[pull] dev from KelvinTegelaar:dev - #133
Open
pull[bot] wants to merge 7801 commits into
Open
Conversation
…ist for setting CPV permissions
…ist for setting CPV permissions
# Conflicts: # Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1
Added extra properties Improved efficiency of adding exception items Signed-off-by: DamienMatthys <damien@pcunplug.com>
Added extra properties Improved efficiency of adding exception items Signed-off-by: DamienMatthys <damien@pcunplug.com>
Enabled syncing with no CVEs in case they have all been cleaned up Signed-off-by: DamienMatthys <damien@pcunplug.com>
## Problem The BEC investigation only lists inbox rules that **still exist** on the mailbox (`Get-InboxRule`). Attackers commonly create a rule, use it, and then delete it to cover their tracks — those rules were completely invisible in the report. Separately, when the unified audit log search failed or timed out, the exception killed the **entire** BEC run instead of producing a partial report. ## Changes - **New `InboxRuleChanges` field**: a user-scoped `Search-UnifiedAuditLog` for `New-InboxRule`, `Set-InboxRule`, `Remove-InboxRule` and `UpdateInboxRules` events over the last 7 days, so created/changed/deleted rules show up even if they no longer exist. - **`RecentlyChanged` flag on existing rules**: rules returned by `Get-InboxRule` are flagged when their name matches a 7-day audit event. (Inbox rules carry no timestamps, so name-matching is the best available signal; Outlook-client `UpdateInboxRules` events carry no rule name and stay unflagged.) - **Resilience**: the tenant-wide audit search is wrapped in try/catch — on failure it logs a warning and degrades to partial results instead of failing the whole run. `Get-InboxRule` failures now log via `Write-LogMessage` (the old `Write-Host` string concat was broken). - **Trimmed the tenant-wide search**: dropped `MailboxLogin`/`UserLoggedIn` operations — nothing downstream consumed them (`$PermissionsLog` filters to permission ops only) and sign-in events are high-volume, bloating the search. - Error-path result now includes `ExtractedAt` so the frontend gets a timestamp even on failure. ## Companion PR Frontend PR (displays `InboxRuleChanges` + `RecentlyChanged` in the BEC page and PDF report): KelvinTegelaar/CIPP#6281 This PR is safe to merge on its own — it only adds fields to the BEC result. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
…moval on offboarding (#2129) - Fixes KelvinTegelaar/CIPP#6280 - Remove users from mail-enabled security groups during license removal on offboarding
…ng valid standards
Minimising tasks Signed-off-by: DamienMatthys <damien@pcunplug.com>
Minimising tasks Signed-off-by: DamienMatthys <damien@pcunplug.com>
- Ability to add secrets - Ability to edit URI's - Ability to edit audience - Added 'rotate' secret workflow (delete and recreate with the same name)
Remove un-needed comments
…uring cache collection
Update tenant onboarding and access validation to treat direct tenants separately from GDAP tenants. The backend now records direct-tenant service account metadata, blocks in-place GDAP→Direct conversion, cleans up stored direct refresh tokens when conversion is refused, and evaluates direct-tenant permissions from the authenticated service account (including Global Admin handling). Frontend settings pages were updated to show tenant type/service-account details, use AssignedRoles (with backward compatibility for GDAPRoles), hide GDAP-only actions where not applicable, and add a direct-tenant re-auth flow via wizard deep links. Adds Pester coverage for direct-token cleanup and the new direct-vs-GDAP access-check behavior. Synced from CyberDrain/CIPP@b231564
Normalize vacation exclusion group naming to avoid Graph lookup/create issues when policy display names are long: cap at 120 chars, append an 8-char policy ID suffix when truncated, and reuse that computed name consistently for filtering and CA exclusion updates. Also update the wizard info text to document the new truncation-and-suffix behavior. Synced from CyberDrain/CIPP@7a37d19
Add a reusable policy diff table and a new compare dialog used from Drift and Applied Standards to compare Intune template standards against live tenant policy state. Extend ExecCompareIntunePolicy with template-prepared resolution, tenantPolicyByTemplate lookup, fuzzy-name matching aligned to standard settings, and explicit missing-policy responses. Also extract Intune template type inference into a shared CIPPCore helper and reuse it in the IntuneTemplate standard. Synced from CyberDrain/CIPP@2c9020b
Add a shared Get-CIPPOfficeAppBody helper and use it in both manual and template/queued Office app deployments so all paths build the same Graph payload and strip unsupported properties consistently. Also detect existing Office apps by @odata.type (officeSuiteApp) instead of display name to avoid repeated redeploys, and trim/validate assignment group names with clearer error output when no groups resolve. Synced from CyberDrain/CIPP@f72e7bf
Improve SharePoint admin link handling across backend and frontend. The API now requires `TenantFilter`, resolves and persists a valid admin URL, logs and returns clearer errors when resolution fails, and includes the URL in redirect responses. Tenant listing and portal UI now prefer the cached `SharepointAdminUrl` field (with fallback to the resolver endpoint), so portal links behave like other direct admin links after first resolution. Synced from CyberDrain/CIPP@81a896f
Mark ListFeatureFlags and several settings endpoints (BackupRetentionConfig, DnsConfig, JITAdminSettings, LogRetentionConfig, PasswordConfig) as AnyTenant so they can be called without a tenant context. Synced from CyberDrain/CIPP@113df59
Add `Initialize-CippRequestContext` and call it at the start of `New-CippCoreRequest` so AsyncLocal-backed tenant/group scope and role cache are always reset on reused workers. Also ensure unrestricted paths explicitly clear scope slots instead of leaving stale restricted values behind. Add `Get-CippRequestContext` for safe cross-module diagnostics, then update `Invoke-ListApiTest` to read context through CIPPCore rather than CIPPHTTP module scope. Update access-role in-memory caching to include a 15-minute TTL aligned with table cache expiration so role changes are picked up without waiting for process recycle. Synced from CyberDrain/CIPP@f1caebb
Introduces a per-worker cache for access scope rules derived from custom roles and tenant group membership, keyed on a shared version stamp stored in Azure Table. - Add Get-CippAccessScopeRule to cache the rule (allow/block lists) rather than resolved tenant ids, keeping correctness as tenants change - Add Get-CippAccessScopeVersion to memo the shared stamp with a short TTL - Add Clear-CippAccessScopeCache to bump the stamp and drop local memos; called from ExecCustomRole, ExecTenantGroup, Set-CIPPAccessRole, and Update-CIPPDynamicTenantGroups - Add Expand-CippScopeTenantItem to resolve tenant group references in allowed/blocked lists - Refactor Test-CIPPAccess to use the cache for TenantList and GroupList requests, avoiding a full tenant load on every warm request - Extract Resolve-CippRoleTenantEntry and fix silent drop of unresolvable tenant ids in ListCustomRole, which previously caused a blocked tenant to render as unrestricted Synced from CyberDrain/CIPP@aa01643
…ine number and detailed JSON output for better diagnostics. (fallback in case write-logmessage doesn't capture it) Synced from CyberDrain/CIPP@224f2de
Synced from CyberDrain/CIPP@8f5c2e2
Synced from CyberDrain/CIPP@67af255
Replace wildcard match for '*/organization' with a regex pattern '/organization(\?|$)' to avoid false positives from URLs containing '/organization' as a path prefix (e.g., '/organizationSettings'). Synced from CyberDrain/CIPP@523be86
Synced from CyberDrain/CIPP@6bbc09a
Exclude the Tests directory from PSScriptAnalyzer runs and add targeted SuppressMessageAttribute annotations for intentional use of ConvertTo-SecureString with plain text (values written to Azure Key Vault) and username/password params (outbound webhook config). Synced from CyberDrain/CIPP@1001169
Synced from CyberDrain/CIPP@95fd296
Synced from CyberDrain/CIPP@ca89185
Synced from CyberDrain/CIPP@772bac6
Synced from CyberDrain/CIPP@d3e36df
Synced from CyberDrain/CIPP@b78e3d2
Make the reusable settings template test stubs match the real advanced-function signatures so parameter binding drift fails loudly. Update the compare-field mock to capture CurrentValue/ExpectedValue and adjust assertions to validate compliance via those fields instead of the legacy FieldValue. Synced from CyberDrain/CIPP@b4af4f6
Feat: Re-add tools and update M365 licenses static files Synced from CyberDrain/CIPP@ad48dd5
…bac-scope fix(tenant access check): add RoleManagement.Read.Exchange delegated permission Synced from CyberDrain/CIPP@cbfae34
Comment out two `Write-Information` messages in `Test-CIPPAuditLogRules` during GUID mapping. This keeps webhook processing output quieter without changing mapping behavior. Synced from CyberDrain/CIPP@0ebfb24
Add a shared `Get-CIPPHostname` helper to consistently resolve and optionally persist the active CIPP host across HTTP and background contexts. Update Partner Center subscription creation/update logic to compare against the current desired webhook URL, handle missing host resolution, and sync stored webhook metadata when needed. Also surface `expectedWebhookUrl` in the webhook API response and show a frontend warning when an existing subscription still points to an old URL. Synced from CyberDrain/CIPP@b6f0c08
fix(webhooks): harden audit log v2 processing Synced from CyberDrain/CIPP@43802e0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )