedMessage.Read.All permission via Metadata.PermissionError, display a targeted caption linking to the Permission Check page instead of the generic Defender-licence messages. Adds corresponding tests to verify caption precedence. Synced from CyberDrain/CIPP@aa9d414
Add a `docsPath` field to nav items whose docs location doesn't mirror the app's nav hierarchy. `getHelpLinks` now resolves the correct docs URL using these overrides, falling back to the pathname-derived URL. Adds tests covering both the fallback and override behaviour. Synced from CyberDrain/CIPP@af93771
…ist and header layout - Changed Typography component in PropertyListItem to use 'div' as the component type for better semantic structure. - Updated HeaderedTabbedLayout to use 'div' for Typography and modified prop types for subtitle text to accept nodes instead of just strings, allowing for more flexible content rendering. Synced from CyberDrain/CIPP@bf87720
Serve CippDataTable cards on ListSiteBrowser below md so phones stay usable, while keeping the desktop explorer intact. Use a separate query key so pagination cache does not collide with the desktop ApiGetCall. Synced from CyberDrain/CIPP@13ee805
A centred md dialog wastes the viewport on phones; always use fullScreen there and keep Expand for desktop. Synced from CyberDrain/CIPP@1c0ab1c
Replace multiple OS-filtered wipe and fresh start actions with consolidated single actions using radio field forms. Switch from `condition` to `hideCondition` for OS-based filtering. Add unit tests covering the new action structure. Synced from CyberDrain/CIPP@3f6ecf1
…t safe areas Use 100dvh on LayoutRoot, add viewport-fit=cover, and offset fixed chrome for notches and PWA status bar without double-counting banner height. Synced from CyberDrain/CIPP@f936213
Synced from CyberDrain/CIPP@23dd956
Number inputs were storing string values in react-hook-form state. Add setValueAs coercion so empty/null yields null and valid input yields a real Number. Update dependent code (CA policy builder, standards accordion, retention tag, registration campaign, date range filter) to handle null correctly. Add tests for the number field behavior. Synced from CyberDrain/CIPP@5aaa651
Add a "Reactivate Archived OneDrive" row action on the OneDrive page and a
new Invoke-ExecReactivateSite endpoint that unarchives a site via the Graph
beta site:unarchive endpoint (POST /beta/sites/{id}/unarchive, app-only with
Sites.FullControl.All). The composite site id is built from the row's host,
siteId and webId so no lookup is made against the locked, archived site.
The confirmation warns that reactivation is asynchronous (up to 24 hours) and
may incur Microsoft 365 Archive charges and require Unlicensed OneDrive
billing to be enabled on the tenant. Errors that look like a Locked/blocked
or billing failure surface a hint to reactivate from the SharePoint admin
center.
Refs #419
Synced from CyberDrain/CIPP@b43805b
Update MDO alerts listing to include both Microsoft Defender for Office 365 and Microsoft Defender for Endpoint by broadening the Graph `serviceSource` filter in live and all-tenant cache paths. Rename the UI/docs navigation from “MDO Alerts” to “Defender Alerts”, add `serviceSource` to visible table columns, and refresh the endpoint/openapi description to match the new scope. Synced from CyberDrain/CIPP@e434ffe
When Delete user is selected, tasks incompatible with user deletion (e.g. convert to shared mailbox, revoke sessions) are now skipped on both the backend and cleared in the frontend form. Adds Pester and Vitest tests covering the new guard logic. Synced from CyberDrain/CIPP@5d600f1
feat: Graph message trace, historical search, and mail flow statistics Synced from CyberDrain/CIPP@192ddbe
… libraries on the classic sites table Adds recycle-bin folder navigation/restore and storage cleanup fields in the site browser, and exposes top-level libraries as a nested column on the traditional SharePoint Sites table via ListSiteBrowser. Synced from CyberDrain/CIPP@d585631
Feat: Enforce per-user MFA option when creating new users Synced from CyberDrain/CIPP@608fbe2
Synced from CyberDrain/CIPP@655d454
…in Report button in Outlook Synced from CyberDrain/CIPP@53d8558
…ing or scenario lists A tenant that fails the licence gate returned situations and excluded as a single null, which crashed the situations page reading .group. The endpoint now filters nulls and every simulator page drops null entries before rendering. Synced from CyberDrain/CIPP@0e90a6c
Replace full in-memory Intune and Defender TVM export processing with streaming aggregation so cache jobs and vulnerability endpoints handle large report datasets without excessive allocations. Add Pester coverage for the new export reader and the updated alert/cache/endpoint behavior, and stop persisting large log query caches to localStorage to avoid quota overruns and tab OOMs. Synced from CyberDrain/CIPP@99edfed
Fix: Hide inapplicable actions for roles and mailbox rules Synced from CyberDrain/CIPP@8ae07ff
Feat: Link Alerts and Tenant card headers to their management pages Synced from CyberDrain/CIPP@ad262c4
…brary sync Adds a Clone Template action to the Conditional Access template list and hides Edit Template on synced templates, matching the Intune template list. ExecCloneTemplate now also resets the GUID column (CA templates are looked up by it, so a clone previously resolved to its original) and clears Source, since community sync matches existing templates on displayName + Source and could otherwise overwrite the clone. Synced from CyberDrain/CIPP@790d863
feat(templates): sync GitHub push state for standards/baselines Synced from CyberDrain/CIPP@791350d
feat(bec): BEC case workflow with attacker IP analysis, blast radius and background containment Synced from CyberDrain/CIPP@fd9b7ea
feat(custom-tests): drive the cache explorer from the live _shape end… Synced from CyberDrain/CIPP@f4136b5
…dministration The BEC hub and case workspace now live at /identity/administration/bec and /identity/administration/bec/case, listed at the bottom of the Administration menu. Row actions, the user Compromise Remediation tab, the audit-log action URL rewrite, alert emails, the Hudu/NinjaOne sync links and the bulk-check queue link point at the new routes. The previous /identity/bec routes, the retired reports page and the old per-user bec tab redirect there, query kept. The docs move to match (identity/administration/bec/README.md and case.md), so the help link resolves from the page path and the nav docsPath override goes. Synced from CyberDrain/CIPP@a2d1833
…o date - Add a page for Settings > BEC Remediation Defaults: where the defaults apply (containment drawer, NewRiskyUsers auto-containment, ExecBECRemediate without actions), that the audit-log alert action is not affected, and the built-in six. Add its card to the General settings page docs and SUMMARY. - Rewrite the BEC hub page docs for Start investigation, the All runs / By user views, their columns and the renamed actions. - Case page: containment preselection follows the configurable defaults, add the phishing-sender and sharing-link actions, correct the legacy protocol default (SMTP AUTH is on), fix the bulk action name, the intro that said opening the page starts a run, and the self-anchors broken by the rename. - NewRiskyUsers alert description listed OneDrive sharing as a default action; the built-in set blocks legacy protocols, and it is configurable. Synced from CyberDrain/CIPP@e480e93
…folders - Added support for creating channels and folders in Teams sites during template deployment. - Updated the deployment logic to handle new parameters for channels and folders. - Introduced new functions for creating channels and folders in SharePoint. - Enhanced the frontend to accommodate channel and folder configurations in site templates. - Updated JSON schema to include definitions for channels and folders, ensuring proper validation. Synced from CyberDrain/CIPP@47de5ae
Synced from CyberDrain/CIPP@17b9af0
…tibility - Updated the Start-Cipp-Dev-Windows-docker.ps1 script to check for Node.js installation on PATH or via nvm-windows. - Added logic to verify the required Node.js version specified in frontend/package.json and provide appropriate feedback. - Improved error handling during yarn installation and development server startup, ensuring clearer messaging for users. Synced from CyberDrain/CIPP@b91f876
…dit schema The Audit.AzureActiveDirectory property list offered 'Errorvalue', which is not a field on Azure AD STS logon records. Per the Management Activity API schema the AADSTS error code of a failed login is 'ErrorCode' (LogonError holds the readable reason), so rules built from the picker could never match on the code. Synced from CyberDrain/CIPP@97c30c4
…nditions Audit records for failed Azure AD sign-ins carry the AADSTS code as ErrorNumber and its name as LogonError; there is no ErrorCode property, despite the Management Activity API schema reference using that name, so the previous schema entry could never match. Confirmed against UserLoginFailed records from a live tenant (e.g. ErrorNumber 50074 / LogonError UserStrongAuthClientAuthNRequiredInterrupt). Both properties now use pickers built from Microsoft's published AADSTS error code reference (350 codes, 223 names), and the alert docs explain which property to use with a Conditional Access block example. Synced from CyberDrain/CIPP@b46a693
… header The Recommended containment text hard-coded four actions, while the containment drawer pre-selects from the instance-wide BEC Remediation Defaults. Read the same ListBECRemediationActions catalog the drawer uses and list its default-selected actions. Synced from CyberDrain/CIPP@70d853d
Excluded tenant groups were not being expanded to their member domains when computing assigned/excluded tenant states, allowing group members to remain incorrectly included. The raw group id is still preserved in the exclusions list for display purposes. Also enable group selection in the excluded tenants picker on the baseline template page. Synced from CyberDrain/CIPP@6c60325
MUI Accordion keeps collapsed content mounted, so an AllTenants task mounted one CippDataTable per tenant result. unmountOnExit on the result accordions already fixes that; the extra isExpanded guard duplicated it and removed the content before the collapse transition ran. Adds a vitest pinning that collapsed tenants mount no table and collapsing unmounts the expanded one. Synced from CyberDrain/CIPP@cb22a06
Add support for form submissions that trigger follow-up API requests and return their results in the same response flow. Update JIT admin and template forms to respect tenant scope, clear tenant-bound selections when the tenant changes, and let audit alert exclusions be scheduled independently from CA policy vacation mode. Includes tests for follow-up mutations, form wiring, and tenant-scoped JIT behavior. Synced from CyberDrain/CIPP@4fbcd94
Synced from CyberDrain/CIPP@214edff
The v2 dashboard is the only dashboard now. Drop the dashboardv1 page, its 'Previous Dashboard Experience' tab, and CippUniversalSearch, which only that page used. Synced from CyberDrain/CIPP@f6839a4
Updates the Augmentt sponsor link to include UTM tracking parameters for campaign attribution. Synced from CyberDrain/CIPP@cb1ed47
The actions selector imported AuditLogTemplates instead of the shared alertActions.json, so it offered log templates instead of actions. Synced from CyberDrain/CIPP@4948c01
…cker verdicts A Microsoft 365 front end in the user's non-interactive sign-ins, or the user's own rotating IPv6 address, could score LikelyAttacker on network heuristics alone (hosting + foreign + new to user). That one verdict then counted again through shared-session lifts, mail attribution, blast radius and the score, turning ordinary activity into a high-confidence case. - Canonicalise addresses (port, brackets, case, zero compression, IPv4-mapped) so one host correlates as one; -Network gives the IPv6 /64. - Class addresses in Microsoft 365's published ranges (endpoints.office.com, cached a day in CacheM365IPRanges) as Service even when signed in from. Rented Azure compute stays outside those ranges and is still judged. - Judge IPv6 by its /64 for the baseline and for colleague lookups, since devices rotate privacy addresses and each LAN device has its own. - Colleague lookups read non-interactive sign-ins before the window separately; the single newest-first page hid them on busy addresses and turned an office exit into a "wider attack". - Never lift an address the user used before the window through a shared session (a dual-stack device carries one session on both families). - Attribute a mailbox record to its own address first; sessions no longer override where the request came from. - Count the attacker-derived score signals (mail, files, forms, delegated mailboxes, other accounts reached) only when an attacker address is backed by an attacker action, a medium/high sign-in risk or a confirmed verdict. Synced from CyberDrain/CIPP@7b93203
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )