fix: suppress SSO migration until setup is complete

Guard the forced SSO migration prompt behind initial setup completion. The setup wizard must run first and the SAM app must be configured before ExecSSOSetup can create the CIPP-SSO registration. Backend checks ApplicationID env var; frontend passes setupCompleted prop to ForcedSsoMigrationDialog.

Synced from CyberDrain/CIPP@805cd1b

Author: github-actions[bot]

Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1

@@ -236,19 +236,19 @@ function Test-CIPPAccess {
             $CanManageAppSettings = $Permissions -contains 'CIPP.AppSettings.ReadWrite'
             $HasAnyPermission = ($Permissions | Measure-Object).Count -gt 0
 
-            # Forced SSO migration: non-dismissible prompt when migration env var is set
-            if ($env:CIPP_SSO_MIGRATION_APPID -and $CanManageAppSettings) {
+            # Forced SSO migration: non-dismissible prompt when migration env var is set.
+            # Suppressed until initial setup (SAM app) is complete — the setup wizard has
+            # to run first, and ExecSSOSetup needs the SAM app to create the CIPP-SSO
+            # registration. Same env check that drives the setupCompleted alert.
+            $InitialSetupComplete = $env:ApplicationID -and $env:ApplicationID -ne 'LongApplicationID'
+            if ($env:CIPP_SSO_MIGRATION_APPID -and $CanManageAppSettings -and $InitialSetupComplete) {
                 $MeResponse['forceSsoMigration'] = @{
                     appId  = $env:CIPP_SSO_MIGRATION_APPID
                     status = 'pending'
                 }
             }
 
-            # SSO migration requires a working SAM app — suppress the nag until initial
-            # setup is complete (same check GetCippAlerts uses for its setup alert)
-            $SetupCompleted = $env:ApplicationID -and $env:ApplicationID -ne 'LongApplicationID'
-
-            if ($env:CIPPNG -ne 'true' -and $HasAnyPermission -and $SetupCompleted) {
+            if ($env:CIPPNG -ne 'true' -and $HasAnyPermission) {
                 try {
                     $SSOTable = Get-CIPPTable -tablename 'SSOMigration'
                     $SSOMigration = Get-CIPPAzDataTableEntity @SSOTable -Filter "PartitionKey eq 'SSO' and RowKey eq 'MigrationConfig'" -ErrorAction SilentlyContinue