[pull] dev from KelvinTegelaar:dev - #140

feat: list Teams channel sites alongside SharePoint sites

Synced from CyberDrain/CIPP@8e00372

feat: MCP authentication changes allowing for refresh token and copilot compatibility

Synced from CyberDrain/CIPP@727684e

feat(hudu): sync LAPS and BitLocker credentials

Synced from CyberDrain/CIPP@cdd33c3

Synced from CyberDrain/CIPP@05b44d8

Synced from CyberDrain/CIPP@b03a530

Synced from CyberDrain/CIPP@7f9a97a

Synced from CyberDrain/CIPP@b3563a1

Synced from CyberDrain/CIPP@77713b9

…60921

chore(openapi): regenerate API spec (2026-09-21)

Synced from CyberDrain/CIPP@f684f0e

…update-20260921

chore(permissions): update Entra API permission translator (2026-09-21)

Synced from CyberDrain/CIPP@6dd35c9

feat(security simulations): Adds simulator and CA Gap analyser.

Synced from CyberDrain/CIPP@d8f452d

Synced from CyberDrain/CIPP@4741ded

Add an "API" filter beside the severity filter in the Logbook Filters panel,
each now half-width and side by side. It is a creatable multi-select whose
selected values are joined with "|" and passed as the API query param, which
Invoke-ListLogs already applies server-side as a regex match on the API column.
Wired into the filter summary chip, query key, clear action and help text.

Synced from CyberDrain/CIPP@49ad151

The Device Preparation profile's device security group is enrolled through the setEnrollmentTimeDeviceMembershipTarget action, not the enrollment_autopilot_dpp_devicesecuritygroupids settings string, which every create writes regardless of whether a group was ever applied.

Adds Get/Set/Remove helpers for the membership target, backed by a CIPP-managed marker for tenants where the retrieve action doesn't route. The baseline and standard now read the applied group live, grade it as a separate dimension from settings, and repair it in place (assign/set) instead of forcing a delete-and-recreate. Also teaches Compare-CIPPIntuneAssignments and Get-CIPPIntuneAssignmentTarget to treat allLicensedUsersAssignmentTarget as equivalent to the All Users group target so a working assignment isn't flagged as drifted.

Synced from CyberDrain/CIPP@6035578

Synced from CyberDrain/CIPP@47d79bf

These Exchange template endpoints were serializing the same Name/Comments fields twice when building the stored JSON payload. This change excludes the original properties after aliasing them, preserving the intended template metadata without duplicate keys.

Synced from CyberDrain/CIPP@f8da32c

Add explicit validation for several query parameters across Graph, reports, and SharePoint endpoints so unsupported values return 400s instead of falling through to defaults. Regenerate the OpenAPI spec to document the accepted values and descriptions, improving MCP/tool discovery and request contracts.

Synced from CyberDrain/CIPP@416a3a2

Synced from CyberDrain/CIPP@5562081

…nt-names

Feat: Show Group Assignment Friendly Name on Windows Autopilot Profile

Synced from CyberDrain/CIPP@a8392c5

Document and align ExecAccessChecks tenant behavior with the UI. Tenant access checks now treat single-tenant reads as cached by default, only force a refresh when SkipCache is set, and the Check Tenant action sends that flag so the requested tenant is rechecked explicitly.

Synced from CyberDrain/CIPP@c268d3a

Feat: Include PIM-eligible members in Magic Dash roles table

Synced from CyberDrain/CIPP@2f5bfc2

…butes

Fix: user templates to retain custom attributes

Synced from CyberDrain/CIPP@bcc5b10

Synced from CyberDrain/CIPP@9edd202

Synced from CyberDrain/CIPP@190d76f

Entra sign-in records can reuse the same Id weeks apart, so claiming by Id alone let a stale claim swallow later events. Claims and stored rows now carry an EventCreationTime derived from the record's creation timestamp; a key conflict is only overridden when the new event is strictly newer or the existing claim is older than the 7-day reconciliation window. Also collapses duplicate keys within a single batch write (keeping the newest stamp) in both the webhook processing flush and the audit log rule flush, preventing regressions from same-Id records landing in the same pass.

Synced from CyberDrain/CIPP@09cce10

Add a shared helper that caches Defender TVM software-vulnerability export SAS URLs per tenant, reducing calls to the heavily rate-limited export endpoint. Update the raw TVM reader to consume the export files directly, streaming and decompressing multiline JSON records instead of paging the older API so large tenant datasets use far less memory.

Synced from CyberDrain/CIPP@16e1e4f

Replace MCP resource user_impersonation consent grants with resource pre-authorization so client setup works reliably even when user consent is disabled. Also split managed and custom redirect URIs into public vs web buckets across the API and UI, add the localhost callback, and cover the new auth flow with tests and OpenAPI updates.

Synced from CyberDrain/CIPP@4ed7372

- Auto-map falls back to an exact HaloPSA client name match when Halo has no Azure tenant ID for a tenant
- Runs from the extension timer when HaloPSA is enabled, so new tenants map without visiting the page
- Mapping table keeps unsaved local automap rows when the server automap refetch lands

Fixes #804

Synced from CyberDrain/CIPP@3664b63

- Matches a tenant's mapped HaloPSA client to the Hudu company synced from it, falling back to an exact company name
- Runs from the mapping page and the extension timer, after HaloPSA so new Halo mappings chain through
- Registers Hudu sync tasks for newly mapped tenants

Fixes #804

Synced from CyberDrain/CIPP@4087420

- List variable type, entered one value per line, expands into the list it is used in
- CA deploy resolves user, group and named location names under every replace option and names undefined variables
- named location countries and IP ranges can come from list variables
- baseline CA template compare resolves custom variables
- tests pin the existing variable behaviour

Fixes #722

Synced from CyberDrain/CIPP@5bd8596

Synced from CyberDrain/CIPP@6bdabbd

Feat: Add Teams files policy standard

Synced from CyberDrain/CIPP@681b376

…licy

Adds ExternalBotAccessMode to the Teams global meeting policy standard:
require approval for detected external bots and AI note takers, or allow
them like any participant. It defaults to keeping the tenant's current
value, so existing baselines do not start enforcing it.
Closes #774

Synced from CyberDrain/CIPP@30d4791

OneDrive names a new shortcut after the library and prefixes the site
name, so Teams channel shortcuts end up as long strings like
"Team - Channel - Documents". The Add OneDrive Shortcut action now takes
an optional name, and the shortcut is renamed to it right after creation,
because OneDrive ignores the name on create. Names breaking OneDrive's
rules (reserved characters, leading or trailing space, trailing period,
over 255 characters) are rejected. If the rename fails the shortcut is
kept and the result says so. A blank name keeps the default.
Closes #853

Synced from CyberDrain/CIPP@bba5201

Synced from CyberDrain/CIPP@40cb269

Graph's message trace API is not offered for GCC tenants, and its
"not currently supported" error was returned to the user instead of
taking the existing Get-MessageTraceV2 fallback. Treat it like a missing
service principal or consent and fall back, without provisioning.

Synced from CyberDrain/CIPP@5d27fd1

Synced from CyberDrain/CIPP@e4d1f73

Synced from CyberDrain/CIPP@9683d00

…hurn in the tests run

- resolve collectors, prepare hooks and executors with a direct command lookup instead of Get-Command
- skip the collector lookup for definitions without a cache type
- take a remembered capabilities failure without rethrowing it; pin Test-CIPPStandardLicense behaviour in tests
- remember a failed SharePoint root site lookup for two minutes
- avoid exception-driven paths in Get-NormalizedError, Get-CippUserAgent, prepare hooks and ZTNA21992

Synced from CyberDrain/CIPP@8a1ece0

The fleet overview mixed every baseline together. It can now be scoped
to one baseline, and optionally one of its stages: a tenant's standard
counts when that baseline has rolled it out to the tenant (stages up to
its current stage, or just the chosen stage). Standards shared by two
baselines count toward both, which the page notes. Stored trends are
fleet-wide, so the trend chart is hidden while filtered, and a filter
with nothing scorable shows a dash instead of 0%.

The Alignment tab's by-standard view gets the same filters and reads
them from the URL, so the Open Deviations and License Missing tiles
carry the filter there. Those tiles passed onClick, which CippInfoBar
ignores, so they never navigated; they now use link.

ListBaselineAlignment takes optional baselineId and stage parameters
with byStandard; the unfiltered response is unchanged. The tenant
view's per-baseline score now matches exact standard instances through
the same stage helper, so package members count and other baselines'
instances no longer skew it.

Closes #868

Synced from CyberDrain/CIPP@2ddfefb

Synced from CyberDrain/CIPP@9015dcd

…eline

Synced from CyberDrain/CIPP@4749ec9

Feat: Scope JIT admin approval to specific tenants and tenant groups

Synced from CyberDrain/CIPP@1280c64

The push-subscription flow now surfaces browser notification permission denials instead of swallowing them. The preferences page shows a clear status message while waiting for permission and explains how to enable notifications if the browser prompt does not appear.

Synced from CyberDrain/CIPP@6d5e904

Synced from CyberDrain/CIPP@e0b109a

…engine

- small batches cut the referenced entries out of the cached directory; a search's large slices share one full parse
- validate the cached users blob with Test-Json instead of parsing it
- share the expanded rule set across tenants
- map GUIDs without Add-Member or a log line per mapping, and before the placeholders are added
- parse and serialise records with CippJson
- drop the per-worker directory memo and the per-batch rule configuration log

Synced from CyberDrain/CIPP@e45ac9f

…tenant

Synced from CyberDrain/CIPP@e207433

Invoke-ListAuditLogCoverage pulled the entire ledger and filtered by date range and tenant in memory, timing out on large instances. Push the WindowStart range and tenant selector (PartitionKey or TenantId) into the table query instead.

Also add a 30-day cleanup of the coverage ledger in Start-LogRetentionCleanup, since the ledger has no other retention and only needs ~50 hours for the engine to function.

Add tests covering the server-side filter construction and the new cleanup batch behavior.

Synced from CyberDrain/CIPP@8f01e51

Synced from CyberDrain/CIPP@1cfccdb

…otification tests

Synced from CyberDrain/CIPP@80b0bd1

Update yarn.lock for sharp 0.35.5, prosemirror-view 1.42.6, and source-map-js 1.2.2.

Synced from CyberDrain/CIPP@a2cb181

…sting device prep group

The Device Prep baseline only set the Intune Provisioning Client as owner
when it created the device group, so a group made by hand stayed without
it. Ownership is now graded and, on remediation, added to the existing
group in place, without recreating the profile. The profile also has to
use the device preparation template to match, so a same-named policy is
never deleted, and the check and the fix resolve the same group when
several match.
Closes #721

Synced from CyberDrain/CIPP@75806c7

…ng webhook runs

Synced from CyberDrain/CIPP@8a24026

…d template tiers

Synced from CyberDrain/CIPP@57480a6

…error

Synced from CyberDrain/CIPP@7e31968

…permissions

Synced from CyberDrain/CIPP@b44f19c