Repository navigation
Conversation
- Save to Azure, MCP registration and the auth warmup no longer skip clients stored with Enabled as 'True' - Get-CippApiClient returns Enabled as a bool so the unsaved-changes check matches Synced from CyberDrain/CIPP@0141702
…omain against the caller's tenants - Removing a domain escapes it in the table filter - Tenant-restricted callers can only remove a domain or set its DKIM selectors when every row for it is one of their tenants Synced from CyberDrain/CIPP@432c1c5
…scope the usage overview - A missing tenantId returns 400 instead of resolving against every visible tenant - An unknown tenant returns 404 with a readable result - The variable usage overview only shows global variables and the caller's own tenants Synced from CyberDrain/CIPP@1559ed8
… every sync - write only new asset relations and delete only removed ones, with plain deletes - stamp the refresh before fetching so concurrent syncs read the cache instead of refreshing too - cache only asset to asset relations, build the key set straight from the rows - keep cached relations when a relations page fails - cache relations for 30 minutes Synced from CyberDrain/CIPP@ee9ed5e
Feat: Email notifications for JIT Admin approvers and requesters Synced from CyberDrain/CIPP@c467b51
…s to the caller's tenants - ListJITAdminTemplates and ListNewUserDefaults hide templates for tenants outside the caller's access; all-tenant templates stay visible - ExecAddCippCveException and ExecRemoveCippCveException limit AllAffected to the caller's tenants and need all-tenant access for Global - ExecEditTemplate only saves IntuneTemplate and CATemplate - ExecUpdateRefreshToken requires a tenant GUID and refuses managed tenants outside the caller's access Synced from CyberDrain/CIPP@cf7fd57
…de the caller's tenants Synced from CyberDrain/CIPP@844d86a
…tenant-checked user lookup Synced from CyberDrain/CIPP@b0d27bc
…ber of days - one threshold covers apps idle since their last sign-in and apps never used since being added - Microsoft-owned apps, managed identities, CIPP's own app and apps re-enabled in the last 7 days are skipped - exclusions match display name, app ID or object ID and accept custom variables, including List variables - remediate mode disables them; report mode is recommended Fixes #1041 Synced from CyberDrain/CIPP@f5639d4
Synced from CyberDrain/CIPP@b913ab2
…ethod - Set-CIPPAuthenticationPolicy takes a generic -ExcludeGroupIds (EmailExcludeGroupIds kept as an alias) - AuthenticationMethods baseline grades and remediates an exclude group per method Fixes #1044 Synced from CyberDrain/CIPP@a5980d7
… grade them by content - Run each tenant's CA template deploys in their own run, one at a time, and refuse a new one while another is running - Remediate Now sends one request per tenant, carrying every selected standard - Compare each named location the template defines and the policy references against the tenant location the policy is bound to, so a changed range or list variable shows as drift and remediates Fixes #1008 Synced from CyberDrain/CIPP@c93474a
…n-update-20261028 Synced from CyberDrain/CIPP@072a0f1
…te editor - Match settings without a template reference by definition id at deploy and compare time - Export policy template setting references and refresh the Intune setting catalog - Stamp template references in the editor and limit the picker to the template's settings Synced from CyberDrain/CIPP@0df54a6
…s not replicated yet Synced from CyberDrain/CIPP@e6e59c6
Synced from CyberDrain/CIPP@0a4ec1b
Synced from CyberDrain/CIPP@eb34712
…ain-fallback fix(tenants): keep the cached initial domain when the domains read falls back Synced from CyberDrain/CIPP@e5c0578
- use boolean comparisons for UseReportDB and includeDetails - drop an -ErrorAction the Hudu module function does not accept - stub Test-CippAccess in the Autopilot config test - match the current PIM licence error message - clear TenantID so the app management policy test does not depend on test order Synced from CyberDrain/CIPP@a8b8cdc
Synced from CyberDrain/CIPP@fa86523
…eline stays on alignment Synced from CyberDrain/CIPP@6cc71ae
… kit Tenant Links, Tenant Summary and User Summary now use the shared CippExtension building blocks and the NinjaOne adaptation the device summary already uses, replacing the legacy card and ConvertTo-Html code. The device summary gets padded cells, coloured chips and border-drawn accents so it survives NinjaOne's style stripping. Fixes the empty Secure Score impact, the US-format tenant creation date and the wrapping OS legend. Adds a date and number format setting for NinjaOne, matching Hudu. Synced from CyberDrain/CIPP@9876fd5
Synced from CyberDrain/CIPP@85ffffc
Synced from CyberDrain/CIPP@35d77e6
Harden JIT Admin and PIM role endpoints against privilege escalation: - Validate role/group ids as GUIDs before using them in Graph URL paths (Set-CIPPUserJITAdmin, Invoke-ExecJITAdmin). - Enforce JIT Role Template allow-lists for group memberships and TAP creation on existing users in Invoke-ExecJITAdmin. - Enforce allow-list checks on GrantActive/Extend/Renew in Invoke-ExecPIMRoleAssignment. - Block restricted callers from editing or deleting JIT Role Templates. Adds corresponding Pester coverage for these new guards. Synced from CyberDrain/CIPP@ea4ef3b
Invoke-ExecExtensionsConfig now compares posted values against stored config and refuses saves where an address change (HaloPSA, Hudu, PWPush, NinjaOne, Syncro) would send a stored API key to a new destination, or where a feature newly routes a secret, unless the secret is re-entered. Disabled NinjaOne with a stale instance value no longer blocks unrelated saves. Hudu/PWPush/HaloPSA addresses must be https without embedded credentials. Adds a per-setting change log (secret values redacted) on save and refusal. Get-SyncroSubdomain now validates the parsed value is a plain DNS label, rejecting input that could otherwise redirect the request off syncromsp.com. Adds corresponding Pester coverage for both. Synced from CyberDrain/CIPP@9b8e241
Add HideLicenseFull/HideLicenseNearFull options to suppress fully or nearly-full license warnings in the Hudu Magic Dash attention items, configurable via new Extensions.json switches and tested. Synced from CyberDrain/CIPP@c444aa9
Restrict assigning tenants to baselines and standards templates during import based on the caller's permissions (Tenant.Baselines.ReadWrite / Tenant.Standards.ReadWrite). Without the permission, new templates import unassigned and updates to already-assigned templates are refused with UnauthorizedAccessException. Also: - Escape RowKey/PartitionKey values with ConvertTo-CIPPODataFilterValue when looking up existing community template rows. - Return 403 instead of 500 from Invoke-ExecGitHubAction when template import throws UnauthorizedAccessException. - Add/extend Pester coverage for the new scope checks and the escaped table filter. Synced from CyberDrain/CIPP@0bc4d3d
Add AccessIPRanges to the list of tables backed up by New-CIPPBackup so IP-based access restrictions are included in exports. Synced from CyberDrain/CIPP@7e15504
Replace command visibility-based filtering with a clear-and-rebuild allowlist (cmdlets + aliases) so no provider, native program, or module auto-loading is reachable from sandboxed scripts. Also block Invoke-CippSandboxScript and New-CippCustomScriptExecution from the scheduler, and add Pester coverage for sandbox isolation and legitimate script execution. Synced from CyberDrain/CIPP@fdc697c
…261112 chore(openapi): regenerate API spec (2026-11-12) Synced from CyberDrain/CIPP@d6d85cd
…pdate-20261112 chore(docs): refresh published docs page snapshot (2026-11-12) Synced from CyberDrain/CIPP@e776d4b
Synced from CyberDrain/CIPP@ef1a948
Replace the AddStandardsTemplate tenant-list scope check with Assert-CippTenantAccess, covering tenant adds/edits, template overwrites, and group targets. Add the same check to ExecStandardConvert, ExecStandardTemplateSchedule, ExecStandardsRun, and RemoveStandardTemplate so scoped callers cannot act on tenants or groups outside their access, including All Tenants and stored rows with broader targets. Remove the legacy v1 Invoke-AddStandardsDeploy and Invoke-RemoveStandard endpoints (and their OpenAPI entries), superseded by the v2 template-based flow. Add tests covering spoofed customerId, out-of-scope groups, All Tenants, template-import placeholder handling, and unrestricted-caller behavior. Synced from CyberDrain/CIPP@e513033
Reserved partner groups (AdminAgents, HelpdeskAgents, SalesAgents, All Users) can no longer be mapped to a GDAP role by id, name, or stale-group correction. Centralize the reserved list in Get-CIPPGDAPReservedGroupName. Role templates and group mappings apply to every customer tenant, so Invoke-ExecGDAPRoleTemplate, Invoke-ExecAddGDAPRole, and Invoke-ExecGDAPAccessAssignment now require an unrestricted (AllTenants) role to write, while read-only actions remain available. Also escape the stale-group RowKey filter in Test-CIPPGDAPGroupMappings against OData injection. Add corresponding Pester tests. Synced from CyberDrain/CIPP@19a32ae
Add Expand-CIPPBaselineToken, which walks a parsed template and fills %name% tokens in string values directly, instead of substituting into serialized JSON. This prevents a variable or read-record value from closing a JSON string and injecting/overriding keys like method, uri, body or cmdlet. Update Invoke-CIPPBaselineStandard, Invoke-CIPPBaselineExoRequest, Invoke-CIPPBaselineExoBulkSweep and Invoke-CIPPBaselineGraphBulkSweep to use the new helper, and add BaselineTokenRender.Tests.ps1 covering breakout and legitimate rendering cases. Synced from CyberDrain/CIPP@e169f8f
Add Test-CippTemplateWriteAccess to block callers whose role is limited to specific tenants from changing or removing shared template rows, since templates are global and deployed by standards to every targeted tenant. Tenant-restricted callers may still create new templates. Apply the check across all template-editing and template-removal endpoints (CA, Intune, transport, spam filter, groups, PIM roles, DLP/retention/SIT/sensitivity-label compliance, safe links, GSA filtering/security profile, contacts, enrollment restrictions, assignment filters, app approval, app templates). Also restrict Invoke-ExecCloneTemplate to CA/Intune templates and tighten Invoke-ExecSetPackageTag to validate per-template permission and return proper status codes via Get-CippErrorStatusCode. Update existing endpoint tests to stub the new helper and add dedicated tests for Test-CippTemplateWriteAccess and the affected endpoints. Synced from CyberDrain/CIPP@094f36e
Add 'allowedUsers' to the list of tables exported by New-CIPPBackup, excluding bookkeeping rows (RowKey prefixed with '_') that are rebuilt on the next user sync. Synced from CyberDrain/CIPP@c6bc19f
CIPP backups previously only preserved excluded tenant rows, losing direct tenant configuration (non-GDAP tenants) on restore. Now includes direct tenants alongside exclusions, marking restored direct tenants with RequiresRefresh since their auth token isn't part of the backup. Adds Pester tests covering CIPP user rows, the tenants table filter, and the fields kept for direct vs. excluded tenants. Synced from CyberDrain/CIPP@b769e90
New-CIPPAPIConfig -ResetSecret previously batched the removal of all old passwords together with adding the new one, risking an app left with no valid secret if the add failed or was delayed by credential policy propagation. Now the new secret is added first (with retry for policy/concurrency errors), and old secrets are removed individually afterward. Any old secrets that fail to be removed are reported back as a warning instead of being silently left valid. Invoke-ExecApiClient surfaces this warning to the caller. Adds Pester tests covering ordering, retry behavior, and failure reporting. Synced from CyberDrain/CIPP@a0ed6ff
fix(identity): add user sponsors with POST instead of PUT Synced from CyberDrain/CIPP@35a4abb
Synced from CyberDrain/CIPP@71329fa
Synced from CyberDrain/CIPP@fde7cef
- retries Graph's concurrent-requests error - returns 207/500 when a removal fails Synced from CyberDrain/CIPP@e997c31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )