fix: Dev to hotfix - #273
Merged
Merged
Conversation
Wrap `Get-AzDataTableLargeEntity` so callers can still pass their own error settings, while incomplete entity errors are intercepted, logged once per row, and re-emitted only for non-recoverable failures. Also updates the bundled AzBobbyTables runtime to support the new handling.
Move Get-CippExoErrorText out of Resolve-CippExoBulkResult into its own GraphHelper file so it can be reused and keep the bulk-result resolver focused. The error text extraction behavior remains the same.
Ensure BECRun passes `UserIds` as an array when calling `Search-UnifiedAuditLog`, matching EXO's expected `String[]` binding. Also guard against missing `AuditData` before `ConvertFrom-Json` so users with no matching events are treated as clean results instead of failures.
Refactor the tenant domain lookup in Invoke-ExecAddTrustedIP to handle the 'AllTenants' case directly, ensuring correct behavior when the tenant filter is set to 'AllTenants'. This change improves clarity and functionality in the trusted IP addition process.
…titution Add functionality to apply watermark text in reports, allowing for variable substitution and enforcing a maximum length of 40 characters. Update related components to utilize the new watermark logic, ensuring consistent display across the application.
Remove the local ConvertTo-IdList wrapper in Invoke-ExecBrandingSettings and call ConvertTo-CIPPCoverImageIdList directly. Switch image-delete filtering from a pipeline to .Where() to prevent the comma-wrapped array from being passed whole to Where-Object, which caused surviving ids to be space-joined into one bogus id and silently emptied the gallery. Add Pester tests covering the delete id-list bookkeeping.
The Compromise Remediation page gave the PDF report a single Actions row, so nothing described the threat assessment banner, how it is scored, or what the report leaves off. Add a PDF Report section covering the report page by page, the fixed point weights behind High, Medium and Low, and the per-section row caps. Call out the three ways the banner misleads: scoring counts findings rather than volume, two of the scored inputs are tenant-wide, and authentication methods, password changes, sent messages and Intune devices carry no weight at all. Also note that the report's check numbers run 1 to 8 against the page's 1 to 9, because Sent Messages has no section in the report. Replace the truncation claim in the Actions row, which said every long result set points at the JSON export when only four sections do, and move the page headings to title case. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ontent GitBook Git Sync absorbs a leading '# H1' in .gitbook/includes/*.md as the snippet title and drops it from the body on import. Prepend a '***' divider so the H1 is no longer the first block, to test whether it then survives the round-trip. Pages still carry their own '***', so they will show two dividers until this is confirmed and the per-page dividers are removed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…tent The feature-request reusable content now carries its own leading divider (GITBOOK-616), which also keeps the H1 from being absorbed as the snippet title on Git Sync import. The per-page '***' immediately before each include is therefore now a duplicate. Removed from all 335 pages that carried it; docs/user-documentation/cipp/integrations/cipp-api.md had none and is untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Get-CIPPTable previously called New-AzDataTable on every invocation, which 409s once the table exists and bills like any other request. This adds a synchronized in-memory cache so CreateTable is only issued once per account+table combination. New helpers: - Initialize-CIPPTables: seeds the cache at warmup via a single ListTables call - Unregister-CIPPTable: invalidates cache entries after a table is dropped All existing Remove-AzDataTable call sites updated to call Unregister-CIPPTable, preventing stale cache entries from causing TableNotFound errors. Cache is shared across the runspace pool via ModuleInjections. Pester tests added covering deduplication, cross-account isolation, warmup seeding, and cache invalidation.
Extend the MCP dynamic client registration redirect URI check to also accept URIs registered on the instance's MCP resource app in Entra, in addition to the static known-client allowlist and loopback addresses. The lookup is lazy, cached per-runspace for 60 s, and keyed to the configured app's client ID to avoid stale hits after a reconfiguration. Failures (e.g. Graph outage) cache as empty so a flaky upstream cannot be amplified into a flood of Graph calls. Moves the McpClient lookup before the URI loop so the app ID is available for the cache key and the error message can suggest adding the URI to the resource app registration.
Enhance the BEC pipeline to collect and return richer indicators: suspect-user sign-ins with country/city, usage-location foreign activity analysis, safelist and sharing-link audit changes, sent-mail burst/repeat-subject analysis, and malicious app catalog matching (including tenant-wide catalog hits). It also updates Huntress rogue app matching to use MaliciousApps.json and fixes a malformed Hudu BEC link. Update the BEC UI/PDF and sample preview data to surface the new checks (now through Check 11), add clearer risk messaging/scoring, show geo context and error states, and align wording/documentation with the 7-day analysis model. Also fix BEC page polling refresh behavior so overwrite is one-shot instead of being retriggered on later refetches.
Improve BEC analysis signal quality by normalizing sign-in/device timestamps to ISO-8601, separating successful foreign sign-ins from failed spray noise, and flagging mailbox permission changes that target the investigated user. Update the BEC page, PDF report, sample preview data, and user docs to reflect the new weighting and messaging so tenant-wide churn is de-emphasized while direct compromise indicators are prioritized.
Replace `Remove-EmptyArrays` with `Format-CIPPCAPolicy` so CA policy PATCH bodies are canonicalized to desired state (`[]`/`null`) instead of silently preserving tenant drift. Wire this into both template deployment and full-policy edit flows, and add focused Pester coverage for canonicalization and endpoint behavior. Also expand the CA policy builder to support include/exclude guest or external user assignments, application and workload identity filters, authentication context references, and custom grant controls, with guardrails for invalid Entra combinations. `openapi.json` was regenerated to reflect the updated request/response shapes.
Replace the nine em dashes introduced with the Check 10 and 11 content, repad the Checks, PDF Pages and Threat Assessment tables to a uniform width, and correct the stale "Both actions" sentence to name the two device actions that actually need write permission. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Use resolved recipient IDs (UserId) for calendar/contact permission removal instead of display names, and still pass display names for clearer logging. Update list endpoints to resolve UserId values, pick folders by FolderType for locale-safe matching, and trim EXO payloads with -Select to reduce response size and ambiguity.
Refactors CVE cache/report paths to stream rows and device payloads instead of materializing large intermediate collections, reducing memory pressure in both DB cache jobs and HTTP reads. Updates Add-CIPPDbItem orphan cleanup to use per-run RunId stamping so authoritative writes never delete rows from the same run, and avoids writing fresh count rows for empty/failed mailbox permission batches. Also adds robust mailbox-folder permission removal for ambiguous display names, fixes AllAffected CVE exception tenant resolution, and expands Pester coverage for these behaviors.
Excluded tenants retained cached rows in the DB that were never cleaned up, causing them to appear in the estate-wide secure score view with empty TenantId and domain as display name. Adds a partition-key filter against the known-tenant lookup before processing rows, and adds Pester tests covering the fix.
…ts on SharePoint sites" as is CSOM property and cannot be directly set with command previously listed
The All Tenants dashboard was fetching full row sets (alignment rows: one per tenant per standard; failed tests: ~928 KB / 1581 rows on a 12-tenant estate) to compute a handful of numbers in the browser. Add `summary=true` to ListTenantAlignment and `countsOnly=true` to ListTestResultsTenants. Both endpoints now return only the aggregates the dashboard needs. The frontend useMemo blocks are replaced with direct reads of the server response. Also adds HighRiskTenants and ByTestType (per-type failure counts, distinct tenant counts, top failing checks) to the test results counts shape, and Pester tests covering both new modes.
Fixes incorrect sharepoint.com URLs for tenants on sovereign clouds (German .de, GCC High .us, DoD -mil.us, 21Vianet .cn). - Add Get-CIPPSharePointDomain to map onmicrosoft TLD to SharePoint domain - Update Get-SharePointAdminLink to read the real domain from the root site host instead of hardcoding sharepoint.com - Propagate SharePointDomain through Get/Set-CIPPSPOTenant, New-CIPPSharepointSite, and template deploy - Invalidate stale cached URLs whose TLD doesn't match the tenant's initial domain - Fix single-domain autodiscover path where [0] on a bare string returns a char - Add Pester tests covering all cloud variants and fallback paths Closes #269
Add `-noPagination $true` to the sign-in log query to avoid unnecessary pagination, and shorten the device code login warning/info messages for clarity.
Reworks SharePoint/OneDrive sharing-links caching to stream writes per page with scan state, checkpoints, idempotent site completion, per-drive delta tokens, and finalization pruning/recount logic. Adds shared DBCache helpers, RunId support in Add-CIPPDbItem for cross-activity cleanup, and comprehensive Pester coverage for resume, incremental/full fallback, contention, and finalization behavior. Also fixes TanStack Query v5 queue polling callbacks to stop refetching when queue status is complete, and updates generated OpenAPI query parameters/descriptions.
Replace interpolated backslash paths with Join-Path so the intuneCollection.json path works correctly on Linux hosts. The old string interpolation caused [System.IO.File] to fail silently on Linux, making the definition index never load and causing every Catalog comparison to degrade to raw setting IDs — appearing as drift on every setting of every policy.
…0812 chore(licenses): update Microsoft license SKU data (2026-08-12)
Align Copilot standards, list output, and the settings UI with the actual Graph values for web search and Designer image generation. This updates the option ordering, handles inverted and three-state labels correctly, and clarifies the docs so admins do not assume all Copilot settings use the same 1/0 semantics.
Update error message to direct users to the Setup Wizard instead of the vague 'rotation will not replace it' wording.
Intune mints a per-entry instance id on create, stored in a child node whose settingDefinitionId ends in '_id'. Templates retain the ids from the source tenant, causing every reusable setting entry to report drift perpetually even when correctly deployed. Fixes: - Compare-CIPPIntuneObject: zero out instance ids before diffing when CompareType includes ReusablePolicySetting, without mutating the caller's objects - Invoke-CIPPStandardReusableSettingsTemplate: iterate selected ids rather than resolved rows so unresolved/deleted templates still emit a compare row (preventing stuck NOT FOUND drift); key compare rows off the picker's RowKey, not the GUID embedded in stored JSON; guard remediation against unresolved templates; fix IDictionary handling in Remove-CIPPNullProperties - Add Pester tests covering all new branches
Condenses over-long code comments across backend and frontend files to shorter, clearer versions while preserving the key technical rationale.
rvdwegen
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.