[pull] dev from KelvinTegelaar:dev - #105

Add explicit validation for several query parameters across Graph, reports, and SharePoint endpoints so unsupported values return 400s instead of falling through to defaults. Regenerate the OpenAPI spec to document the accepted values and descriptions, improving MCP/tool discovery and request contracts.

Synced from CyberDrain/CIPP@416a3a2

Synced from CyberDrain/CIPP@5562081

…nt-names

Feat: Show Group Assignment Friendly Name on Windows Autopilot Profile

Synced from CyberDrain/CIPP@a8392c5

Document and align ExecAccessChecks tenant behavior with the UI. Tenant access checks now treat single-tenant reads as cached by default, only force a refresh when SkipCache is set, and the Check Tenant action sends that flag so the requested tenant is rechecked explicitly.

Synced from CyberDrain/CIPP@c268d3a

Feat: Include PIM-eligible members in Magic Dash roles table

Synced from CyberDrain/CIPP@2f5bfc2

…butes

Fix: user templates to retain custom attributes

Synced from CyberDrain/CIPP@bcc5b10

Synced from CyberDrain/CIPP@9edd202

Synced from CyberDrain/CIPP@190d76f

Entra sign-in records can reuse the same Id weeks apart, so claiming by Id alone let a stale claim swallow later events. Claims and stored rows now carry an EventCreationTime derived from the record's creation timestamp; a key conflict is only overridden when the new event is strictly newer or the existing claim is older than the 7-day reconciliation window. Also collapses duplicate keys within a single batch write (keeping the newest stamp) in both the webhook processing flush and the audit log rule flush, preventing regressions from same-Id records landing in the same pass.

Synced from CyberDrain/CIPP@09cce10

Add a shared helper that caches Defender TVM software-vulnerability export SAS URLs per tenant, reducing calls to the heavily rate-limited export endpoint. Update the raw TVM reader to consume the export files directly, streaming and decompressing multiline JSON records instead of paging the older API so large tenant datasets use far less memory.

Synced from CyberDrain/CIPP@16e1e4f

Replace MCP resource user_impersonation consent grants with resource pre-authorization so client setup works reliably even when user consent is disabled. Also split managed and custom redirect URIs into public vs web buckets across the API and UI, add the localhost callback, and cover the new auth flow with tests and OpenAPI updates.

Synced from CyberDrain/CIPP@4ed7372

…maps

Synced from CyberDrain/CIPP@1f26fe9

Synced from CyberDrain/CIPP@685c7a4

…ing or scenario lists

A tenant that fails the licence gate returned situations and excluded as a single null, which crashed the situations page reading .group. The endpoint now filters nulls and every simulator page drops null entries before rendering.

Synced from CyberDrain/CIPP@0e90a6c

Drop the redundant `Timestamp` boolean check from the OData filter used when querying cached access permissions, as it caused an invalid filter expression.

Synced from CyberDrain/CIPP@f49d9da

Switch CIS_6_2_3, CISAMSEXO71, and ORCA240 to the new ExoExternalInOutlook cache type and its Enabled property. Also adds an onmicrosoft.com UPN check to CIS_1_1_1's privileged user compliance report.

Synced from CyberDrain/CIPP@fdab33b

Cached access tokens minted from the old refresh token remain valid until expiry, so the new refresh token wasn't taking effect immediately. Clear the token cache for the partner tenant (all GDAP tenants) or for the specific tenant (by GUID and domain) after updating the refresh token.

Synced from CyberDrain/CIPP@e7173a0

Synced from CyberDrain/CIPP@8b2b2d2

Replace full in-memory Intune and Defender TVM export processing with streaming aggregation so cache jobs and vulnerability endpoints handle large report datasets without excessive allocations. Add Pester coverage for the new export reader and the updated alert/cache/endpoint behavior, and stop persisting large log query caches to localStorage to avoid quota overruns and tab OOMs.

Synced from CyberDrain/CIPP@99edfed

Fix: unwrapping of select fields in SetAuthMethod

Synced from CyberDrain/CIPP@0f2c8ee

…brary sync

Adds a Clone Template action to the Conditional Access template list and
hides Edit Template on synced templates, matching the Intune template list.

ExecCloneTemplate now also resets the GUID column (CA templates are looked
up by it, so a clone previously resolved to its original) and clears
Source, since community sync matches existing templates on displayName +
Source and could otherwise overwrite the clone.

Synced from CyberDrain/CIPP@790d863

feat(templates): sync GitHub push state for standards/baselines

Synced from CyberDrain/CIPP@791350d

feat(bec): BEC case workflow with attacker IP analysis, blast radius and background containment

Synced from CyberDrain/CIPP@fd9b7ea

feat(reporting): server-side PDF engine for every report, the Report Builder and branding previews

Synced from CyberDrain/CIPP@2d3367b

Synced from CyberDrain/CIPP@8866127

Synced from CyberDrain/CIPP@97f239a

The push-subscription flow now surfaces browser notification permission denials instead of swallowing them. The preferences page shows a clear status message while waiting for permission and explains how to enable notifications if the browser prompt does not appear.

Synced from CyberDrain/CIPP@6d5e904

Synced from CyberDrain/CIPP@e0b109a

…engine

- small batches cut the referenced entries out of the cached directory; a search's large slices share one full parse
- validate the cached users blob with Test-Json instead of parsing it
- share the expanded rule set across tenants
- map GUIDs without Add-Member or a log line per mapping, and before the placeholders are added
- parse and serialise records with CippJson
- drop the per-worker directory memo and the per-batch rule configuration log

Synced from CyberDrain/CIPP@e45ac9f

…tenant

Synced from CyberDrain/CIPP@e207433

Invoke-ListAuditLogCoverage pulled the entire ledger and filtered by date range and tenant in memory, timing out on large instances. Push the WindowStart range and tenant selector (PartitionKey or TenantId) into the table query instead.

Also add a 30-day cleanup of the coverage ledger in Start-LogRetentionCleanup, since the ledger has no other retention and only needs ~50 hours for the engine to function.

Add tests covering the server-side filter construction and the new cleanup batch behavior.

Synced from CyberDrain/CIPP@8f01e51

Synced from CyberDrain/CIPP@1cfccdb

…otification tests

Synced from CyberDrain/CIPP@80b0bd1

Update yarn.lock for sharp 0.35.5, prosemirror-view 1.42.6, and source-map-js 1.2.2.

Synced from CyberDrain/CIPP@a2cb181

…sting device prep group

The Device Prep baseline only set the Intune Provisioning Client as owner
when it created the device group, so a group made by hand stayed without
it. Ownership is now graded and, on remediation, added to the existing
group in place, without recreating the profile. The profile also has to
use the device preparation template to match, so a same-named policy is
never deleted, and the check and the fix resolve the same group when
several match.
Closes #721

Synced from CyberDrain/CIPP@75806c7

…ng webhook runs

Synced from CyberDrain/CIPP@8a24026

…d template tiers

Synced from CyberDrain/CIPP@57480a6

…error

Synced from CyberDrain/CIPP@7e31968

…permissions

Synced from CyberDrain/CIPP@b44f19c

…tory lookup fails

Synced from CyberDrain/CIPP@62d1a75

…ore syncs

Synced from CyberDrain/CIPP@2f151d7

Synced from CyberDrain/CIPP@1fa7a68

Synced from CyberDrain/CIPP@39779d2

feat(intune): add macOS LAPS retrieval

Synced from CyberDrain/CIPP@b68fa80

…icate auth

Enabling certificate authentication (wizard toggle or certificate-only
first setup) switched every Graph call onto the SAM certificate as soon as
the registration step returned, without proving the certificate could
obtain a token. When the stored certificate was not actually registered on
the application, that produced a full AADSTS700027 outage that the wizard
reported as success.

Backend:
- Add Test-CIPPSAMCertificateAuth, which reads the stored certificate
  uncached and requests an app-only token with it. Both enable paths now
  run it first; on failure the flag stays off (or is rolled back) and the
  client secret remains in use.
- Get-GraphToken: on AADSTS700027 re-read the certificate from storage and
  retry once when the thumbprint differs, so a runspace holding a stale
  certificate self-heals instead of failing until restart.
- Update-CIPPSAMCertificate: refresh the process-wide preload after a
  drift re-register, not only after a mint.
- Get-CIPPAuthentication: do not burn the one-shot provisioning attempt
  while the vault still holds deployment placeholders, so the manual
  credential route provisions a certificate on the next reload.
- ExecSAMCertificate Get: return the application id and the certificate
  credentials registered on the application (name, thumbprint, dates,
  whether it is this instance's). No key material is returned.

Frontend:
- Certificate step: clearer copy, a collapsed "Certificate details" panel
  with an Open in Entra button and a table of registered credentials
  (this instance sorted first, refreshable), a Renew certificate action,
  and status polling after renew while Graph catches up.

Tests cover the enable gate on both entrypoints, the probe helper, the
token self-heal, the drift env refresh and the status endpoint shape.

Synced from CyberDrain/CIPP@b4f930b

Synced from CyberDrain/CIPP@833eb26

Synced from CyberDrain/CIPP@c98e876

Synced from CyberDrain/CIPP@28d1d34

Synced from CyberDrain/CIPP@9bd0e3e

Synced from CyberDrain/CIPP@638252c

…g post-execution

- store only records whose operation an eq/in rule condition can match
- settle windows with nothing stored as Processed without processing
- start processing from the download task only when a window is waiting
- move the rule set read into Get-CIPPAuditLogRuleSet

Synced from CyberDrain/CIPP@2b3efed

Synced from CyberDrain/CIPP@2eddf0b

…active

Synced from CyberDrain/CIPP@f3b285f

Synced from CyberDrain/CIPP@7af4423

…date-20261014

Synced from CyberDrain/CIPP@621f0a1