[pull] master from KelvinTegelaar:master#34
Open
pull[bot] wants to merge 1510 commits into
Open
Conversation
This pull request enhances the `Push-BECRun` PowerShell function by adding the retrieval and logging of sent message traces for a user, and includes this data in the output object. These changes improve the auditing and incident response capabilities of the function by providing more comprehensive information about user activity. **Enhancements to auditing and user activity tracking:** * Added retrieval of sent message traces using the `Get-MessageTraceV2` cmdlet, with error handling and logging in case of failures. The trace includes message details such as status, subject, recipient, received time, and sender IP. * Included the collected sent message trace data as a new property (`SentMessages`) in the output object returned by the function.
Introduce support for ExcludeGroupIds and ExcludeGroupNames in assignment functions. Frontend PR: KelvinTegelaar/CIPP#6244
Overhaul of the rather interesting way to construct a JSON payload and add in severity and resolving comment functionality. Frontend PR: KelvinTegelaar/CIPP#6234
Updated to write to and read from cetralised CIPP database
Frontend PR: KelvinTegelaar/CIPP#6238 The `SetAuthMethod` endpoint only toggled state and group targeting, so every method-specific option was unreachable from the portal. This forwards those settings through `Invoke-SetAuthMethod` and applies them in `Set-CIPPAuthenticationPolicy`. **Added/exposed settings** - TAP: `isUsableOnce`, min/max/default lifetime, default length - Microsoft Authenticator: software OATH + display-app-info / display-location / companion-app feature states - Email OTP: external-ID state, exclude groups (empty list now explicitly clears `excludeTargets`) - QR Code PIN: lifetime + PIN length - FIDO2: `isAttestationEnforced` + `isSelfServiceRegistrationAllowed` (were hardcoded on enable) - Voice: `isOfficePhoneAllowed` - SMS: `isUsableForSignIn` (stamped onto each include-target) Log messages now spell out the changed values per method. **Tests:** adds `Tests/Private/Set-CIPPAuthenticationPolicy.Tests.ps1` (7 cases) — `Invoke-Pester -Path ./Tests/Private/Set-CIPPAuthenticationPolicy.Tests.ps1`.
Add the SMTP client authentication state to the mailbox details response, enhancing the information available for mailbox configuration. Frontend: KelvinTegelaar/CIPP#6180
Introduce functionality to allow specific user profile fields to be cleared when editing a user. Currently the property is just quietly dropped with a success message. Frontend PR: KelvinTegelaar/CIPP#6261
Group display names are matched with -like, which treats square brackets as a wildcard character class, so a literal group such as [WIN] Company Devices never matched itself and assignment failed with No matching groups resolved. Escape only [ and ] before the match so bracketed names resolve literally, while * and ? wildcards (documented in the assignment UI, 'Wildcards (*) are allowed') keep working. Applied to the six group-resolution sites in Set-CIPPAssignedApplication, Set-CIPPAssignedPolicy and Compare-CIPPIntuneAssignments (include and exclude). Filter-name matching is unchanged. Resolves KelvinTegelaar/CIPP#6246
Detect AADSTS7000229 token-acquisition failures in audit search creation and classify them as `AccessDenied` instead of generic transient errors. Update the webhook flow to handle `AccessDenied` like `AuditingDisabled`: cache the tenant in `AuditLogDisabledTenants` for 24 hours, stop further processing in the cycle, and defer remaining windows with a consistent bail reason.
…llowlists The allowlist of special includeUsers/excludeUsers values spelled the Graph value as 'GuestOrExternalUsers' (singular), but Microsoft's real value is 'GuestsOrExternalUsers' (plural). In New-CIPPCAPolicy the misspelled value fell through to the display-name lookup, found no matching user, and was silently dropped - producing an empty includeUsers array that Graph rejects on deploy. Also corrects the same spelling in the New-CIPPCATemplate ID-to-name maps (benign fallthrough there, fixed for consistency), and logs a warning naming any user value that fails to resolve instead of dropping it silently.
… them Eleven standards wrapped their remediation calls in try/catch with an empty catch block, so any failure from Set-CIPPAuthenticationPolicy (which throws on error) was silently discarded and the standard appeared to succeed.
…/assignments App Protection / managed-app policies reported NON-COMPLIANT on every drift run regardless of settings: templates are stored with apps[], deployment strips apps (Set-CIPPIntunePolicy), and the policy read-back never returns apps, assignments, or a matching deployedAppCount (Get-CIPPIntunePolicy has no $expand), so the generic deep-compare always flagged them. - Exclude 'assignments' globally: read-back never includes assignments for any policy type, and assignment verification has its own dedicated path (Compare-CIPPIntuneAssignments via verifyAssignments). - Exclude 'apps' and 'deployedAppCount' only for CompareType 'AppProtection' (what the Standards/drift engine passes), because Device configs carry legitimate nested 'apps' arrays (e.g. kiosk profiles) that must keep being compared. - '@odata.context' already skipped by the existing *@OData* wildcard.
Templates synced from a gold tenant fetch App Protection policies via
their concrete type URL (e.g. androidManagedAppProtections('id')), and
Graph omits @odata.type from those responses. The stored RAWJson then
lacks @odata.type, so Set-CIPPIntunePolicy built the deploy URL as
deviceAppManagement/s and Graph returned "Resource not found for the
segment 's'.". Re-add @odata.type from the known ODataType when Graph
omits it, and fail with a clear error on deploy when a stored template
still has no @odata.type.
Two defects allowed Invoke-SherwebMigration scheduled tasks to keep firing daily (sending alerts and performing real Sherweb purchases and Pax8 subscription cancellations) after the Sherweb migration was disabled: - Invoke-SherwebMigration had no enabled-guard: it read the Sherweb extension config but never checked Enabled before acting. It now returns immediately unless the Sherweb config exists and Enabled is true, which neutralizes any stale scheduled task. - Register-CIPPExtensionScheduledTasks created migration tasks in the enable branch, but the disable cleanup only filtered Push-CippExtensionData tasks, so migration tasks were never removed. Migration tasks are now queried at function scope, removed when the Sherweb extension is disabled, and removed when a tenant is no longer Sherweb-mapped.
…ve licensed users alert The alert already fetched assignedLicenses and accountEnabled from Graph but dropped them from the emitted alert data. Surface license display names, raw SKU IDs, account enablement and days since last sign-in so the alert can be actioned without a follow-up lookup.
…isfy its own check The remediation enabled the MicrosoftAuthenticator method but never passed the feature settings the compliance check grades against, so the standard could never converge: displayAppInformationRequiredState was checked but not set, and numberMatchingRequiredState was checked even though Set-CIPPAuthenticationPolicy deliberately strips it from the PATCH body (Microsoft now enforces number matching and the setting can no longer be toggled). The empty catch around the remediation call also swallowed every error, leaving no signal in the logs. - Pass -MicrosoftAuthenticatorDisplayAppInfo 'enabled' in the remediation so the PATCH sets what the check grades - Drop numberMatchingRequiredState from the check and the report comparison, matching Microsoft's enforced-by-default behavior - Replace the empty catch with Get-CippException + Write-LogMessage error logging, matching the idiom in Invoke-CIPPStandardAuthenticationMethods
Update New-CIPPCATemplate to use the correct special value `GuestsOrExternalUsers` when processing include/exclude users and groups. This fixes a typo that could cause the selector to be treated like a normal ID instead of being preserved.
Update request parsing to support both PSCustomObject and IDictionary shapes from Azure Functions deserialization. `Get-CippMcpToolResult` now correctly flattens MCP arguments and clones headers when they are dictionaries, preventing lost params/headers (including EasyAuth context). `Invoke-ListMailboxes` now reads query parameter names from dictionary keys, so allowed mailbox filters are applied reliably.
… sending null
Untoggled "switch" inputs are omitted from a standard's settings, so
TeamsGlobalMeetingPolicy, TeamsExternalFileSharing, and
TeamsFederationConfiguration serialized null booleans to the Teams
ConfigApi, which rejects the write with 400 "Error converting value
{null} to type 'System.Boolean'". The null also poisoned the
$StateIsCorrect comparison ($CurrentState.X -eq $null is never true),
so affected tenants reported non-compliant and failed remediation on
every run.
Coalesce each switch to $false (the CIS recommended value, matching the
convention in TeamsExternalAccessPolicy/TeamsGuestAccess/
TeamsEmailIntegration) and use the coalesced variable in the state
comparison, remediation payload, and report expected values. In
TeamsExternalFileSharing the existing "?? $false" was dead code because
-eq binds tighter than ??.
Replace the null-check wrapper with a direct null filter when building `ComparisonResults`. This ensures the endpoint always returns an array containing only valid comparison entries, avoiding accidental null items in the response.
Add `Sync-CippContainerUpdateState` and use it in both timer and container management endpoints so stale "update available" results are corrected after a restart. The update-check flow now also captures and preserves `RemoteBuildDate` and `CheckedTag`, and the settings/status response includes build-date metadata for both running and remote images.
Ensure container image build timestamps are converted from PowerShell DateTime values into UTC ISO 8601 strings before they are returned or stored. This avoids ambiguous unspecified kinds and keeps timer-driven update checks and container management responses consistent.
Resolve container update settings through the shared sync path so never-saved fields default to auto-restart on, hourly checks, and 23:00 while still respecting explicit disabled or empty values. Also tighten status reconciliation after restarts and fix check-time validation/formatting so early UTC hours are accepted correctly.
Refactors the SSO migration checks in `Test-CIPPAccess` to use explicit permission flags. This keeps the forced migration prompt limited to users who can manage app settings and skips migration lookups for users with no assigned permissions.
Add a shared Autopilot profile name validator and use it in both the HTTP endpoint and default deployment profile flow. This catches unsupported Intune characters before submission so the API returns a clear bad request or logged error instead of an opaque service-side 500.
Add `Resolve-CIPPDlpAdvancedRule` and apply it across template capture, policy deploy, and drift comparison so DLP rules keep either `AdvancedRule` or flat condition fields, never both. Update DLP rule field metadata to expose `RuleConditions` and include `AdvancedRule`, then normalize advanced-rule JSON during comparison to avoid false drift from formatting or key-order differences.
… missing" This reverts commit 24db2c5.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )