Dev to release - #2135
Merged
Merged
Conversation
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
Updated to write to and read from cetralised CIPP database
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
Added license check for new Defender category Signed-off-by: DamienMatthys <damien@pcunplug.com>
Cleaned up logging Signed-off-by: DamienMatthys <damien@pcunplug.com>
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
…enant.ps1 Remove old sync function Signed-off-by: DamienMatthys <damien@pcunplug.com>
Remove old sync schedule Signed-off-by: DamienMatthys <damien@pcunplug.com>
Fixed sync to add one CVE per Device Signed-off-by: DamienMatthys <damien@pcunplug.com>
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
[pull] dev from KelvinTegelaar:dev
Set SetFromProfile earlier to prevent re-entrancy when Update-CIPPSAMCertificate calls Get-GraphToken. Add logic to provision a missing SAM certificate during authentication initialization, with improved error handling and logging. The weekly token update will retry if provisioning fails.
Extend `Invoke-ExecSetSharePointMember` to handle communication/classic SharePoint sites by using SharePoint REST (`ensureuser`, add/remove in associated member group) with certificate auth, while preserving group-connected behavior via M365 group membership. The change also improves request field reuse, adds endpoint logging for success/failure, normalizes exception handling with `Get-CippException`, and returns clearer error messages and status codes.
Refines SharePoint member management to be role-aware across Owners, Members, and Visitors, with smarter routing between Graph-backed M365 group updates and SharePoint role-group REST calls. Removals now honor the selected member type/source so directly added users are removed from the correct role group, and messaging/error text is more specific. Updates site member listing to return actual role-group membership from SharePoint REST, expand M365 group claims into real users on group-connected sites, include site collection admins, and fall back to the User Information List via Graph when REST access is unavailable.
…ite retrieval feat: Extend Set-CIPPSPOSite to support Int64 property types feat: Implement Invoke-ExecSetSiteProperties for updating site properties via API feat: Create Invoke-ListSiteProperties to retrieve site properties with friendly enum names
- deleted site restoration - bulk removal of sharing links for a site - site recycle bin management (new cipp permission) - full user removal from all groups in site - guest user detection in list site members
- Implements KelvinTegelaar/CIPP#6248 - Group Templates for Distribution Lists and mail enabled security groups can now define **email aliases with variables** and **hide from GAL** option
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # Every safety-eligible device inactive beyond the delete age meets the delete threshold (surfaced in reports). | ||
| $DevicesMeetingDeleteThreshold = @($AllDevices | Where-Object { $_.approximateLastSignInDateTime -lt $DeleteDate } | Where-Object $SafetyFilter) | ||
| # Only those already disabled are actually deleted this run; enabled ones are disabled first and deleted later. | ||
| $DevicesToDelete = @($DevicesMeetingDeleteThreshold | Where-Object { $_.accountEnabled -ne $true }) |
| $ComputeSets = { | ||
| $StaleDevices = @($AllDevices | Where-Object { $_.approximateLastSignInDateTime -lt $DisableDate }) | ||
| $RemediationEligibleStaleDevices = @($StaleDevices | Where-Object $SafetyFilter) | ||
| $DevicesToDisable = @($RemediationEligibleStaleDevices | Where-Object { $_.accountEnabled -eq $true }) |
|
|
||
| # Retrieve CVEs from database | ||
| $RawCveItems = $GraphRequest | ||
| $AllCachedCves = $RawCveData |
| } | ||
|
|
||
| $CveExceptionsTable = Get-CIPPTable -TableName 'CveExceptions' | ||
| $CveCacheTable = Get-CIPPTable -TableName 'CveCache' |
| } | ||
|
|
||
| $SuccessCount = 0 | ||
| $FailCount = 0 |
| return | ||
| } | ||
|
|
||
| $SuccessCount = 0 |
| if ($tenantid -ne $env:TenantID -and $clientType.delegatedPrivilegeStatus -eq 'directTenant') { | ||
| Write-Host "Using direct tenant refresh token for $($clientType.customerId)" | ||
| $ClientRefreshToken = Get-Item -Path "env:\$($clientType.customerId)" -ErrorAction SilentlyContinue | ||
| if (!$env:SetFromProfile) { $CIPPAuth = Get-CIPPAuthentication; Write-Host 'Could not get Refreshtoken from environment variable. Reloading token.' } |
| } | ||
|
|
||
| $SuccessCount = 0 | ||
| $FailCount = 0 |
| return | ||
| } | ||
|
|
||
| $SuccessCount = 0 |
Signed-off-by: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
TecharyJames
added a commit
to Techary/CIPP-API
that referenced
this pull request
Jul 13, 2026
commit fd23ff20016d97f87b2a262f0d08ec4e07501399
Merge: 0ec258d90 11beb6dde
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 16:59:27 2026 +0200
Dev to release (#2135)
commit 11beb6dde91a005dc3a36be98d9bcaa7477dfb0a
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Fri Jul 10 22:57:21 2026 +0800
Conventional Commits Check for PR titles
commit f921f04ecf2c12eff2ad17794000955830eba5d9
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 16:52:13 2026 +0200
version up
commit 8aa4d31e66eaade491ac4027c2bab07dcc27eaf0
Merge: e42d8d3d3 0ec258d90
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 16:50:42 2026 +0200
Merge branch 'master' into dev
Signed-off-by: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
commit e42d8d3d3eda248fd143fbeef7deafd9624fcf3b
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 16:49:27 2026 +0200
version up
commit 06d0bd80f12167223b1fd2e5b12cce7e27e723bf
Author: John Duprey <jwd@johnwduprey.com>
Date: Fri Jul 10 10:03:03 2026 -0400
feat: add functions to manage SharePoint external users and site user removal
commit c59b1305e79d8cc4a0c439276f650416a035c7a7
Merge: 3777ac22b cad96bbb5
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 14:48:09 2026 +0200
Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev
commit 3777ac22bdeb5c7fbe3e0b46930a714ef91f2787
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 14:48:07 2026 +0200
rollup multiple versions of same tool
commit cad96bbb59aa97cb4358025de0380a4986cb8c84
Merge: 36759b2d8 b378d96e0
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 13:07:18 2026 +0200
feat: add email aliases and hide-from-GAL to group templates (#2130)
- Implements KelvinTegelaar/CIPP#6248
- Group Templates for Distribution Lists and mail enabled security
groups can now define **email aliases with variables** and **hide from
GAL** option
commit 36759b2d83748b427a32d573f124c5efc549b360
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 13:05:58 2026 +0200
fixed in dev
commit 7c86a6a91399bc116bb81df0a14bcd8b4c982784
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 12:58:58 2026 +0200
fix for template names when cant be found
commit 101477fc350aa00c67f615bd23b3fc9f17a27ad0
Merge: c6e67b2be c13479500
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 12:02:27 2026 +0200
Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev
commit c6e67b2beb03501f6c28d661e43567bc58d9c403
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Fri Jul 10 12:00:36 2026 +0200
tag update
commit c1347950045a0c106e79a83ba975728559e9f8fb
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Fri Jul 10 14:24:24 2026 +0800
Fixes for mem cache performance
commit 2e8531cf19ccf308fd68ce1cc53b749cec2c3a23
Author: John Duprey <jwd@johnwduprey.com>
Date: Fri Jul 10 01:41:15 2026 -0400
feat: Enhanced SharePoint site management functionality
- deleted site restoration
- bulk removal of sharing links for a site
- site recycle bin management (new cipp permission)
- full user removal from all groups in site
- guest user detection in list site members
commit 2bc15bf029d112089fa44377dc37a3efd8cd3c1e
Author: John Duprey <jwd@johnwduprey.com>
Date: Fri Jul 10 00:33:08 2026 -0400
feat: Add SiteUrl parameter to Get-CIPPSPOSite and implement single-site retrieval
feat: Extend Set-CIPPSPOSite to support Int64 property types
feat: Implement Invoke-ExecSetSiteProperties for updating site properties via API
feat: Create Invoke-ListSiteProperties to retrieve site properties with friendly enum names
commit d06d7fc65ecbe7662b8d5dd891c5015b7a5930fd
Author: John Duprey <jwd@johnwduprey.com>
Date: Fri Jul 10 00:01:08 2026 -0400
feat: Enhance group member addition and removal logging with group names
commit 0fe9645a1b5b6edb4bf7419428b3a9ea964b5cdb
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 9 23:51:51 2026 -0400
feat: Improve SharePoint site role membership handling
Refines SharePoint member management to be role-aware across Owners, Members, and Visitors, with smarter routing between Graph-backed M365 group updates and SharePoint role-group REST calls. Removals now honor the selected member type/source so directly added users are removed from the correct role group, and messaging/error text is more specific.
Updates site member listing to return actual role-group membership from SharePoint REST, expand M365 group claims into real users on group-connected sites, include site collection admins, and fall back to the User Information List via Graph when REST access is unavailable.
commit d50b7174741c24ab128120f64c0399a4529863f1
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 9 22:47:07 2026 -0400
feat: Support non-group SharePoint member updates
Extend `Invoke-ExecSetSharePointMember` to handle communication/classic SharePoint sites by using SharePoint REST (`ensureuser`, add/remove in associated member group) with certificate auth, while preserving group-connected behavior via M365 group membership. The change also improves request field reuse, adds endpoint logging for success/failure, normalizes exception handling with `Get-CippException`, and returns clearer error messages and status codes.
commit 5d3befc8387ac18b627d0a35a1347c01ebf4d3fd
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 9 22:08:40 2026 -0400
fix: add onprem sync attributes
commit 2b3ec21ddea36adff013b7a5fafa8648be992451
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 9 17:06:19 2026 -0400
fix: SAM certificate provisioning in authentication load
Set SetFromProfile earlier to prevent re-entrancy when Update-CIPPSAMCertificate calls Get-GraphToken. Add logic to provision a missing SAM certificate during authentication initialization, with improved error handling and logging. The weekly token update will retry if provisioning fails.
commit 3ba77440a3fe9b387f88b1209322dd585ad3d208
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 22:45:11 2026 +0200
add license name to offboarding
commit 510236d64767fd0af485260191756a348d851704
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 22:35:04 2026 +0200
fixes cve management issue.
commit 94ab1afa6ff6424f5333ddf911c7e588102c6146
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 21:48:48 2026 +0200
fix as app because I forgot
commit beae1130ca0ecd5fca1d76cb3d8e79d3d4079549
Merge: 559036d6f 5f2a3e3ec
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 21:25:24 2026 +0200
Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev
commit 559036d6fbfa71123395eefa5c65131dbb4f40f5
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 21:25:22 2026 +0200
fix for listening libraries
commit 5f2a3e3ec03b8894b4be4c8a17f31f6128240995
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 9 13:56:01 2026 -0400
feat: Enhance SAM certificate handling with preload and cache update functionality
commit ce34525d4ca8af8c303b51343a6457ca9a58d060
Merge: 035b8625f 98e1a315f
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 18:40:58 2026 +0200
Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev
commit 035b8625f5da640885a1212aed14417628576e81
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 18:40:38 2026 +0200
merge issue
commit 98e1a315f4525056e0191fad9e253d73c2bf56d6
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 9 12:16:21 2026 -0400
fix: Preserve EXO error responses
Use `ResponseHeadersRead` in `CIPPRestClient` so mislabelled compressed Exchange error bodies do not fail inside `SendAsync`. This keeps the HTTP status available for the existing defensive response handling path.
commit 2e636ca5454fc49be48dbb93028bd6a651fa1a7b
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 9 12:15:41 2026 -0400
feat: Unify certificate token auth flow
Adds a shared `New-CIPPCertificateAssertion` helper and refactors Graph/EXO request helpers to route `-UseCertificate` through `Get-GraphToken` for both delegated refresh-token and app-only flows. Updates token cache grant-type keys for certificate auth, defaults EXO tenant ID to env TenantID, and blocks the new assertion helper from scheduler/exec invocation. Also changes `CIPPRestClient` to use `ResponseHeadersRead` so malformed EXO content-encoding responses don’t fail in `SendAsync` before status/body handling.
commit bf76f2bd6b01a8f3f294b04e67ce1871309e6c7f
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 9 11:36:55 2026 -0400
feat: Support SAM certificate setup exemptions
Ensure SAM certificate creation works during initial setup and renewal when app management policies restrict key credentials. This updates the exemption policy logic to disable certificate-related restrictions, lets SAM certificate rotation use delegated Graph headers for setup-time calls, and attempts to create the certificate immediately after provisioning the SAM app instead of waiting for the scheduled renewal.
commit da30ffcadb00a0b55b19fe50350ef620f248d3dc
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 9 11:20:10 2026 -0400
feat: Add SAM cert lifecycle management and endpoint
Introduces full SAM certificate lifecycle support: create, load (with cache), store (Key Vault cert with secret fallback), and renew with app-registration key credential sync/rollback logic. The weekly token timer now auto-renews the SAM cert when missing or near expiry.
Graph/EXO helpers gain a `UseCertificate` path so app-only requests can authenticate via the stored SAM certificate, and certificate-based token acquisition now includes token caching plus transient AADSTS700027 retry handling. Adds a new `Invoke-ExecSAMCertificate` HTTP endpoint for status and forced renewal, and blocks SAM certificate management commands from scheduler/ExecCippFunction execution.
commit 82ac60ee99ef117bf11103fa9821b7df47e0f1bb
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 17:13:23 2026 +0200
introducing streaming
commit 6c86428ccd5fabcd8898fd4abe705940b68a205a
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 16:52:18 2026 +0200
oom management
commit e106d4de3cbc4a6f73d290d4679523be1808aa21
Merge: e7ed3a226 70a8722c1
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 16:35:22 2026 +0200
Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev
commit e7ed3a226ae12d44ec213783d66f7c2449b9a313
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 16:35:20 2026 +0200
extra logging
commit 70a8722c1bf4f80a0049d448ab4cef8e88c8e883
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 16:05:32 2026 +0200
Add or update the Azure App Service build and deployment workflow config
commit aa7e060b6754298862a439549a86607da3788b2e
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 9 15:44:12 2026 +0200
sharepoint reports
commit 4f2dad21ee11581116659e56714218aca966a0f4
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Thu Jul 9 17:53:15 2026 +0800
Custom Tests Results Overview page
commit 856a5c3d0e6655e8184844b6124b6356e7c5a226
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Thu Jul 9 17:09:18 2026 +0800
Feature Flag updates
Hide backend links for hosted instances
Hide offloading when not needed
commit faa1b841e31bcbafe49da3b365f1bc75c33be5f6
Author: John Duprey <jwd@johnwduprey.com>
Date: Wed Jul 8 23:04:51 2026 -0400
fix: add member to upn field candidates
commit 23502b984c5dbe88a4d07ca553fd802e3656d85b
Author: John Duprey <jwd@johnwduprey.com>
Date: Wed Jul 8 16:20:57 2026 -0400
feat: add functions to format alert cell values and normalize alert display rows
commit 15cc4b45937a8f263a179464b0a9ce80e85e65d7
Author: John Duprey <jwd@johnwduprey.com>
Date: Wed Jul 8 12:50:56 2026 -0400
feat: enhance role permission handling and introduce Get-CippHttpPermissions function
fix issue with stale permissions causing escalation alerts on api client management
commit 660a177d5e62b7f985d835c6541692644cc6166b
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Thu Jul 9 00:45:22 2026 +0800
Optionally set company branding for usernameHintText and signInPageText only if specified
commit bc3230e725df650575eb17293096da5e636d4857
Author: John Duprey <jwd@johnwduprey.com>
Date: Wed Jul 8 12:06:38 2026 -0400
fix: ensure sorted output for child values and handle comparison errors in Intune template
commit ff91091df1a085feec45d12c31eeb953f4fa4af6
Author: John Duprey <jwd@johnwduprey.com>
Date: Wed Jul 8 12:04:04 2026 -0400
fix: exclude .None permissions from permission check
commit c90254651259e6694f23e72efc513fe4641fd9b7
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 8 20:59:37 2026 +0800
Remove legacy formatting for antiphish standard
commit 0dac60d9d3bd6c544cb3995e2a2bd5f35f3dca51
Merge: 0a520a2dd 866ede9f9
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 8 14:37:20 2026 +0200
Fix: Added more properties to CVE management, improved efficiency (#2131)
Added more properties sent to the CVE management window
Improved efficiency of compiling exceptions, which can cause it to crash
when there are too many
Adjusted the Ninja sync to send over empty CVE listings to ensure they
are wiped from Ninja in the event they are all cleaned up
commit 0a520a2ddf5968df9e5f81e16eaf91eeb2dbc557
Merge: be7b3a704 403082ad8
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 8 14:31:30 2026 +0200
Feat: App registration enhancements (#2132)
- Added ability to add secrets
- Added ability to edit URI's
- Added ability to edit audience
- Added 'rotate' workflow to secrets
commit be7b3a704f0de621144b666951c8c72119dc531d
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 8 20:17:37 2026 +0800
Fix for when editing a scheduled and no hidden param is sent from the frontend
commit fe93fbd4b45ba804ad651a825b49b0062d53846d
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 8 19:32:44 2026 +0800
Self fix on read duplicate key values for KeepCopy, keepCopy and keepcopy
commit 5b7cf18234b4840f3eacafe27b041fa2657094fb
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jul 7 23:37:35 2026 +0200
json updates
commit fea7f9f85f5841f52cfa8b41038a2b3f26cae12a
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jul 7 22:58:29 2026 +0200
shadow ai updates
commit 239cfeb54c1c692215816dc5dc8bd0d7798c9eb1
Author: John Duprey <jwd@johnwduprey.com>
Date: Tue Jul 7 13:29:43 2026 -0400
feat: Refactor target object handling in Get-CippCustomDataAttributes and enhance user attribute selection in Invoke-ListUsers
commit c0573d20545e48a1dde54d21e17aefc9cfb2f37a
Author: John Duprey <jwd@johnwduprey.com>
Date: Tue Jul 7 12:58:08 2026 -0400
feat: Enhance reusable settings template handling in tenant alignment functions and standards
commit ef91c5b2a63cb5fb07d75d0b8534c04238caee9a
Merge: 9c5b576ef 9520792f4
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jul 7 16:56:13 2026 +0200
Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev
commit 9c5b576ef918cdae3bfb4e4686ac7e8c5a620c95
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jul 7 16:56:12 2026 +0200
Last copilot AI improvements reporting.
commit 9520792f466eeb52548577ff5da6c3d85ceb4d43
Author: John Duprey <jwd@johnwduprey.com>
Date: Tue Jul 7 10:00:37 2026 -0400
feat: Include SSO migration status in stats timer
commit 405c55d085d80d1bcd3674f993e739a0dcdda14d
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Tue Jul 7 21:55:50 2026 +0800
Update Update-CIPPSSORedirectUri.ps1
commit 9c91d0460c93bb31bde81317f07490552e2c4d84
Merge: bf3f22879 168a11032
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jul 7 15:51:06 2026 +0200
Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev
commit bf3f22879f0bc1a5e6b49ebd9e1f5d4a7fd5401f
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jul 7 15:51:04 2026 +0200
fixes manual run jobs with detectedApp data
commit 168a1103248acaabdb5bafc1122c3c7cf12fef99
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Tue Jul 7 21:29:09 2026 +0800
SSO manual cred input
commit 122fbf2fcff1e8351816e3516d9862b7ad01d263
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jul 7 14:41:24 2026 +0200
remove copilot feature flag. its timmmeee
commit cb33a142ac719d81adc185dc01782cdb5d9fe014
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Tue Jul 7 19:41:43 2026 +0800
Harden KV and Offloading name resolutions
commit 158ebf27cc2a61dea6026f1519f7e0be297949a7
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Tue Jul 7 17:41:35 2026 +0800
Introduce pipeline streaming for graph get request to reduce memory during cache collection
commit 403082ad8827ff44a872cbb73af68d2e8c564fc4
Author: James Tarran <jtarran@techary.com>
Date: Tue Jul 7 09:25:24 2026 +0100
Update Invoke-ExecManageAppCredentials.ps1
Remove un-needed comments
commit 2999e363f6bebbd3c7cc08acc91821ce3017558d
Author: James Tarran <jtarran@techary.com>
Date: Tue Jul 7 09:05:35 2026 +0100
App registration love
- Ability to add secrets
- Ability to edit URI's
- Ability to edit audience
- Added 'rotate' secret workflow (delete and recreate with the same name)
commit 866ede9f9483aaf9c2be65356d34bea8e9c00b33
Author: DamienMatthys <damien@pcunplug.com>
Date: Tue Jul 7 12:02:34 2026 +1000
Update Get-CIPPCVEReport.ps1
Minimising tasks
Signed-off-by: DamienMatthys <damien@pcunplug.com>
commit 61c55e730515e9f95fa6125e6e1266ab4e706f94
Author: DamienMatthys <damien@pcunplug.com>
Date: Tue Jul 7 12:01:51 2026 +1000
Update Invoke-ListCVEManagement.ps1
Minimising tasks
Signed-off-by: DamienMatthys <damien@pcunplug.com>
commit b1bc57f2ca2259455f7e15fe55bc9e803702f94b
Author: John Duprey <jwd@johnwduprey.com>
Date: Mon Jul 6 20:24:27 2026 -0400
feat: enhance drift data handling by pruning stale entries and tracking valid standards
commit e380a7ce22bcdd5028056df9ffc344bd32087554
Author: John Duprey <jwd@johnwduprey.com>
Date: Mon Jul 6 13:52:32 2026 -0400
feat: enhance sensitivity label handling with advanced settings
commit 9c1879c10c066fd0cdb6de1936a536fe84c1905e
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Mon Jul 6 20:22:15 2026 +0800
Drop disableResilienceDefaults when not enabled
Fixes: https://github.com/KelvinTegelaar/CIPP/issues/6287
commit 4c5404c1a4e5be3fd9599c738b0fa29145cc7baa
Merge: 36eca35d2 d3ea5f7f6
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Mon Jul 6 14:06:15 2026 +0200
Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev
commit 36eca35d2489f075e5a2d4e2686b7450bdfa9368
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Mon Jul 6 14:02:48 2026 +0200
vacation mode updates
commit d3ea5f7f622c230f327e23d091d12fb6440407e2
Merge: 15dc7816e 288351fbf
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Mon Jul 6 13:08:07 2026 +0200
fix: remove users from mail-enabled security groups during license removal on offboarding (#2129)
- Fixes KelvinTegelaar/CIPP#6280
- Remove users from mail-enabled security groups during license removal
on offboarding
commit 15dc7816ee4eb953850f7c7345cfefd3788fea8c
Merge: 4efcd9f35 f4861cf23
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Mon Jul 6 13:04:58 2026 +0200
feat(bec): surface inbox rule changes in report (#2127)
## Problem
The BEC investigation only lists inbox rules that **still exist** on the
mailbox (`Get-InboxRule`). Attackers commonly create a rule, use it, and
then delete it to cover their tracks — those rules were completely
invisible in the report.
Separately, when the unified audit log search failed or timed out, the
exception killed the **entire** BEC run instead of producing a partial
report.
## Changes
- **New `InboxRuleChanges` field**: a user-scoped
`Search-UnifiedAuditLog` for `New-InboxRule`, `Set-InboxRule`,
`Remove-InboxRule` and `UpdateInboxRules` events over the last 7 days,
so created/changed/deleted rules show up even if they no longer exist.
- **`RecentlyChanged` flag on existing rules**: rules returned by
`Get-InboxRule` are flagged when their name matches a 7-day audit event.
(Inbox rules carry no timestamps, so name-matching is the best available
signal; Outlook-client `UpdateInboxRules` events carry no rule name and
stay unflagged.)
- **Resilience**: the tenant-wide audit search is wrapped in try/catch —
on failure it logs a warning and degrades to partial results instead of
failing the whole run. `Get-InboxRule` failures now log via
`Write-LogMessage` (the old `Write-Host` string concat was broken).
- **Trimmed the tenant-wide search**: dropped
`MailboxLogin`/`UserLoggedIn` operations — nothing downstream consumed
them (`$PermissionsLog` filters to permission ops only) and sign-in
events are high-volume, bloating the search.
- Error-path result now includes `ExtractedAt` so the frontend gets a
timestamp even on failure.
## Companion PR
Frontend PR (displays `InboxRuleChanges` + `RecentlyChanged` in the BEC
page and PDF report): KelvinTegelaar/CIPP#6281
This PR is safe to merge on its own — it only adds fields to the BEC
result.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
commit e083b193530b702a7f9bc7107ddf7dac713e2929
Author: DamienMatthys <damien@pcunplug.com>
Date: Mon Jul 6 14:45:55 2026 +1000
Update Invoke-NinjaOneTenantSync.ps1
Enabled syncing with no CVEs in case they have all been cleaned up
Signed-off-by: DamienMatthys <damien@pcunplug.com>
commit bb94134ff4fb7bab3f5f4bf7bfd8584de85ae4c1
Author: DamienMatthys <damien@pcunplug.com>
Date: Mon Jul 6 14:43:02 2026 +1000
Update Invoke-ListCVEManagement.ps1
Added extra properties
Improved efficiency of adding exception items
Signed-off-by: DamienMatthys <damien@pcunplug.com>
commit 78c74362bd7fe9d3bbebfc5e6de2b44790ff37e2
Author: DamienMatthys <damien@pcunplug.com>
Date: Mon Jul 6 14:42:05 2026 +1000
Update Get-CIPPCVEReport.ps1
Added extra properties
Improved efficiency of adding exception items
Signed-off-by: DamienMatthys <damien@pcunplug.com>
commit b378d96e0f6e2884a524b435e2bb825c6e1ade37
Author: Luis Mengel <mail@lmengel.de>
Date: Sun Jul 5 01:11:31 2026 +0200
feat: add email aliases and hide-from-GAL to group templates
commit 288351fbf41d1d07e31e409cedb3c20f8a8e3ff4
Author: Luis Mengel <mail@lmengel.de>
Date: Sun Jul 5 00:13:26 2026 +0200
fix: remove users from mail-enabled security groups during license removal
commit f4861cf23b10381e880c24498c24ad5cfd72bbf5
Merge: f95046cbe 4efcd9f35
Author: Bobby <31723128+kris6673@users.noreply.github.com>
Date: Fri Jul 3 17:08:10 2026 +0200
Merge remote-tracking branch 'upstream/dev' into bec-rule-changes
# Conflicts:
# Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1
commit 4efcd9f35e7aa05edd918e728374177c96ac4d84
Author: John Duprey <jwd@johnwduprey.com>
Date: Fri Jul 3 08:44:23 2026 -0400
chore: update version to 10.5.8
commit 127bdc688b223f9295922960b39c46cee10ae4ab
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Fri Jul 3 20:15:49 2026 +0800
BEC and false network timeout fixes
commit 1f0a3c40a49a1f5e96bd2478f00b96c61dcce7ee
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Fri Jul 3 16:19:26 2026 +0800
Revert partner SP permission lookup and revert to table permissions list for setting CPV permissions
commit 1390e14e421d9244b8b27083eeb7894c1d749bc0
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 2 22:23:06 2026 +0200
updated standards report item
commit d3a016c3af12a39d09b35b1d38b55593abe77d28
Merge: 965352fe5 50ba47ff2
Author: John Duprey <john@cyberdrain.com>
Date: Thu Jul 2 15:37:56 2026 -0400
feat: add psscriptanalyzer (#2128)
commit 50ba47ff269aaf57eca89fffdd90dfa06b36a536
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 2 15:32:54 2026 -0400
feat: add psscriptanalyzer
commit 965352fe5a8443c7cc3bb30ffa33299ca727d53a
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 2 15:18:57 2026 -0400
fix: add caching for hudu relations to reduce api overload
commit 4ee969426f6f387618724889462cf6ff75996a49
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 2 15:17:55 2026 -0400
chore: bump version to 10.5.7
commit f95046cbeeaf5f0bff25302397cefb3e36656255
Author: Bobby <31723128+kris6673@users.noreply.github.com>
Date: Thu Jul 2 21:08:34 2026 +0200
feat(bec): surface inbox rule changes in report
The BEC report only listed inbox rules that still exist on the
mailbox, so rules an attacker created, used and then deleted were
invisible. Add a user-scoped audit log search for rule create,
change and remove events over the last 7 days, expose it as
InboxRuleChanges, and flag surviving rules as RecentlyChanged.
Also harden the run: audit log search failures and timeouts were
killing the entire BEC run, so wrap the search in try/catch and
degrade to partial results with a warning instead. Drop the unused
high-volume MailboxLogin/UserLoggedIn operations from the
tenant-wide search (nothing downstream consumed them) and log
Get-InboxRule failures properly instead of a broken Write-Host.
commit 23c0c83446a4e5ef533bcc217ce409a8abc7cd20
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Fri Jul 3 01:56:59 2026 +0800
Revert permission repair changes (AsApp grant application + Jun 30 rework)
commit 396606f0fa6ab4cc2140bc8d713c1ba21afb9f37
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Fri Jul 3 01:12:53 2026 +0800
Implement rest api management of teams admin management and update cache, tests and standards
This addressed authentication issues with GDAP and the Teams PowerShell module, not all uses of the module have been replaced but this covers most of them with the remaining to be ported at a later date allowing for the complete removal of the teams PowerShell module
commit 7c1afbfa3e52f8f0df73c91c01d78617a43581cb
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Fri Jul 3 00:15:42 2026 +0800
Use app permissions to update partner tenant sam app else use delegate permissions as fallback
commit 913b8285be7d61c3ce9514b8eb11ad2c470f01a2
Author: John Duprey <jwd@johnwduprey.com>
Date: Thu Jul 2 10:21:38 2026 -0400
fix: increase template depth in get-cippdrift
commit bb1e10de1de194edfb1bbd5832f3c8d11dbdf638
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Thu Jul 2 18:10:10 2026 +0800
Add Stale Entra Devices Remediation Action
commit a34a6ed75e3250df8b2dcf531a3e9aeddd78e282
Merge: dbc414a85 15c545ff1
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Thu Jul 2 11:28:31 2026 +0200
feat: user filter + cache sync for mailbox permissions (#2125)
## Summary
Companion to the CIPP frontend PR adding bulk mailbox-permission removal
and a per-user "Mailbox Access" card.
- **`Invoke-ExecModifyMBPerms`**: sync the reporting-DB cache
(`Sync-CIPPMailboxPermissionCache`) for every successful
FullAccess/SendAs/SendOnBehalf operation. The endpoint executes cmdlets
via `New-ExoBulkRequest`/`New-ExoRequest` built with
`Set-CIPPMailboxPermission -AsCmdletObject`, which returns before its
own execute-mode sync — so every change through this endpoint left the
cached permission report stale. The sync uses the Graph-resolved UPN
(cache rows are keyed by mailbox UPN), and failed operations are not
synced.
- **`Invoke-ListmailboxPermissions`**: optional `User` query filter on
the `UseReportDB` + `ByUser=true` path, so the frontend can fetch one
user's mailbox access without downloading the whole tenant report. The
filter is gated on `ByUser=true` because the mailbox-grouped shape has
no top-level `User` property.
## Tests
`Tests/Endpoint/Invoke-ExecModifyMBPerms.Tests.ps1`: 25 Pester tests
covering per-level cmdlet mapping, bulk/individual/fallback execution
paths, user lookup fallbacks, input shapes, guards, and the new
cache-sync behaviour (syncs on success with resolved UPN, skips failures
and non-cacheable levels). All passing.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
commit dbc414a85320e51caa251c217dd258f6290c052f
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Thu Jul 2 17:24:37 2026 +0800
fix logging semantics
commit 81e7900ca0cb03a1ac084a34f3522fbe102196ee
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Thu Jul 2 17:21:06 2026 +0800
Correct missing templates from policy compare page and endpoint
commit 15c545ff1f124e3df7c7bb647a779ac0ce93d2c7
Author: Bobby <31723128+kris6673@users.noreply.github.com>
Date: Thu Jul 2 10:28:59 2026 +0200
fix: sync cache with resolved UPN, guard filter
Cache rows are keyed by mailbox UPN, so syncing with the raw
request identifier missed the row whenever the caller passed a
Graph object id. The new User query filter also emptied the
mailbox-grouped report shape, which has no top-level User
property; it now only applies alongside ByUser=true.
commit 84945c6da1beb40c76bee3ed0807378c4817549e
Author: Bobby <31723128+kris6673@users.noreply.github.com>
Date: Thu Jul 2 00:44:53 2026 +0200
feat: filter permission report by user
Lets the frontend fetch a single user's mailbox access from the
cached report without downloading the whole tenant's data.
commit b17579056401fda266e92e8cabc84838ab1fbedf
Author: Bobby <31723128+kris6673@users.noreply.github.com>
Date: Thu Jul 2 00:44:46 2026 +0200
fix: sync mailbox permission cache after changes
ExecModifyMBPerms executes EXO cmdlets itself via -AsCmdletObject,
which bypasses Set-CIPPMailboxPermission's execute-mode cache sync,
so every change through this endpoint left the cached permission
report stale until the next full sync. Track which operations
actually succeeded and sync each cacheable one.
commit 0cb0ddc9d674286d09cff9ded832fb57314f7986
Merge: 2df58194e 3c919651e
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 23:53:18 2026 +0200
Feat: Alerts on dashboard (#2118)
Adds a read-only endpoint that surfaces the currently-active fired alert
items for a tenant, so the frontend can display live alert instances
(not just configured rules or snoozed items). Backs the new Alerts card
on the dashboard.
commit 2df58194ecc51797f1e4751973e128239908a335
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 23:46:44 2026 +0200
MSP App improvements
commit f6115b2166727d42703ff3cc72d2c38a28c78db8
Merge: 1a3c6c0e5 dab2d8f75
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 23:36:09 2026 +0200
Feat: add Pester test runner and scaffolder (#2124)
Split out of #2096 (4/4).
- `Tests/Invoke-CippTests.ps1` — runs the whole Pester suite, with
optional `-CI` (NUnit results file) and `-Coverage` output.
- `Tests/New-CippTest.ps1` — scaffolds a runnable test skeleton for any
function (helper stubs, fake HTTP contexts, move-resilient path
resolution by filename), lowering the barrier to adding backend tests.
- `.gitignore` — ignores the runner's `TestResults.xml` / `coverage.xml`
artifacts.
Tooling only — no runtime code touched.
commit 1a3c6c0e5417c788a83bd723df5e23fcc7814f90
Merge: 12fcd0118 877a4668d
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 23:25:35 2026 +0200
Tests: add mailbox permission coverage (#2123)
Split out of #2096 (3/4).
New Pester coverage for `Set-CIPPMailboxPermission`,
`Set-CIPPMailboxVacation`, and `Remove-CIPPMailboxPermissions`:
permission-level → EXO cmdlet mapping, cache sync, Add/Remove actions,
and error paths. Tests dot-source the function under test and stub CIPP
helpers, matching the existing test style.
Test-only change; 43 tests pass locally against current `dev`.
commit 12fcd0118dc1f796d308d6463f9acae4f684ab04
Merge: 1b5601e25 b6ceba414
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 23:09:55 2026 +0200
Refactor: share mailbox permission helper (#2122)
Split out of #2096 (2/4).
`Set-CIPPMailboxAccess`, `Invoke-ExecEditMailboxPermissions`, and
`Invoke-ExecModifyMBPerms` each duplicated the permission → EXO cmdlet
mapping. They now share the existing `Set-CIPPMailboxPermission` helper
(~230 fewer lines). Bulk processing in `ExecModifyMBPerms` is unchanged.
Includes Pester coverage for all three refactored functions (34 tests,
passing locally).
## Intended behavior changes
- `ExecEditMailboxPermissions` drops a redundant Graph `id` lookup — the
UPN is passed straight to EXO as the identity.
- `SendOnBehalf` now syncs the permission cache, matching
FullAccess/SendAs.
commit 1b5601e25f305b0ddf9431314b45fc7f96043d83
Merge: 76ec0e274 b326768d6
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 23:09:04 2026 +0200
Fix: resolve test function paths by filename (#2121)
Split out of #2096 (1/4).
Several existing Pester tests (Intune reusable settings,
GlobalAdminAllowList alert, ReusableSettingsTemplate standard) hardcode
the module path of the function under test, so they broke when functions
moved between modules and currently fail on `dev`. This resolves the
function by filename under `Modules/` instead, making the tests
move-resilient.
Test-only change; all 36 tests in the touched files pass locally.
commit dab2d8f75c051744842ce31f673f71724ccd8738
Author: Bobby <31723128+kris6673@users.noreply.github.com>
Date: Wed Jul 1 22:54:42 2026 +0200
feat(tests): add test runner and scaffolder
Invoke-CippTests.ps1 runs the Pester suite with optional -CI
(NUnit results) and -Coverage output; New-CippTest.ps1
scaffolds a runnable test skeleton for any function (helper
stubs, fake HTTP contexts, move-resilient path resolution)
to lower the barrier to adding backend tests. Ignore the
runner's result/coverage artifacts.
commit 877a4668df5d13e3aa5ffb8367b50c5688ebd5b4
Author: Bobby <31723128+kris6673@users.noreply.github.com>
Date: Wed Jul 1 22:54:07 2026 +0200
test: add mailbox permission coverage
Pester coverage for Set-CIPPMailboxPermission,
Set-CIPPMailboxVacation and Remove-CIPPMailboxPermissions:
permission-level to EXO cmdlet mapping, cache sync,
Add/Remove actions and error paths. Tests dot-source the
function under test and stub CIPP helpers, per house style.
commit b6ceba4140b3260ff015d2dcf3e9cce9082f4544
Author: Bobby <31723128+kris6673@users.noreply.github.com>
Date: Wed Jul 1 22:53:33 2026 +0200
refactor(mailbox-perms): share permission helper
Set-CIPPMailboxAccess, Invoke-ExecEditMailboxPermissions and
Invoke-ExecModifyMBPerms each duplicated the permission-level
to EXO cmdlet mapping. Route all three through the existing
Set-CIPPMailboxPermission helper (~230 fewer lines) and add
Pester coverage for the three refactored functions.
Intended behavior changes:
- ExecEditMailboxPermissions drops a redundant Graph id
lookup; the UPN is passed straight to EXO as identity.
- SendOnBehalf now syncs the permission cache, matching
FullAccess/SendAs.
Bulk processing in ExecModifyMBPerms is unchanged.
commit b326768d6b4fe2e78fcce088fd3568d8e4a6d2fc
Author: Bobby <31723128+kris6673@users.noreply.github.com>
Date: Wed Jul 1 22:52:55 2026 +0200
fix(tests): resolve function paths by filename
Existing tests hardcoded module paths that break whenever a
function moves between modules. Resolve the function under
test by filename under Modules/ instead, so tests keep
passing after file moves. Fixes the Intune/Alert/Standards
tests currently failing on dev.
commit 76ec0e274f89f6e2c9efe08c655f12a5c5d5019b
Merge: ea8259f8c 0c524d8db
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 22:45:40 2026 +0200
Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev
commit ea8259f8c0a016db2558f2c88dd67b7c323b8833
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 22:45:38 2026 +0200
add package to exclusions
commit 0c524d8db78b49b17f419b6aadf243620513cb3c
Merge: 9767403bc ee5c30aa1
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 22:30:21 2026 +0200
Feat: Enhance device import status handling and logging (#2111)
Return only 1 line instead of 5 per device.
It's not much more readable. Each device that is added, also is written
to logdata making it a lot easier to find tenants devices were added to.
commit 9767403bc26f1587638958dfc97323d548445f02
Merge: 227a74ebb 390b07534
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 22:26:02 2026 +0200
Escape square brackets in Intune assignment group name matching (#2120)
Resolves KelvinTegelaar/CIPP#6246
## Problem
Intune assignment resolves group and assignment-filter names with
PowerShell's `-like`
operator. `-like` treats `[ ]` as wildcard character-class syntax, so a
literal group
named `[WIN] Company Devices` never matches itself. Deploying an app (or
policy) to such
a group fails with `No matching groups resolved for assignment
request.`, even though the
group exists with that exact name. Bracket-prefixed naming schemes
(`[WIN]`, `[PROD]`,
`[Pilot]`, ...) are common, so this hits real tenants. Other wildcard
metacharacters in a
literal name (`?`, `*`) are affected the same way.
## Fix
Escape only the square brackets in the supplied name (`` `[ `` / `` `]
``) before the `-like`
match, so `[` and `]` are treated as literal characters instead of a
wildcard character-class.
`*` and `?` are left untouched, so the documented wildcard matching (the
assignment UI labels
say "Wildcards (*) are allowed") keeps working exactly as before. Only
the unintended
bracket-as-character-class behaviour is fixed.
The same root cause is present in every Intune assignment group-name
lookup, so all six
group-resolution sites are fixed together rather than only the one path
in the report:
| File | Group lookups fixed |
|---|---|
| `Set-CIPPAssignedApplication.ps1` | include, exclude |
| `Set-CIPPAssignedPolicy.ps1` | include, exclude |
| `Compare-CIPPIntuneAssignments.ps1` | include, exclude |
This covers app deployment (Standards "Deploy Application", the
Chrome-extension standard,
Office-app deploy, the assign-app endpoint), configuration-policy
assignment, and the
assignment drift/comparison reporting, all of which share the predicate.
Assignment-filter name matching (which also uses `-like`) is
deliberately left unchanged:
`Compare-CIPPIntuneAssignments` documents the filter name as supporting
wildcards, so
escaping it would remove a documented feature. Only group-name
resolution, which is matched
against exact names, is made literal here.
## Behaviour note
Wildcards `*` and `?` still work exactly as documented - only `[` and
`]` are escaped. So
`Sales*` keeps matching every Sales group, while a literal `[WIN]
Company Devices` now
resolves to itself instead of being read as the character-class `[WIN]`.
## Verification
Validated by inspection plus a standalone logic harness that reproduces
the resolution
predicate (old vs new) against a realistic group set including
bracketed, parenthesised and
near-collision names. The harness confirms: the bug pre-fix (bracketed
name resolves to
nothing), the fix post-fix (resolves to the correct group only), plain
names still resolve,
comma-separated multi-group input works, and no over-matching across
similar names.
## Related (separate issue)
`Get-CIPPAlertGroupMembershipChange` uses the same `-like` pattern when
matching audit-log
group names against the admin's monitored-group list. Bracketed
monitored group names would
silently never alert. It is intentionally left out of this PR and raised
separately, because
that path may be intended to support wildcard monitoring and the desired
behaviour is a
maintainer decision.
commit 227a74ebb9b5e3c39668a552d65cb61061162d85
Merge: 915355cb9 1e8360719
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 22:24:22 2026 +0200
feat(halo): link CIPP-generated PSA tickets to the affected user (#2051)
## Summary
Today, every CIPP-generated HaloPSA ticket lands on the client's
**General User** contact (`userlookup.id = -1`), regardless of which
end-user the alert is actually about. This PR adds a single integration
toggle that, when enabled, splits per-user alerts into one ticket each
and links them to the matching HaloPSA contact - or falls back cleanly
to the General User when no match exists.
Companion PR for the CIPP frontend: KelvinTegelaar/CIPP equivalent
(linked separately).
- **New integration setting `HaloPSA.LinkTicketsToUsers`** (default off,
no behavioural change for existing installs until opted in).
- **New helper `Get-HaloUser`** that looks up a HaloPSA contact by Azure
Object ID first (via `?advanced_search=` against
`azureoid`/`aaduserid`), falling back to email/UPN against
`emailaddress`/`networklogin`/`aaduserid`. The basic `?search=`
parameter doesn't index the AD-sync fields, so we exact-match via
advanced_search where possible and silently fall back when an instance
doesn't whitelist those filter names. IDs are cast to `[int]` so
PowerShell doesn't serialise them back as `95.0`.
- **Per-user splitter in `Send-CIPPScheduledTaskAlert`** - when the
toggle is on and a scheduled-alert task returns rows containing a
UPN-like field
(`UserPrincipalName`/`userPrincipalName`/`UPN`/`userId`/`Userkey`),
groups by user and emits one PSA call per user with an `AffectedUser`
payload.
- **`AffectedUser` parameter on `Send-CIPPAlert -Type 'psa'`** that
threads through to `New-CippExtAlert` and `New-HaloPSATicket`.
- **Audit-log path** (`Invoke-CippWebhookProcessing`) now extracts the
affected user from `ObjectId`/`UserId`/`Userkey` (and their CIPP-mapped
variants) so role-change, password-reset, sessions-revoked,
MFA-disabled, inbox-rule etc. tickets land on the right contact too.
- **`New-HaloPSATicket`** populates `userlookup.id`, `user_name` and
`site_id` from the matched contact when found, and casts `client_id` to
`[int]` so storage-resident IDs (which are stored as strings) don't
break Halo's payload validation.
- **Unmatched users** keep today's General User behaviour but get an
italic notice appended to the description and a Warning logged for
follow-up.
- **Recovery from note-add failures** in the consolidation path: when
adding a note to an existing ticket fails (permission on the configured
outcome, ticket type mismatch, etc.) the function now falls through to
creating a new ticket so the alert isn't silently lost.
- **Diagnostics** in the PSA branch of `Send-CIPPAlert`: explicit "PSA
delivery skipped" message when `sendtoIntegration` is off, plus surfaces
the result string from the Halo call.
commit 915355cb977ad97350507fe82b616b9756e5d192
Author: John Duprey <jwd@johnwduprey.com>
Date: Wed Jul 1 13:12:37 2026 -0400
feat: move edituser to reusable set-cippuser function
add scheduling capability in API
add pester test
commit 7227962fede36bd8ed16d691df84d396163a1c4e
Author: John Duprey <jwd@johnwduprey.com>
Date: Wed Jul 1 12:29:14 2026 -0400
fix: update sherweb functions to support API client callers
commit 7a69da158b7e802562fa9a17afc4e29648d5d383
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 23:42:03 2026 +0800
Harden app template creation to check app type
commit 5d29976356c421815e064f9abbc8efe7bbcdbd6a
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 22:45:14 2026 +0800
Role lookup fixes
commit 8ff71da63dd808e38fdb020aad625253f7a19eb3
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 22:44:56 2026 +0800
ACSC Essential Eight Test Suite
commit a973ec62c08346a2b3ccc1ddb806cdaca47204c9
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 21:44:30 2026 +0800
Dep bump
commit aae566d72488dfe59e277b261c9885fa764ecfde
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 14:46:11 2026 +0200
add executingUser
commit 614949f2ce1c020a825f782773209787852dcd5b
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 19:13:01 2026 +0800
Update payload for log collection endpoint
commit 390b07534b89c2fa91a69c784aa6fe69a430a315
Author: MatStocks <20848373+matstocks@users.noreply.github.com>
Date: Wed Jul 1 00:12:08 2026 +0100
Escape square brackets in Intune assignment group name matching
Group display names are matched with -like, which treats square brackets as
a wildcard character class, so a literal group such as [WIN] Company Devices
never matched itself and assignment failed with No matching groups resolved.
Escape only [ and ] before the match so bracketed names resolve literally,
while * and ? wildcards (documented in the assignment UI, 'Wildcards (*) are
allowed') keep working. Applied to the six group-resolution sites in
Set-CIPPAssignedApplication, Set-CIPPAssignedPolicy and
Compare-CIPPIntuneAssignments (include and exclude). Filter-name matching is
unchanged.
Resolves KelvinTegelaar/CIPP#6246
commit 7fa8c1d3c990375c172c3f9b207431bfb74fe9a5
Merge: c4c0d3f1a 67fdcd25d
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 12:27:40 2026 +0200
Fix: Implement clearable fields in user edit (#2119)
Introduce functionality to allow specific user profile fields to be
cleared when editing a user. Currently the property is just quietly
dropped with a success message.
Frontend PR: https://github.com/KelvinTegelaar/CIPP/pull/6261
commit c4c0d3f1ad5517b98f8fadd6252038cbe60537d5
Merge: a79be1cab 4fb1aded1
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 12:24:27 2026 +0200
Feat: Return SMTP client authentication state in mailbox details (#2097)
Add the SMTP client authentication state to the mailbox details
response, enhancing the information available for mailbox configuration.
Frontend: https://github.com/KelvinTegelaar/CIPP/pull/6180
commit a79be1cabe82e646d71d9eddf90612b21d482a21
Merge: f06ad2fbb f18525b6b
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Wed Jul 1 12:23:54 2026 +0200
feat: configure auth method sub-settings (#2110)
Frontend PR: https://github.com/KelvinTegelaar/CIPP/pull/6238
The `SetAuthMethod` endpoint only toggled state and group targeting, so
every method-specific option was unreachable from the portal. This
forwards those settings through `Invoke-SetAuthMethod` and applies them
in `Set-CIPPAuthenticationPolicy`.
**Added/exposed settings**
- TAP: `isUsableOnce`, min/max/default lifetime, default length
- Microsoft Authenticator: software OATH + display-app-info /
display-location / companion-app feature states
- Email OTP: external-ID state, exclude groups (empty list now
explicitly clears `excludeTargets`)
- QR Code PIN: lifetime + PIN length
- FIDO2: `isAttestationEnforced` + `isSelfServiceRegistrationAllowed`
(were hardcoded on enable)
- Voice: `isOfficePhoneAllowed`
- SMS: `isUsableForSignIn` (stamped onto each include-target)
Log messages now spell out the changed values per method.
**Tests:** adds `Tests/Private/Set-CIPPAuthenticationPolicy.Tests.ps1`
(7 cases) — `Invoke-Pester -Path
./Tests/Private/Set-CIPPAuthenticationPolicy.Tests.ps1`.
commit f06ad2fbbb36ab0ddfb3657c187c361df9ff2c4b
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 17:32:00 2026 +0800
Table Read Retry
commit e164701291884fa5f154305385cfb27ce2415d6b
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 17:05:40 2026 +0800
Bump AzBobbyTables version
commit 103078a4210304204077e2cbf577087599a095cd
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 15:40:33 2026 +0800
JSON escaping fixes for intune policies
commit 9cf8a3c674e72204b40b9056ca42dfc74da9e0c6
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 15:33:56 2026 +0800
Reduce Verbose nop logging
commit 52ce1759413b411f500df829abca2b5cf2bf5080
Author: John Duprey <jwd@johnwduprey.com>
Date: Tue Jun 30 21:34:01 2026 -0400
fix: exclude imAddresses from user backup/restore
commit d17b33f46405056fcd5a8cbd42a6d8b01e18bc33
Author: John Duprey <jwd@johnwduprey.com>
Date: Tue Jun 30 21:11:31 2026 -0400
fix: add system32,osdrive
commit 259770d93654ec76cb3d1ae6b44750ea3d9b0ca5
Author: John Duprey <jwd@johnwduprey.com>
Date: Tue Jun 30 18:37:32 2026 -0400
fix: revert rerun protection on scheduled tasks
commit a0b263cd30d3a08e21f60eab384c9c778acc3e91
Author: John Duprey <jwd@johnwduprey.com>
Date: Tue Jun 30 17:56:44 2026 -0400
chore: update version to 10.5.6
commit 67fdcd25d5177327d68b6861a764c775581a0021
Author: Bobby <31723128+kris6673@users.noreply.github.com>
Date: Tue Jun 30 23:31:08 2026 +0200
feat: implement clearable fields in user edit API
commit f965afebf7fc6556a46f3ff62d3e81515bbb7745
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 22:39:47 2026 +0200
Implements #6214
commit 25b4110029b2ea57d5140c80494052aa58dc56a0
Merge: e8014647d 4998ffe39
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 22:18:42 2026 +0200
Feat: CVE exception management page and NinjaOne CVE sync (#2080)
Updated to write to and read from cetralised CIPP database
commit e8014647d49492eac26b26d72759f9fe034bfb51
Merge: 028822779 f44ff88ad
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 21:36:38 2026 +0200
Feat: Add allTenants support for shared mailbox enabled report (#2103)
Frontend PR: https://github.com/KelvinTegelaar/CIPP/pull/6206
commit 02882277923e5cb7a54aa7e62b5f50dd853303b3
Merge: 5994a4402 05096dcf6
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 21:34:32 2026 +0200
Feat: Support room calendar processing options and default permissions (#2104)
Frontend PR: https://github.com/KelvinTegelaar/CIPP/pull/6207
commit 5994a440211f279104d1734f2972353c85c45f97
Merge: 24e7a0676 68595ccdf
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 21:30:46 2026 +0200
Feat: Add incident severity and resolving comments (#2109)
Overhaul of the rather interesting way to construct a JSON payload and
add in severity and resolving comment functionality.
Frontend PR: https://github.com/KelvinTegelaar/CIPP/pull/6234
commit 24e7a067663ea1fabf61346fd302c1ed05053c82
Merge: a3c752df2 9a88ec07e
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 21:03:41 2026 +0200
Feat: Add Intune group assignment enhancements (#2115)
Introduce support for ExcludeGroupIds and ExcludeGroupNames in
assignment functions.
Frontend PR: https://github.com/KelvinTegelaar/CIPP/pull/6244
commit a3c752df25d979f21b69628e92ab3ecf7a1aa248
Merge: 3198c7750 42087aefc
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 21:03:15 2026 +0200
feat: Add message trace retrieval to Push-BECRun function (#2098)
This pull request enhances the `Push-BECRun` PowerShell function by
adding the retrieval and logging of sent message traces for a user, and
includes this data in the output object. These changes improve the
auditing and incident response capabilities of the function by providing
more comprehensive information about user activity.
**Enhancements to auditing and user activity tracking:**
* Added retrieval of sent message traces using the `Get-MessageTraceV2`
cmdlet, with error handling and logging in case of failures. The trace
includes message details such as status, subject, recipient, received
time, and sender IP.
* Included the collected sent message trace data as a new property
(`SentMessages`) in the output object returned by the function.
commit 3198c77501bc5c5f50ffe9c2a7ae56f6c21b8fef
Merge: 36fd9c019 03ae94ec9
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 20:59:54 2026 +0200
Enrich generated openapi.json with typed responses and operationIds (#2112)
## What
Adds a deterministic post-processing stage that enriches the generated
`openapi.json` with typed `200` response schemas and a unique
`operationId` per operation, and publishes the result as a Release
asset. It does **not** replace the existing generator; it runs on its
output.
## Why
The generated spec types request bodies but leaves every `200` response
as the generic `StandardResults` envelope, and carries no `operationId`
on any operation. Two practical consequences:
- OpenAPI importers that key on `operationId` skip every operation.
Tested against a real importer: the unmodified spec imported as **0**
actions; with `operationId` injected it imports as **all 582**.
- Downstream tools get no typed output fields to map against.
## How
A PowerShell stage (`.build/Add-OpenApiResponseSchemas.ps1`) with two
passes, both pure functions of checked-in sources (no live API calls,
byte-identical output across runs):
- **operationId**: bare endpoint name per operation; method-prefixed
only where one path carries multiple methods (e.g. `GetExecCSPLicense` /
`PostExecCSPLicense`). Existing `operationId`s are preserved; any
collision is a hard failure.
- **typed 200 responses**: derived from the frontend shape baselines
(`Tests/Shapes/*.json`) and page `simpleColumns` declarations. The `{
Results, Metadata }` envelope is preserved exactly as the API returns it
(no flattening, so the schema stays truthful to the wire).
Endpoints with no typed source keep `StandardResults`, which is correct
for write/exec operations.
## Publishing + CI
- `openapi-enriched-release.yml` builds and uploads
`openapi.enriched.json` as an asset on each GitHub Release (no commits
back to the tree).
- `openapi-enriched-check.yml` runs the test suite and **strictly lints
the enriched spec** against a committed ignore-baseline
(`.redocly.lint-ignore.yaml`) that pins pre-existing findings, so any
*new* finding fails CI.
- `.github/workflows/` is gitignored in this repo (the existing
workflows are force-added), so these two were added with `git add -f`,
matching the repo convention.
## Tests
50 Pester tests + PSScriptAnalyzer (0 findings), run via
`Tests/Build/Invoke-BuildTests.ps1`. Covers operationId rules
(bare/disambiguated/preserve/collision-throws), response typing,
idempotency, and the frontend-scan edge cases.
## Known limitations (documented in `.build/README.md`)
- Only `get/post/put/patch/delete` are processed (the spec has no other
methods today).
- Paths are assumed to start with `/api/` (all current paths do).
- A typed `200` replaces the existing `200.content` (today only
`StandardResults` exists there).
- Conditional/ternary `simpleColumns` expressions are intentionally not
parsed (a conservative miss is preferred over capturing non-column
strings).
## Side benefit
Injecting `operationId` also removes the `operation-operationId` lint
warning that previously applied to every operation in the spec.
## CI activation note
Both workflows are guarded with `if: github.repository_owner ==
'KelvinTegelaar'`, matching the convention of the existing workflows in
this repo (forks do not run them). As a result they will **not** appear
as status checks on this PR from the fork; they activate once merged
into the upstream tree. Verification was therefore done locally before
opening this PR:
- `Tests/Build/Invoke-BuildTests.ps1`: 50 Pester tests passing,
PSScriptAnalyzer 0 findings
- strict Redocly lint of the generated `openapi.enriched.json`: 0
errors, 0 warnings, 5 pre-existing findings ignored via the committed
baseline; verified to fail on an injected new finding
- both workflow YAML files parse clean
- enrichment is deterministic: same inputs produce byte-identical output
across runs
commit 36fd9c0199d041f902c51584e1b581d351f385af
Merge: c6c50d781 6205e97c2
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 20:59:30 2026 +0200
Fix: Modernize GDAP relationship termination logging (#2117)
Improve logging and error handling in the GDAP relationship termination
function
commit c6c50d78182d598163c1d12e41a011131bd2eb05
Merge: eec5f69ca d52ec9b1a
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 20:58:18 2026 +0200
Resolve tenant variables in Win32 Custom App detection script (#2116)
# Resolve tenant variables in the Win32 Custom App detection script
Fixes KelvinTegelaar/CIPP#6226.
`%tenantid%` and the other `Get-CIPPTextReplacement` tokens resolve in a
Win32 Custom Application's install and uninstall scripts, but not in the
detection script, which reaches Intune with the literal `%tenantid%`
string.
In `Add-CIPPW32ScriptApplication.ps1` the install and uninstall scripts
are passed through `Get-CIPPTextReplacement` before being
base64-encoded, but the detection script was encoded from the raw
`$Properties.detectionScript`. This change runs the detection script
through `Get-CIPPTextReplacement` first, the same way as the install and
uninstall scripts directly below it.
Verified against the real `Get-CIPPTextReplacement` with mocked tenant
lookups: before the change the detection script keeps the literal
`%tenantid%`; after, it resolves to the tenant's customerId and matches
what the install script produces. Other tokens such as `%tenantfilter%`
resolve too.
commit eec5f69ca7e2da25d0902681815d7d7055e02b41
Merge: 29e8e6cc4 dae979bb5
Author: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Date: Tue Jun 30 20:57:40 2026 +0200
Fix Check extension alerts repeating on every run (watermark never advanced) (#2114)
## What
The "Check" add-in's alerts are re-sent on every scheduled run - each
run dumps the whole recent backlog to the configured webhook instead of
only new alerts. Reported in #6216 (e.g. 13 test alerts resulted in 13
entries on every run).
## Cause
`Get-CIPPAlertCheckExtension` reads a per-tenant watermark from the
`AlertLastRun` table (`PartitionKey 'AlertLastRun'`, `RowKey
"<tenant>-Get-CIPPAlertCheckExtension"`) so it only fetches alerts newer
than the previous run - but it never writes that watermark back. As a
result `$Since` always falls back to the default 24-hour window, so
every run re-fetches and re-sends the same alerts (and the
day-partitioned de-dupe in `Write-AlertTrace` resets at midnight, which
lines up with the reported timing jumps).
## Fix
Capture the run start, read/store an explicit `LastRunTime` watermark
(falling back to the existing `Timestamp` for backward compatibility),
and upsert the `AlertLastRun` row after processing. Each run now only
sends alerts created since the previous run.
## Testing
- PowerShell parses clean.
- A mock-storage harness confirms the behaviour: run 1 sends the
backlog, run 2 (no new alerts) sends nothing, run 3 sends only a
newly-added alert.
Fixes KelvinTegelaar/CIPP#6216
commit 29e8e6cc46b881853f8f2ff56665b37fd98c1369
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 02:22:31 2026 +0800
Fixes for standards where deployment errors were hidden
If a CA failed to be deployed because of a missing X or another issue these were not surfaced to the user and in tern drift/standards alignment indicated the policy as aligned even though nothing was deployed. Also adds some future helpers that might be of use later
commit 3c919651ec9326ad9e9c7c29a46021e80011576c
Author: James Tarran <jtarran@techary.com>
Date: Tue Jun 30 18:53:49 2026 +0100
Adds a read-only endpoint that surfaces the currently-active fired alert items for a tenant, so the frontend can display live alert instances (not just configured rules or snoozed items). Backs the new Alerts card on the dashboard.
Adds a read-only endpoint that surfaces the currently-active fired alert items for a tenant, so the frontend can display live alert instances (not just configured rules or snoozed items). Backs the new Alerts card on the dashboard.
commit fc8756f1235e07ac72926d88213ee6df32c98b1c
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 01:37:22 2026 +0800
User Offboarding default settings fix
commit 7c0da88b49c4bf87aed315f4f71ab05c78058f60
Author: John Duprey <jwd@johnwduprey.com>
Date: Tue Jun 30 12:21:59 2026 -0400
feat: add featureflags to stats timer
commit 0dcb4fb1515b2f3e40e9081a6ad6e8d747a0104b
Author: John Duprey <jwd@johnwduprey.com>
Date: Tue Jun 30 12:21:44 2026 -0400
fix: hudu sync
- replace arraylist with generic list
- skip sync on archived companies
commit e77de9803ec68a12a52e796eb3dd2b8db3e2789b
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Wed Jul 1 00:04:20 2026 +0800
CIPP Rogue App List
commit 25445c637b8866ea6165dfe6d9a3ca67fd7b4e3c
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Tue Jun 30 23:20:30 2026 +0800
Update Oauth standards with conflict information
commit c5a732ddf7f50ab819145f1b2f2cd0c2bd467c5c
Author: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Tue Jun 30 22:53:32 2026 +0800
Update Invoke-AddSpamFilter.ps1
commit e718903dc2ef78f26ad889b5a741e551c3f4aa91
Author: John Dupre…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.