Add SAMCertProvisionAttempted guard to break recursion when Update-CIPPSAMCertificate calls Get-GraphToken, which re-enters Get-CIPPAuthentication before the cert env var is set.

Also short-circuit Key Vault retry loop on 404 responses since the secret is definitively absent and retrying with backoff only adds latency.

Parse app template config JSON with `-AsHashtable` before converting it back to a PSCustomObject so templates can carry both `applicationName` and `ApplicationName` without losing data. This avoids deployment issues caused by PowerShell's default case-insensitive JSON object handling.

Replace `Compare-Object` checks with sorted string equality for Teams federation allowed/blocked domain matching. This prevents parameter binding failures when one side is an empty array while preserving exact list-match behavior.

- Replace silent Write-Information bulk error messages with structured Write-LogMessage calls including normalized error details and batch counts
- Handle duplicate document templates gracefully by selecting the oldest instead of throwing
- Clear stale user/update cache entries from Azure Table Storage at sync start rather than reusing potentially stale data
- Remove debug Write-Host from document template creation

Update role permission filtering to compare normalized permission bases instead of exact strings. The code now strips `.Read`/`.ReadWrite` suffixes and uses a case-insensitive hash set of valid permissions, preventing legitimate role permissions from being incorrectly filtered out when access level suffixes differ.

Update NinjaOne tenant sync to resolve the SharePoint Admin URL via `Get-SharePointAdminLink` and gracefully fall back to a tenant-derived `https://<tenant>-admin.sharepoint.com` URL if lookup fails. The SharePoint management link now uses the resolved admin URL instead of the partner session redirect, improving reliability for tenant link mapping.

Update the NinjaOne tenant sync CVE upload path to call `New-VulnCsvBytes` with only the supported parameters. This aligns the invocation with the helper signature and avoids passing an unused `TenantFilter` argument during vulnerability CSV generation.

Added the `i` flag to the Conventional Commits regex so PR titles with uppercase type prefixes (e.g., `Fix:`, `FEAT:`) are also accepted.

Include Intune managed app protection policies in the policy listing endpoint and map them to the compare endpoint. The list output now classifies iOS, Android, and Windows app protection policies so they appear with clearer policy type names.

Tightens app role existence checks in `Add-CIPPApplicationPermission` to match both `appRoleId` and `resourceId` instead of only role ID. This prevents skipping valid role assignments when the same role ID appears across different service principals.

… dev