[pull] master from KelvinTegelaar:master - #59
Open
pull[bot] wants to merge 477 commits into
Open
Conversation
This pull request enhances the `Push-BECRun` PowerShell function by adding the retrieval and logging of sent message traces for a user, and includes this data in the output object. These changes improve the auditing and incident response capabilities of the function by providing more comprehensive information about user activity. **Enhancements to auditing and user activity tracking:** * Added retrieval of sent message traces using the `Get-MessageTraceV2` cmdlet, with error handling and logging in case of failures. The trace includes message details such as status, subject, recipient, received time, and sender IP. * Included the collected sent message trace data as a new property (`SentMessages`) in the output object returned by the function.
Introduce support for ExcludeGroupIds and ExcludeGroupNames in assignment functions. Frontend PR: KelvinTegelaar/CIPP#6244
Overhaul of the rather interesting way to construct a JSON payload and add in severity and resolving comment functionality. Frontend PR: KelvinTegelaar/CIPP#6234
Updated to write to and read from cetralised CIPP database
Frontend PR: KelvinTegelaar/CIPP#6238 The `SetAuthMethod` endpoint only toggled state and group targeting, so every method-specific option was unreachable from the portal. This forwards those settings through `Invoke-SetAuthMethod` and applies them in `Set-CIPPAuthenticationPolicy`. **Added/exposed settings** - TAP: `isUsableOnce`, min/max/default lifetime, default length - Microsoft Authenticator: software OATH + display-app-info / display-location / companion-app feature states - Email OTP: external-ID state, exclude groups (empty list now explicitly clears `excludeTargets`) - QR Code PIN: lifetime + PIN length - FIDO2: `isAttestationEnforced` + `isSelfServiceRegistrationAllowed` (were hardcoded on enable) - Voice: `isOfficePhoneAllowed` - SMS: `isUsableForSignIn` (stamped onto each include-target) Log messages now spell out the changed values per method. **Tests:** adds `Tests/Private/Set-CIPPAuthenticationPolicy.Tests.ps1` (7 cases) — `Invoke-Pester -Path ./Tests/Private/Set-CIPPAuthenticationPolicy.Tests.ps1`.
Add the SMTP client authentication state to the mailbox details response, enhancing the information available for mailbox configuration. Frontend: KelvinTegelaar/CIPP#6180
Introduce functionality to allow specific user profile fields to be cleared when editing a user. Currently the property is just quietly dropped with a success message. Frontend PR: KelvinTegelaar/CIPP#6261
Group display names are matched with -like, which treats square brackets as a wildcard character class, so a literal group such as [WIN] Company Devices never matched itself and assignment failed with No matching groups resolved. Escape only [ and ] before the match so bracketed names resolve literally, while * and ? wildcards (documented in the assignment UI, 'Wildcards (*) are allowed') keep working. Applied to the six group-resolution sites in Set-CIPPAssignedApplication, Set-CIPPAssignedPolicy and Compare-CIPPIntuneAssignments (include and exclude). Filter-name matching is unchanged. Resolves KelvinTegelaar/CIPP#6246
add scheduling capability in API add pester test
## Summary Today, every CIPP-generated HaloPSA ticket lands on the client's **General User** contact (`userlookup.id = -1`), regardless of which end-user the alert is actually about. This PR adds a single integration toggle that, when enabled, splits per-user alerts into one ticket each and links them to the matching HaloPSA contact - or falls back cleanly to the General User when no match exists. Companion PR for the CIPP frontend: KelvinTegelaar/CIPP equivalent (linked separately). - **New integration setting `HaloPSA.LinkTicketsToUsers`** (default off, no behavioural change for existing installs until opted in). - **New helper `Get-HaloUser`** that looks up a HaloPSA contact by Azure Object ID first (via `?advanced_search=` against `azureoid`/`aaduserid`), falling back to email/UPN against `emailaddress`/`networklogin`/`aaduserid`. The basic `?search=` parameter doesn't index the AD-sync fields, so we exact-match via advanced_search where possible and silently fall back when an instance doesn't whitelist those filter names. IDs are cast to `[int]` so PowerShell doesn't serialise them back as `95.0`. - **Per-user splitter in `Send-CIPPScheduledTaskAlert`** - when the toggle is on and a scheduled-alert task returns rows containing a UPN-like field (`UserPrincipalName`/`userPrincipalName`/`UPN`/`userId`/`Userkey`), groups by user and emits one PSA call per user with an `AffectedUser` payload. - **`AffectedUser` parameter on `Send-CIPPAlert -Type 'psa'`** that threads through to `New-CippExtAlert` and `New-HaloPSATicket`. - **Audit-log path** (`Invoke-CippWebhookProcessing`) now extracts the affected user from `ObjectId`/`UserId`/`Userkey` (and their CIPP-mapped variants) so role-change, password-reset, sessions-revoked, MFA-disabled, inbox-rule etc. tickets land on the right contact too. - **`New-HaloPSATicket`** populates `userlookup.id`, `user_name` and `site_id` from the matched contact when found, and casts `client_id` to `[int]` so storage-resident IDs (which are stored as strings) don't break Halo's payload validation. - **Unmatched users** keep today's General User behaviour but get an italic notice appended to the description and a Warning logged for follow-up. - **Recovery from note-add failures** in the consolidation path: when adding a note to an existing ticket fails (permission on the configured outcome, ticket type mismatch, etc.) the function now falls through to creating a new ticket so the alert isn't silently lost. - **Diagnostics** in the PSA branch of `Send-CIPPAlert`: explicit "PSA delivery skipped" message when `sendtoIntegration` is off, plus surfaces the result string from the Halo call.
Resolves KelvinTegelaar/CIPP#6246 ## Problem Intune assignment resolves group and assignment-filter names with PowerShell's `-like` operator. `-like` treats `[ ]` as wildcard character-class syntax, so a literal group named `[WIN] Company Devices` never matches itself. Deploying an app (or policy) to such a group fails with `No matching groups resolved for assignment request.`, even though the group exists with that exact name. Bracket-prefixed naming schemes (`[WIN]`, `[PROD]`, `[Pilot]`, ...) are common, so this hits real tenants. Other wildcard metacharacters in a literal name (`?`, `*`) are affected the same way. ## Fix Escape only the square brackets in the supplied name (`` `[ `` / `` `] ``) before the `-like` match, so `[` and `]` are treated as literal characters instead of a wildcard character-class. `*` and `?` are left untouched, so the documented wildcard matching (the assignment UI labels say "Wildcards (*) are allowed") keeps working exactly as before. Only the unintended bracket-as-character-class behaviour is fixed. The same root cause is present in every Intune assignment group-name lookup, so all six group-resolution sites are fixed together rather than only the one path in the report: | File | Group lookups fixed | |---|---| | `Set-CIPPAssignedApplication.ps1` | include, exclude | | `Set-CIPPAssignedPolicy.ps1` | include, exclude | | `Compare-CIPPIntuneAssignments.ps1` | include, exclude | This covers app deployment (Standards "Deploy Application", the Chrome-extension standard, Office-app deploy, the assign-app endpoint), configuration-policy assignment, and the assignment drift/comparison reporting, all of which share the predicate. Assignment-filter name matching (which also uses `-like`) is deliberately left unchanged: `Compare-CIPPIntuneAssignments` documents the filter name as supporting wildcards, so escaping it would remove a documented feature. Only group-name resolution, which is matched against exact names, is made literal here. ## Behaviour note Wildcards `*` and `?` still work exactly as documented - only `[` and `]` are escaped. So `Sales*` keeps matching every Sales group, while a literal `[WIN] Company Devices` now resolves to itself instead of being read as the character-class `[WIN]`. ## Verification Validated by inspection plus a standalone logic harness that reproduces the resolution predicate (old vs new) against a realistic group set including bracketed, parenthesised and near-collision names. The harness confirms: the bug pre-fix (bracketed name resolves to nothing), the fix post-fix (resolves to the correct group only), plain names still resolve, comma-separated multi-group input works, and no over-matching across similar names. ## Related (separate issue) `Get-CIPPAlertGroupMembershipChange` uses the same `-like` pattern when matching audit-log group names against the admin's monitored-group list. Bracketed monitored group names would silently never alert. It is intentionally left out of this PR and raised separately, because that path may be intended to support wildcard monitoring and the desired behaviour is a maintainer decision.
…llowlists The allowlist of special includeUsers/excludeUsers values spelled the Graph value as 'GuestOrExternalUsers' (singular), but Microsoft's real value is 'GuestsOrExternalUsers' (plural). In New-CIPPCAPolicy the misspelled value fell through to the display-name lookup, found no matching user, and was silently dropped - producing an empty includeUsers array that Graph rejects on deploy. Also corrects the same spelling in the New-CIPPCATemplate ID-to-name maps (benign fallthrough there, fixed for consistency), and logs a warning naming any user value that fails to resolve instead of dropping it silently.
… them Eleven standards wrapped their remediation calls in try/catch with an empty catch block, so any failure from Set-CIPPAuthenticationPolicy (which throws on error) was silently discarded and the standard appeared to succeed.
…/assignments App Protection / managed-app policies reported NON-COMPLIANT on every drift run regardless of settings: templates are stored with apps[], deployment strips apps (Set-CIPPIntunePolicy), and the policy read-back never returns apps, assignments, or a matching deployedAppCount (Get-CIPPIntunePolicy has no $expand), so the generic deep-compare always flagged them. - Exclude 'assignments' globally: read-back never includes assignments for any policy type, and assignment verification has its own dedicated path (Compare-CIPPIntuneAssignments via verifyAssignments). - Exclude 'apps' and 'deployedAppCount' only for CompareType 'AppProtection' (what the Standards/drift engine passes), because Device configs carry legitimate nested 'apps' arrays (e.g. kiosk profiles) that must keep being compared. - '@odata.context' already skipped by the existing *@OData* wildcard.
Templates synced from a gold tenant fetch App Protection policies via
their concrete type URL (e.g. androidManagedAppProtections('id')), and
Graph omits @odata.type from those responses. The stored RAWJson then
lacks @odata.type, so Set-CIPPIntunePolicy built the deploy URL as
deviceAppManagement/s and Graph returned "Resource not found for the
segment 's'.". Re-add @odata.type from the known ODataType when Graph
omits it, and fail with a clear error on deploy when a stored template
still has no @odata.type.
Two defects allowed Invoke-SherwebMigration scheduled tasks to keep firing daily (sending alerts and performing real Sherweb purchases and Pax8 subscription cancellations) after the Sherweb migration was disabled: - Invoke-SherwebMigration had no enabled-guard: it read the Sherweb extension config but never checked Enabled before acting. It now returns immediately unless the Sherweb config exists and Enabled is true, which neutralizes any stale scheduled task. - Register-CIPPExtensionScheduledTasks created migration tasks in the enable branch, but the disable cleanup only filtered Push-CippExtensionData tasks, so migration tasks were never removed. Migration tasks are now queried at function scope, removed when the Sherweb extension is disabled, and removed when a tenant is no longer Sherweb-mapped.
…ve licensed users alert The alert already fetched assignedLicenses and accountEnabled from Graph but dropped them from the emitted alert data. Surface license display names, raw SKU IDs, account enablement and days since last sign-in so the alert can be actioned without a follow-up lookup.
…isfy its own check The remediation enabled the MicrosoftAuthenticator method but never passed the feature settings the compliance check grades against, so the standard could never converge: displayAppInformationRequiredState was checked but not set, and numberMatchingRequiredState was checked even though Set-CIPPAuthenticationPolicy deliberately strips it from the PATCH body (Microsoft now enforces number matching and the setting can no longer be toggled). The empty catch around the remediation call also swallowed every error, leaving no signal in the logs. - Pass -MicrosoftAuthenticatorDisplayAppInfo 'enabled' in the remediation so the PATCH sets what the check grades - Drop numberMatchingRequiredState from the check and the report comparison, matching Microsoft's enforced-by-default behavior - Replace the empty catch with Get-CippException + Write-LogMessage error logging, matching the idiom in Invoke-CIPPStandardAuthenticationMethods
Update New-CIPPCATemplate to use the correct special value `GuestsOrExternalUsers` when processing include/exclude users and groups. This fixes a typo that could cause the selector to be treated like a normal ID instead of being preserved.
Update request parsing to support both PSCustomObject and IDictionary shapes from Azure Functions deserialization. `Get-CippMcpToolResult` now correctly flattens MCP arguments and clones headers when they are dictionaries, preventing lost params/headers (including EasyAuth context). `Invoke-ListMailboxes` now reads query parameter names from dictionary keys, so allowed mailbox filters are applied reliably.
… sending null
Untoggled "switch" inputs are omitted from a standard's settings, so
TeamsGlobalMeetingPolicy, TeamsExternalFileSharing, and
TeamsFederationConfiguration serialized null booleans to the Teams
ConfigApi, which rejects the write with 400 "Error converting value
{null} to type 'System.Boolean'". The null also poisoned the
$StateIsCorrect comparison ($CurrentState.X -eq $null is never true),
so affected tenants reported non-compliant and failed remediation on
every run.
Coalesce each switch to $false (the CIS recommended value, matching the
convention in TeamsExternalAccessPolicy/TeamsGuestAccess/
TeamsEmailIntegration) and use the coalesced variable in the state
comparison, remediation payload, and report expected values. In
TeamsExternalFileSharing the existing "?? $false" was dead code because
-eq binds tighter than ??.
Replace the null-check wrapper with a direct null filter when building `ComparisonResults`. This ensures the endpoint always returns an array containing only valid comparison entries, avoiding accidental null items in the response.
Add `Sync-CippContainerUpdateState` and use it in both timer and container management endpoints so stale "update available" results are corrected after a restart. The update-check flow now also captures and preserves `RemoteBuildDate` and `CheckedTag`, and the settings/status response includes build-date metadata for both running and remote images.
Ensure container image build timestamps are converted from PowerShell DateTime values into UTC ISO 8601 strings before they are returned or stored. This avoids ambiguous unspecified kinds and keeps timer-driven update checks and container management responses consistent.
Resolve container update settings through the shared sync path so never-saved fields default to auto-restart on, hourly checks, and 23:00 while still respecting explicit disabled or empty values. Also tighten status reconciliation after restarts and fix check-time validation/formatting so early UTC hours are accepted correctly.
Refactors the SSO migration checks in `Test-CIPPAccess` to use explicit permission flags. This keeps the forced migration prompt limited to users who can manage app settings and skips migration lookups for users with no assigned permissions.
Add a shared Autopilot profile name validator and use it in both the HTTP endpoint and default deployment profile flow. This catches unsupported Intune characters before submission so the API returns a clear bad request or logged error instead of an opaque service-side 500.
Add `Resolve-CIPPDlpAdvancedRule` and apply it across template capture, policy deploy, and drift comparison so DLP rules keep either `AdvancedRule` or flat condition fields, never both. Update DLP rule field metadata to expose `RuleConditions` and include `AdvancedRule`, then normalize advanced-rule JSON during comparison to avoid false drift from formatting or key-order differences.
… missing" This reverts commit 24db2c5.
Update sync-legacy-backend-repository.yml Synced from CyberDrain/CIPP@041e447
Dev to hf Synced from CyberDrain/CIPP@7d7036e
chore: bump version to 10.7.2 Synced from CyberDrain/CIPP@5b38b39
fix: Dev to hotfix Synced from CyberDrain/CIPP@6e9f3e5
Dev to hf Synced from CyberDrain/CIPP@3e2ca0a
Dev to docs update and clean branch Synced from CyberDrain/CIPP@f15aa84
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )