Repository navigation
Conversation
Feat: Scope JIT admin approval to specific tenants and tenant groups Synced from CyberDrain/CIPP@1280c64
The push-subscription flow now surfaces browser notification permission denials instead of swallowing them. The preferences page shows a clear status message while waiting for permission and explains how to enable notifications if the browser prompt does not appear. Synced from CyberDrain/CIPP@6d5e904
…engine - small batches cut the referenced entries out of the cached directory; a search's large slices share one full parse - validate the cached users blob with Test-Json instead of parsing it - share the expanded rule set across tenants - map GUIDs without Add-Member or a log line per mapping, and before the placeholders are added - parse and serialise records with CippJson - drop the per-worker directory memo and the per-batch rule configuration log Synced from CyberDrain/CIPP@e45ac9f
Invoke-ListAuditLogCoverage pulled the entire ledger and filtered by date range and tenant in memory, timing out on large instances. Push the WindowStart range and tenant selector (PartitionKey or TenantId) into the table query instead. Also add a 30-day cleanup of the coverage ledger in Start-LogRetentionCleanup, since the ledger has no other retention and only needs ~50 hours for the engine to function. Add tests covering the server-side filter construction and the new cleanup batch behavior. Synced from CyberDrain/CIPP@8f01e51
…otification tests Synced from CyberDrain/CIPP@80b0bd1
Update yarn.lock for sharp 0.35.5, prosemirror-view 1.42.6, and source-map-js 1.2.2. Synced from CyberDrain/CIPP@a2cb181
…sting device prep group The Device Prep baseline only set the Intune Provisioning Client as owner when it created the device group, so a group made by hand stayed without it. Ownership is now graded and, on remediation, added to the existing group in place, without recreating the profile. The profile also has to use the device preparation template to match, so a same-named policy is never deleted, and the check and the fix resolve the same group when several match. Closes #721 Synced from CyberDrain/CIPP@75806c7
…ng webhook runs Synced from CyberDrain/CIPP@8a24026
…d template tiers Synced from CyberDrain/CIPP@57480a6
…permissions Synced from CyberDrain/CIPP@b44f19c
…tory lookup fails Synced from CyberDrain/CIPP@62d1a75
…ore syncs Synced from CyberDrain/CIPP@2f151d7
Synced from CyberDrain/CIPP@1fa7a68
Synced from CyberDrain/CIPP@39779d2
feat(intune): add macOS LAPS retrieval Synced from CyberDrain/CIPP@b68fa80
…icate auth Enabling certificate authentication (wizard toggle or certificate-only first setup) switched every Graph call onto the SAM certificate as soon as the registration step returned, without proving the certificate could obtain a token. When the stored certificate was not actually registered on the application, that produced a full AADSTS700027 outage that the wizard reported as success. Backend: - Add Test-CIPPSAMCertificateAuth, which reads the stored certificate uncached and requests an app-only token with it. Both enable paths now run it first; on failure the flag stays off (or is rolled back) and the client secret remains in use. - Get-GraphToken: on AADSTS700027 re-read the certificate from storage and retry once when the thumbprint differs, so a runspace holding a stale certificate self-heals instead of failing until restart. - Update-CIPPSAMCertificate: refresh the process-wide preload after a drift re-register, not only after a mint. - Get-CIPPAuthentication: do not burn the one-shot provisioning attempt while the vault still holds deployment placeholders, so the manual credential route provisions a certificate on the next reload. - ExecSAMCertificate Get: return the application id and the certificate credentials registered on the application (name, thumbprint, dates, whether it is this instance's). No key material is returned. Frontend: - Certificate step: clearer copy, a collapsed "Certificate details" panel with an Open in Entra button and a table of registered credentials (this instance sorted first, refreshable), a Renew certificate action, and status polling after renew while Graph catches up. Tests cover the enable gate on both entrypoints, the probe helper, the token self-heal, the drift env refresh and the status endpoint shape. Synced from CyberDrain/CIPP@b4f930b
Synced from CyberDrain/CIPP@c98e876
…g post-execution - store only records whose operation an eq/in rule condition can match - settle windows with nothing stored as Processed without processing - start processing from the download task only when a window is waiting - move the rule set read into Get-CIPPAuditLogRuleSet Synced from CyberDrain/CIPP@2b3efed
Standards and Secure Score sat at a third of the width and wrapped their first column word by word. Cards now take their own column widths and standard actions may wrap. Synced from CyberDrain/CIPP@896fa0b
- HttpBurstMax per SKU profile: the HTTP pool size on Premium and packed hosted instances, half on multi-core Basic, 0 on single-core hosts - hosted matrix lists B2 explicitly with the same 3 GB heap cap as the default matrix Synced from CyberDrain/CIPP@e496cf6
…ng a new one Synced from CyberDrain/CIPP@49bd5be
…ing ticket Synced from CyberDrain/CIPP@0843aeb
Fixes #1074 Synced from CyberDrain/CIPP@785cb8c
Alerts and ticket-producing actions can now raise tickets in NinjaOne Ticketing beside HaloPSA and Syncro, using the existing NinjaOne integration's instance and tenant-to-organisation mapping. NinjaOne refuses ticket writes for the client-credentials token (user_context_required), so ticketing runs as a signed-in technician: a Connect button on the integration page starts the Authorization Code flow through the existing /authredirect popup relay, ExecExtensionOAuth owns state and the token exchange, and the refresh token is stored as an extension secret. Documentation sync keeps the app-only token. - New-NinjaOneTicket: form, status, priority and both description bodies from the integration settings; optional consolidation that comments on the open ticket for a repeat title; requester from the organisation's end users by email (Link Tickets to affected Users); device via the tenant sync's NinjaOneDeviceMap or by serial - Get-NinjaOneTicketFields feeds the form and status pickers - New-CippExtAlert dispatches to NinjaOne when ticketing is enabled; unmapped tenants are skipped with a warning - Alerts carry an AffectedDevice: webhook alerts from the mapped Entra device or sign-in device, scheduled tasks from their device parameters; the scheduler's PSA user/device resolution no longer requires HaloPSA - Saving the extension config warns when more than one ticketing integration is enabled Synced from CyberDrain/CIPP@d783a2d
Synced from CyberDrain/CIPP@953afa9
…pdate-20261030 Synced from CyberDrain/CIPP@4c326c8
… and enterprise app permission management App Permission Exposure report - Score Entra directory roles held by service principals, directly or through role-assignable groups. RiskyPermissions.json gains 91 DirectoryRole entries, plus 47 Application and 46 Delegated entries. - Read three new 30-day directory audit caches (Entra ID P1): ServicePrincipalRoleChanges, AppCredentialChanges and DelegatedGrantChanges. Each has its own ConvertFrom-CIPP*AuditEvent parser. - Raise suspicion when an app, rather than a person, assigns a role, adds a credential, or creates a delegated grant for a single user (including an app granting to itself). - Tell credential rotation from additive credentials: a new secret or certificate that replaces an expiring or removed sign-in key gets a smaller bump than one added next to working keys. - Flag backdated credentials: a secret whose start date is more than 2 days before the audit log shows it was added, or a certificate valid from long before it was uploaded. - Report managed identities as their own ownership class. Show the Azure resource behind each one from alternativeNames, skip the credential checks, and note that who controls it is set in Azure, which CIPP cannot read. - Detail view: grant added date and actor, credential start dates, a "Managed identities" filter and an Azure resource field. Enterprise apps - New Permissions management: add or remove application and delegated permissions (ExecEnterpriseAppPermission). Removing a delegated scope strips it from every grant for that API, including per-user grants. - New Roles tab: add or remove directory role assignments (ExecEnterpriseAppRole). The CIPP-SAM app's own roles are refused. - Show "View in Entra" only for apps owned by the selected tenant. Supporting changes - Set-CIPPDBCacheRoleAssignments stores the service principal members of role-holding groups. - Get-CIPPRiskyPermissionCatalog adds a DirectoryRole lookup keyed on the role template id. - BEC heuristics only match catalog scope names from Graph, Exchange Online and SharePoint Online, so generic names like user_impersonation no longer match. - Register the new cache types in the backend and frontend CIPPDBCacheTypes.json and in the cache categories. Synced from CyberDrain/CIPP@cb1c3b3
Synced from CyberDrain/CIPP@ee1a502
…p gate excludes Fixes #1089 Synced from CyberDrain/CIPP@c5731e9
…aselines save Synced from CyberDrain/CIPP@8c957d3
…eAppInstallationStatusReport Fixes #1087 Synced from CyberDrain/CIPP@cb7c465
…ser.ReadWrite Synced from CyberDrain/CIPP@1e1915d
…try-After header - read Retry-After only when there is a response, and fall back to the default wait when it is not a number of seconds Synced from CyberDrain/CIPP@537e45e
…lter Feat: Add preset filter for retiring memberOf rules in dynamic groups Synced from CyberDrain/CIPP@127b576
feat(intune): manage, template and deploy enrollment restrictions Synced from CyberDrain/CIPP@630257a
feat(groups): convert Add Group page to a drawer Synced from CyberDrain/CIPP@f787696
…-remove Feat: Bulk remove on Calendar Permissions Report Synced from CyberDrain/CIPP@47be62a
…pdate-20261102 Synced from CyberDrain/CIPP@7d1513f
- Updated CippAppPermissionExposureDetail component to include Exchange application roles and their counts. - Enhanced CIPPDBCacheTypes.json to define new cache types for Exchange application access policies and role assignments. - Introduced new risky permissions for Exchange roles in RiskyPermissions.json. - Modified cippdb-cache-categories.js to include new cache types. - Implemented PowerShell functions to retrieve and cache Exchange application role assignments and access policies. - Added tests for caching and retrieving Exchange application role assignments and access policies. Synced from CyberDrain/CIPP@bdeeef2
Add Resolve-CippBulkSelectedTenant helper to validate selectedTenants entries against Get-Tenants by customerId instead of trusting the client-supplied defaultDomainName, preventing a mismatched customerId/domain pair from targeting an unauthorized tenant. Update Invoke-AddChocoApp, Invoke-AddEdgeApp, Invoke-AddMSPApp, Invoke-AddOfficeApp, Invoke-AddStoreApp, and Invoke-AddWin32ScriptApp to use the new helper, and expand tests to cover the resolution logic. Synced from CyberDrain/CIPP@70cde7c
Update Syncro integration logo with a dark-mode variant and mark it hidden in Extensions.json. Filter hidden extensions from the integrations page and universal search results. Synced from CyberDrain/CIPP@c23d93a
Resolve-CippBulkSelectedTenant now takes SelectedTenants explicitly instead of reading Request.Body.selectedTenants internally, making the tenant source visible at call sites. Updated all bulk app-install endpoints and the security test regex accordingly, and documented the new x-cipp-reads-via dependency in openapi.json. Synced from CyberDrain/CIPP@5dd7a69
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )