Repository navigation
Conversation
![github-actions[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Synced from CyberDrain/CIPP@b3563a1
Synced from CyberDrain/CIPP@77713b9
…60921 chore(openapi): regenerate API spec (2026-09-21) Synced from CyberDrain/CIPP@f684f0e
…update-20260921 chore(permissions): update Entra API permission translator (2026-09-21) Synced from CyberDrain/CIPP@6dd35c9
feat(security simulations): Adds simulator and CA Gap analyser. Synced from CyberDrain/CIPP@d8f452d
Synced from CyberDrain/CIPP@4741ded
Add an "API" filter beside the severity filter in the Logbook Filters panel, each now half-width and side by side. It is a creatable multi-select whose selected values are joined with "|" and passed as the API query param, which Invoke-ListLogs already applies server-side as a regex match on the API column. Wired into the filter summary chip, query key, clear action and help text. Synced from CyberDrain/CIPP@49ad151
The Device Preparation profile's device security group is enrolled through the setEnrollmentTimeDeviceMembershipTarget action, not the enrollment_autopilot_dpp_devicesecuritygroupids settings string, which every create writes regardless of whether a group was ever applied. Adds Get/Set/Remove helpers for the membership target, backed by a CIPP-managed marker for tenants where the retrieve action doesn't route. The baseline and standard now read the applied group live, grade it as a separate dimension from settings, and repair it in place (assign/set) instead of forcing a delete-and-recreate. Also teaches Compare-CIPPIntuneAssignments and Get-CIPPIntuneAssignmentTarget to treat allLicensedUsersAssignmentTarget as equivalent to the All Users group target so a working assignment isn't flagged as drifted. Synced from CyberDrain/CIPP@6035578
Synced from CyberDrain/CIPP@47d79bf
These Exchange template endpoints were serializing the same Name/Comments fields twice when building the stored JSON payload. This change excludes the original properties after aliasing them, preserving the intended template metadata without duplicate keys. Synced from CyberDrain/CIPP@f8da32c
Add explicit validation for several query parameters across Graph, reports, and SharePoint endpoints so unsupported values return 400s instead of falling through to defaults. Regenerate the OpenAPI spec to document the accepted values and descriptions, improving MCP/tool discovery and request contracts. Synced from CyberDrain/CIPP@416a3a2
…nt-names Feat: Show Group Assignment Friendly Name on Windows Autopilot Profile Synced from CyberDrain/CIPP@a8392c5
Document and align ExecAccessChecks tenant behavior with the UI. Tenant access checks now treat single-tenant reads as cached by default, only force a refresh when SkipCache is set, and the Check Tenant action sends that flag so the requested tenant is rechecked explicitly. Synced from CyberDrain/CIPP@c268d3a
Feat: Include PIM-eligible members in Magic Dash roles table Synced from CyberDrain/CIPP@2f5bfc2
…butes Fix: user templates to retain custom attributes Synced from CyberDrain/CIPP@bcc5b10
Synced from CyberDrain/CIPP@190d76f
Entra sign-in records can reuse the same Id weeks apart, so claiming by Id alone let a stale claim swallow later events. Claims and stored rows now carry an EventCreationTime derived from the record's creation timestamp; a key conflict is only overridden when the new event is strictly newer or the existing claim is older than the 7-day reconciliation window. Also collapses duplicate keys within a single batch write (keeping the newest stamp) in both the webhook processing flush and the audit log rule flush, preventing regressions from same-Id records landing in the same pass. Synced from CyberDrain/CIPP@09cce10
Add a shared helper that caches Defender TVM software-vulnerability export SAS URLs per tenant, reducing calls to the heavily rate-limited export endpoint. Update the raw TVM reader to consume the export files directly, streaming and decompressing multiline JSON records instead of paging the older API so large tenant datasets use far less memory. Synced from CyberDrain/CIPP@16e1e4f
Replace MCP resource user_impersonation consent grants with resource pre-authorization so client setup works reliably even when user consent is disabled. Also split managed and custom redirect URIs into public vs web buckets across the API and UI, add the localhost callback, and cover the new auth flow with tests and OpenAPI updates. Synced from CyberDrain/CIPP@4ed7372
…ing or scenario lists A tenant that fails the licence gate returned situations and excluded as a single null, which crashed the situations page reading .group. The endpoint now filters nulls and every simulator page drops null entries before rendering. Synced from CyberDrain/CIPP@0e90a6c
Drop the redundant `Timestamp` boolean check from the OData filter used when querying cached access permissions, as it caused an invalid filter expression. Synced from CyberDrain/CIPP@f49d9da
Switch CIS_6_2_3, CISAMSEXO71, and ORCA240 to the new ExoExternalInOutlook cache type and its Enabled property. Also adds an onmicrosoft.com UPN check to CIS_1_1_1's privileged user compliance report. Synced from CyberDrain/CIPP@fdab33b
Cached access tokens minted from the old refresh token remain valid until expiry, so the new refresh token wasn't taking effect immediately. Clear the token cache for the partner tenant (all GDAP tenants) or for the specific tenant (by GUID and domain) after updating the refresh token. Synced from CyberDrain/CIPP@e7173a0
added 30 commits
October 10, 2026 18:48
OneDrive names a new shortcut after the library and prefixes the site name, so Teams channel shortcuts end up as long strings like "Team - Channel - Documents". The Add OneDrive Shortcut action now takes an optional name, and the shortcut is renamed to it right after creation, because OneDrive ignores the name on create. Names breaking OneDrive's rules (reserved characters, leading or trailing space, trailing period, over 255 characters) are rejected. If the rename fails the shortcut is kept and the result says so. A blank name keeps the default. Closes #853 Synced from CyberDrain/CIPP@bba5201
Graph's message trace API is not offered for GCC tenants, and its "not currently supported" error was returned to the user instead of taking the existing Get-MessageTraceV2 fallback. Treat it like a missing service principal or consent and fall back, without provisioning. Synced from CyberDrain/CIPP@5d27fd1
Synced from CyberDrain/CIPP@e4d1f73
Synced from CyberDrain/CIPP@9683d00
…hurn in the tests run - resolve collectors, prepare hooks and executors with a direct command lookup instead of Get-Command - skip the collector lookup for definitions without a cache type - take a remembered capabilities failure without rethrowing it; pin Test-CIPPStandardLicense behaviour in tests - remember a failed SharePoint root site lookup for two minutes - avoid exception-driven paths in Get-NormalizedError, Get-CippUserAgent, prepare hooks and ZTNA21992 Synced from CyberDrain/CIPP@8a1ece0
The fleet overview mixed every baseline together. It can now be scoped to one baseline, and optionally one of its stages: a tenant's standard counts when that baseline has rolled it out to the tenant (stages up to its current stage, or just the chosen stage). Standards shared by two baselines count toward both, which the page notes. Stored trends are fleet-wide, so the trend chart is hidden while filtered, and a filter with nothing scorable shows a dash instead of 0%. The Alignment tab's by-standard view gets the same filters and reads them from the URL, so the Open Deviations and License Missing tiles carry the filter there. Those tiles passed onClick, which CippInfoBar ignores, so they never navigated; they now use link. ListBaselineAlignment takes optional baselineId and stage parameters with byStandard; the unfiltered response is unchanged. The tenant view's per-baseline score now matches exact standard instances through the same stage helper, so package members count and other baselines' instances no longer skew it. Closes #868 Synced from CyberDrain/CIPP@2ddfefb
Feat: Scope JIT admin approval to specific tenants and tenant groups Synced from CyberDrain/CIPP@1280c64
The push-subscription flow now surfaces browser notification permission denials instead of swallowing them. The preferences page shows a clear status message while waiting for permission and explains how to enable notifications if the browser prompt does not appear. Synced from CyberDrain/CIPP@6d5e904
…engine - small batches cut the referenced entries out of the cached directory; a search's large slices share one full parse - validate the cached users blob with Test-Json instead of parsing it - share the expanded rule set across tenants - map GUIDs without Add-Member or a log line per mapping, and before the placeholders are added - parse and serialise records with CippJson - drop the per-worker directory memo and the per-batch rule configuration log Synced from CyberDrain/CIPP@e45ac9f
Invoke-ListAuditLogCoverage pulled the entire ledger and filtered by date range and tenant in memory, timing out on large instances. Push the WindowStart range and tenant selector (PartitionKey or TenantId) into the table query instead. Also add a 30-day cleanup of the coverage ledger in Start-LogRetentionCleanup, since the ledger has no other retention and only needs ~50 hours for the engine to function. Add tests covering the server-side filter construction and the new cleanup batch behavior. Synced from CyberDrain/CIPP@8f01e51
…otification tests Synced from CyberDrain/CIPP@80b0bd1
Update yarn.lock for sharp 0.35.5, prosemirror-view 1.42.6, and source-map-js 1.2.2. Synced from CyberDrain/CIPP@a2cb181
…sting device prep group The Device Prep baseline only set the Intune Provisioning Client as owner when it created the device group, so a group made by hand stayed without it. Ownership is now graded and, on remediation, added to the existing group in place, without recreating the profile. The profile also has to use the device preparation template to match, so a same-named policy is never deleted, and the check and the fix resolve the same group when several match. Closes #721 Synced from CyberDrain/CIPP@75806c7
…ng webhook runs Synced from CyberDrain/CIPP@8a24026
…d template tiers Synced from CyberDrain/CIPP@57480a6
…permissions Synced from CyberDrain/CIPP@b44f19c
…tory lookup fails Synced from CyberDrain/CIPP@62d1a75
…ore syncs Synced from CyberDrain/CIPP@2f151d7
Synced from CyberDrain/CIPP@1fa7a68
Synced from CyberDrain/CIPP@39779d2
feat(intune): add macOS LAPS retrieval Synced from CyberDrain/CIPP@b68fa80
…icate auth Enabling certificate authentication (wizard toggle or certificate-only first setup) switched every Graph call onto the SAM certificate as soon as the registration step returned, without proving the certificate could obtain a token. When the stored certificate was not actually registered on the application, that produced a full AADSTS700027 outage that the wizard reported as success. Backend: - Add Test-CIPPSAMCertificateAuth, which reads the stored certificate uncached and requests an app-only token with it. Both enable paths now run it first; on failure the flag stays off (or is rolled back) and the client secret remains in use. - Get-GraphToken: on AADSTS700027 re-read the certificate from storage and retry once when the thumbprint differs, so a runspace holding a stale certificate self-heals instead of failing until restart. - Update-CIPPSAMCertificate: refresh the process-wide preload after a drift re-register, not only after a mint. - Get-CIPPAuthentication: do not burn the one-shot provisioning attempt while the vault still holds deployment placeholders, so the manual credential route provisions a certificate on the next reload. - ExecSAMCertificate Get: return the application id and the certificate credentials registered on the application (name, thumbprint, dates, whether it is this instance's). No key material is returned. Frontend: - Certificate step: clearer copy, a collapsed "Certificate details" panel with an Open in Entra button and a table of registered credentials (this instance sorted first, refreshable), a Renew certificate action, and status polling after renew while Graph catches up. Tests cover the enable gate on both entrypoints, the probe helper, the token self-heal, the drift env refresh and the status endpoint shape. Synced from CyberDrain/CIPP@b4f930b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.3)
Can you help keep this open source service alive? 💖 Please sponsor : )