[pull] master from KelvinTegelaar:master#59
Open
pull[bot] wants to merge 471 commits into
Open
Conversation
…ert items for a tenant, so the frontend can display live alert instances (not just configured rules or snoozed items). Backs the new Alerts card on the dashboard. Adds a read-only endpoint that surfaces the currently-active fired alert items for a tenant, so the frontend can display live alert instances (not just configured rules or snoozed items). Backs the new Alerts card on the dashboard.
If a CA failed to be deployed because of a missing X or another issue these were not surfaced to the user and in tern drift/standards alignment indicated the policy as aligned even though nothing was deployed. Also adds some future helpers that might be of use later
…vanced) (#2114) ## What The "Check" add-in's alerts are re-sent on every scheduled run - each run dumps the whole recent backlog to the configured webhook instead of only new alerts. Reported in #6216 (e.g. 13 test alerts resulted in 13 entries on every run). ## Cause `Get-CIPPAlertCheckExtension` reads a per-tenant watermark from the `AlertLastRun` table (`PartitionKey 'AlertLastRun'`, `RowKey "<tenant>-Get-CIPPAlertCheckExtension"`) so it only fetches alerts newer than the previous run - but it never writes that watermark back. As a result `$Since` always falls back to the default 24-hour window, so every run re-fetches and re-sends the same alerts (and the day-partitioned de-dupe in `Write-AlertTrace` resets at midnight, which lines up with the reported timing jumps). ## Fix Capture the run start, read/store an explicit `LastRunTime` watermark (falling back to the existing `Timestamp` for backward compatibility), and upsert the `AlertLastRun` row after processing. Each run now only sends alerts created since the previous run. ## Testing - PowerShell parses clean. - A mock-storage harness confirms the behaviour: run 1 sends the backlog, run 2 (no new alerts) sends nothing, run 3 sends only a newly-added alert. Fixes KelvinTegelaar/CIPP#6216
# Resolve tenant variables in the Win32 Custom App detection script Fixes KelvinTegelaar/CIPP#6226. `%tenantid%` and the other `Get-CIPPTextReplacement` tokens resolve in a Win32 Custom Application's install and uninstall scripts, but not in the detection script, which reaches Intune with the literal `%tenantid%` string. In `Add-CIPPW32ScriptApplication.ps1` the install and uninstall scripts are passed through `Get-CIPPTextReplacement` before being base64-encoded, but the detection script was encoded from the raw `$Properties.detectionScript`. This change runs the detection script through `Get-CIPPTextReplacement` first, the same way as the install and uninstall scripts directly below it. Verified against the real `Get-CIPPTextReplacement` with mocked tenant lookups: before the change the detection script keeps the literal `%tenantid%`; after, it resolves to the tenant's customerId and matches what the install script produces. Other tokens such as `%tenantfilter%` resolve too.
Improve logging and error handling in the GDAP relationship termination function
…2112) ## What Adds a deterministic post-processing stage that enriches the generated `openapi.json` with typed `200` response schemas and a unique `operationId` per operation, and publishes the result as a Release asset. It does **not** replace the existing generator; it runs on its output. ## Why The generated spec types request bodies but leaves every `200` response as the generic `StandardResults` envelope, and carries no `operationId` on any operation. Two practical consequences: - OpenAPI importers that key on `operationId` skip every operation. Tested against a real importer: the unmodified spec imported as **0** actions; with `operationId` injected it imports as **all 582**. - Downstream tools get no typed output fields to map against. ## How A PowerShell stage (`.build/Add-OpenApiResponseSchemas.ps1`) with two passes, both pure functions of checked-in sources (no live API calls, byte-identical output across runs): - **operationId**: bare endpoint name per operation; method-prefixed only where one path carries multiple methods (e.g. `GetExecCSPLicense` / `PostExecCSPLicense`). Existing `operationId`s are preserved; any collision is a hard failure. - **typed 200 responses**: derived from the frontend shape baselines (`Tests/Shapes/*.json`) and page `simpleColumns` declarations. The `{ Results, Metadata }` envelope is preserved exactly as the API returns it (no flattening, so the schema stays truthful to the wire). Endpoints with no typed source keep `StandardResults`, which is correct for write/exec operations. ## Publishing + CI - `openapi-enriched-release.yml` builds and uploads `openapi.enriched.json` as an asset on each GitHub Release (no commits back to the tree). - `openapi-enriched-check.yml` runs the test suite and **strictly lints the enriched spec** against a committed ignore-baseline (`.redocly.lint-ignore.yaml`) that pins pre-existing findings, so any *new* finding fails CI. - `.github/workflows/` is gitignored in this repo (the existing workflows are force-added), so these two were added with `git add -f`, matching the repo convention. ## Tests 50 Pester tests + PSScriptAnalyzer (0 findings), run via `Tests/Build/Invoke-BuildTests.ps1`. Covers operationId rules (bare/disambiguated/preserve/collision-throws), response typing, idempotency, and the frontend-scan edge cases. ## Known limitations (documented in `.build/README.md`) - Only `get/post/put/patch/delete` are processed (the spec has no other methods today). - Paths are assumed to start with `/api/` (all current paths do). - A typed `200` replaces the existing `200.content` (today only `StandardResults` exists there). - Conditional/ternary `simpleColumns` expressions are intentionally not parsed (a conservative miss is preferred over capturing non-column strings). ## Side benefit Injecting `operationId` also removes the `operation-operationId` lint warning that previously applied to every operation in the spec. ## CI activation note Both workflows are guarded with `if: github.repository_owner == 'KelvinTegelaar'`, matching the convention of the existing workflows in this repo (forks do not run them). As a result they will **not** appear as status checks on this PR from the fork; they activate once merged into the upstream tree. Verification was therefore done locally before opening this PR: - `Tests/Build/Invoke-BuildTests.ps1`: 50 Pester tests passing, PSScriptAnalyzer 0 findings - strict Redocly lint of the generated `openapi.enriched.json`: 0 errors, 0 warnings, 5 pre-existing findings ignored via the committed baseline; verified to fail on an injected new finding - both workflow YAML files parse clean - enrichment is deterministic: same inputs produce byte-identical output across runs
This pull request enhances the `Push-BECRun` PowerShell function by adding the retrieval and logging of sent message traces for a user, and includes this data in the output object. These changes improve the auditing and incident response capabilities of the function by providing more comprehensive information about user activity. **Enhancements to auditing and user activity tracking:** * Added retrieval of sent message traces using the `Get-MessageTraceV2` cmdlet, with error handling and logging in case of failures. The trace includes message details such as status, subject, recipient, received time, and sender IP. * Included the collected sent message trace data as a new property (`SentMessages`) in the output object returned by the function.
Introduce support for ExcludeGroupIds and ExcludeGroupNames in assignment functions. Frontend PR: KelvinTegelaar/CIPP#6244
Overhaul of the rather interesting way to construct a JSON payload and add in severity and resolving comment functionality. Frontend PR: KelvinTegelaar/CIPP#6234
Updated to write to and read from cetralised CIPP database
Frontend PR: KelvinTegelaar/CIPP#6238 The `SetAuthMethod` endpoint only toggled state and group targeting, so every method-specific option was unreachable from the portal. This forwards those settings through `Invoke-SetAuthMethod` and applies them in `Set-CIPPAuthenticationPolicy`. **Added/exposed settings** - TAP: `isUsableOnce`, min/max/default lifetime, default length - Microsoft Authenticator: software OATH + display-app-info / display-location / companion-app feature states - Email OTP: external-ID state, exclude groups (empty list now explicitly clears `excludeTargets`) - QR Code PIN: lifetime + PIN length - FIDO2: `isAttestationEnforced` + `isSelfServiceRegistrationAllowed` (were hardcoded on enable) - Voice: `isOfficePhoneAllowed` - SMS: `isUsableForSignIn` (stamped onto each include-target) Log messages now spell out the changed values per method. **Tests:** adds `Tests/Private/Set-CIPPAuthenticationPolicy.Tests.ps1` (7 cases) — `Invoke-Pester -Path ./Tests/Private/Set-CIPPAuthenticationPolicy.Tests.ps1`.
Add the SMTP client authentication state to the mailbox details response, enhancing the information available for mailbox configuration. Frontend: KelvinTegelaar/CIPP#6180
Introduce functionality to allow specific user profile fields to be cleared when editing a user. Currently the property is just quietly dropped with a success message. Frontend PR: KelvinTegelaar/CIPP#6261
Group display names are matched with -like, which treats square brackets as a wildcard character class, so a literal group such as [WIN] Company Devices never matched itself and assignment failed with No matching groups resolved. Escape only [ and ] before the match so bracketed names resolve literally, while * and ? wildcards (documented in the assignment UI, 'Wildcards (*) are allowed') keep working. Applied to the six group-resolution sites in Set-CIPPAssignedApplication, Set-CIPPAssignedPolicy and Compare-CIPPIntuneAssignments (include and exclude). Filter-name matching is unchanged. Resolves KelvinTegelaar/CIPP#6246
Detect AADSTS7000229 token-acquisition failures in audit search creation and classify them as `AccessDenied` instead of generic transient errors. Update the webhook flow to handle `AccessDenied` like `AuditingDisabled`: cache the tenant in `AuditLogDisabledTenants` for 24 hours, stop further processing in the cycle, and defer remaining windows with a consistent bail reason.
…llowlists The allowlist of special includeUsers/excludeUsers values spelled the Graph value as 'GuestOrExternalUsers' (singular), but Microsoft's real value is 'GuestsOrExternalUsers' (plural). In New-CIPPCAPolicy the misspelled value fell through to the display-name lookup, found no matching user, and was silently dropped - producing an empty includeUsers array that Graph rejects on deploy. Also corrects the same spelling in the New-CIPPCATemplate ID-to-name maps (benign fallthrough there, fixed for consistency), and logs a warning naming any user value that fails to resolve instead of dropping it silently.
… them Eleven standards wrapped their remediation calls in try/catch with an empty catch block, so any failure from Set-CIPPAuthenticationPolicy (which throws on error) was silently discarded and the standard appeared to succeed.
…/assignments App Protection / managed-app policies reported NON-COMPLIANT on every drift run regardless of settings: templates are stored with apps[], deployment strips apps (Set-CIPPIntunePolicy), and the policy read-back never returns apps, assignments, or a matching deployedAppCount (Get-CIPPIntunePolicy has no $expand), so the generic deep-compare always flagged them. - Exclude 'assignments' globally: read-back never includes assignments for any policy type, and assignment verification has its own dedicated path (Compare-CIPPIntuneAssignments via verifyAssignments). - Exclude 'apps' and 'deployedAppCount' only for CompareType 'AppProtection' (what the Standards/drift engine passes), because Device configs carry legitimate nested 'apps' arrays (e.g. kiosk profiles) that must keep being compared. - '@odata.context' already skipped by the existing *@OData* wildcard.
Templates synced from a gold tenant fetch App Protection policies via
their concrete type URL (e.g. androidManagedAppProtections('id')), and
Graph omits @odata.type from those responses. The stored RAWJson then
lacks @odata.type, so Set-CIPPIntunePolicy built the deploy URL as
deviceAppManagement/s and Graph returned "Resource not found for the
segment 's'.". Re-add @odata.type from the known ODataType when Graph
omits it, and fail with a clear error on deploy when a stored template
still has no @odata.type.
Two defects allowed Invoke-SherwebMigration scheduled tasks to keep firing daily (sending alerts and performing real Sherweb purchases and Pax8 subscription cancellations) after the Sherweb migration was disabled: - Invoke-SherwebMigration had no enabled-guard: it read the Sherweb extension config but never checked Enabled before acting. It now returns immediately unless the Sherweb config exists and Enabled is true, which neutralizes any stale scheduled task. - Register-CIPPExtensionScheduledTasks created migration tasks in the enable branch, but the disable cleanup only filtered Push-CippExtensionData tasks, so migration tasks were never removed. Migration tasks are now queried at function scope, removed when the Sherweb extension is disabled, and removed when a tenant is no longer Sherweb-mapped.
…ve licensed users alert The alert already fetched assignedLicenses and accountEnabled from Graph but dropped them from the emitted alert data. Surface license display names, raw SKU IDs, account enablement and days since last sign-in so the alert can be actioned without a follow-up lookup.
…isfy its own check The remediation enabled the MicrosoftAuthenticator method but never passed the feature settings the compliance check grades against, so the standard could never converge: displayAppInformationRequiredState was checked but not set, and numberMatchingRequiredState was checked even though Set-CIPPAuthenticationPolicy deliberately strips it from the PATCH body (Microsoft now enforces number matching and the setting can no longer be toggled). The empty catch around the remediation call also swallowed every error, leaving no signal in the logs. - Pass -MicrosoftAuthenticatorDisplayAppInfo 'enabled' in the remediation so the PATCH sets what the check grades - Drop numberMatchingRequiredState from the check and the report comparison, matching Microsoft's enforced-by-default behavior - Replace the empty catch with Get-CippException + Write-LogMessage error logging, matching the idiom in Invoke-CIPPStandardAuthenticationMethods
Update New-CIPPCATemplate to use the correct special value `GuestsOrExternalUsers` when processing include/exclude users and groups. This fixes a typo that could cause the selector to be treated like a normal ID instead of being preserved.
Update request parsing to support both PSCustomObject and IDictionary shapes from Azure Functions deserialization. `Get-CippMcpToolResult` now correctly flattens MCP arguments and clones headers when they are dictionaries, preventing lost params/headers (including EasyAuth context). `Invoke-ListMailboxes` now reads query parameter names from dictionary keys, so allowed mailbox filters are applied reliably.
… sending null
Untoggled "switch" inputs are omitted from a standard's settings, so
TeamsGlobalMeetingPolicy, TeamsExternalFileSharing, and
TeamsFederationConfiguration serialized null booleans to the Teams
ConfigApi, which rejects the write with 400 "Error converting value
{null} to type 'System.Boolean'". The null also poisoned the
$StateIsCorrect comparison ($CurrentState.X -eq $null is never true),
so affected tenants reported non-compliant and failed remediation on
every run.
Coalesce each switch to $false (the CIS recommended value, matching the
convention in TeamsExternalAccessPolicy/TeamsGuestAccess/
TeamsEmailIntegration) and use the coalesced variable in the state
comparison, remediation payload, and report expected values. In
TeamsExternalFileSharing the existing "?? $false" was dead code because
-eq binds tighter than ??.
Replace the null-check wrapper with a direct null filter when building `ComparisonResults`. This ensures the endpoint always returns an array containing only valid comparison entries, avoiding accidental null items in the response.
Add `Sync-CippContainerUpdateState` and use it in both timer and container management endpoints so stale "update available" results are corrected after a restart. The update-check flow now also captures and preserves `RemoteBuildDate` and `CheckedTag`, and the settings/status response includes build-date metadata for both running and remote images.
Ensure container image build timestamps are converted from PowerShell DateTime values into UTC ISO 8601 strings before they are returned or stored. This avoids ambiguous unspecified kinds and keeps timer-driven update checks and container management responses consistent.
Resolve container update settings through the shared sync path so never-saved fields default to auto-restart on, hourly checks, and 23:00 while still respecting explicit disabled or empty values. Also tighten status reconciliation after restarts and fix check-time validation/formatting so early UTC hours are accepted correctly.
Refactors the SSO migration checks in `Test-CIPPAccess` to use explicit permission flags. This keeps the forced migration prompt limited to users who can manage app settings and skips migration lookups for users with no assigned permissions.
Add a shared Autopilot profile name validator and use it in both the HTTP endpoint and default deployment profile flow. This catches unsupported Intune characters before submission so the API returns a clear bad request or logged error instead of an opaque service-side 500.
Add `Resolve-CIPPDlpAdvancedRule` and apply it across template capture, policy deploy, and drift comparison so DLP rules keep either `AdvancedRule` or flat condition fields, never both. Update DLP rule field metadata to expose `RuleConditions` and include `AdvancedRule`, then normalize advanced-rule JSON during comparison to avoid false drift from formatting or key-order differences.
… missing" This reverts commit 24db2c5.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )