Repository navigation
feat: dev to release - #956
Merged
Merged
Conversation
Added docs page for incident response scenarios
SideNavItem read openImmediately only on mount, so client-side navigation (Ctrl+K page search, breadcrumbs, bookmarks) left the parent sections of the new route collapsed and the highlighted page hidden. Sections now open when the route moves into them, without auto-closing ones the user opened. The active leaf is centered in the nav when it is out of view, measuring against the sticky sponsor footer, which covered items scrolled to the bottom edge with block "nearest".
…vices Direction-scoped Replace kept the All Users / All Devices broad targets in both directions. For Exclude that is right, the exclusions narrow them, but for Include it made Replace a no-op on broadly assigned policies: All Devices plus the picked group still reaches every device, and there was no way in the UI to narrow a policy from All Devices to a group. Include + Replace now treats the broad targets as part of the include side, so the picked groups become the only include targets. Exclusions are kept. Exclude + Replace is unchanged. Applied to Set-CIPPAssignedPolicy and Set-CIPPAssignedApplication, helper text and docs updated.
React already escapes text node values, so manually escaping with escapeHtml caused values like '&' and '<' to render as '&'/'<' to the user. Remove the redundant escapeHtml helper and use raw nested values directly, and add a test covering HTML-special characters rendering verbatim. Closes #883
…known Without Defender for Office 365 Plan 2 the message details come from the exported message, which lists the URLs and attachments but carries no verdict. The chip rendered that gap as "Unknown", which reads as a verdict Microsoft never gave. It now says "Not analysed" on the header fallback and keeps "Unknown" for a Defender answer without a verdict. Closes #873
…ofile The profile was found by name across every configuration policy, so a same-named Settings Catalog policy from another template would be graded as drifted and deleted on remediation. Also require the device preparation template.
…sting device prep group The Device Prep baseline only set the Intune Provisioning Client as owner when it created the device group, so a group made by hand stayed without it. Ownership is now graded and, on remediation, added to the existing group in place, without recreating the profile. The profile also has to use the device preparation template to match, so a same-named policy is never deleted, and the check and the fix resolve the same group when several match. Closes #721
…s audit permissions
- clearing a tenant's tokens now covers its GUID and every domain
…tory lookup fails
- MessageEncryption, SetDefaultMailboxFont, PlannerBlockTaskDelete, OneDriveLicensedQuota, MigrateOneDriveShortcuts and PIMRoleSettings - on-demand caches for the per-user/per-mailbox reads: MailboxMessageConfiguration, PlannerUserPolicies, OneDriveQuotas, OneDriveRootShortcuts; ExoIRMConfiguration joins the scheduled Exchange group - engine: a prepare hook that cannot grade records an error and never runs the executor; configuration errors skip the cache re-collection - ExoBulkSweep: per-write concurrency, default 16
…te-limit pacing - nightly cache collection runs one capped run per tenant instead of one flat run - mailbox permissions, calendar permissions and rules run as a chain per tenant, one type at a time, each stored before the next starts - CIPPRateLimiter paces EXO from the Rate-Limit-Remaining/Reset headers - New-ExoBulkRequest retries transient mailbox errors, caps concurrency at 32 and drops the never-logged-on mailbox warning - $select on the permission and calendar reads
…hub-script andymckay/labeler is archived (no updates since 2022) and can't set issue types. actions/github-script now adds the labels and sets the Bug/Feature type in one step, so issues filed outside the form get the same type the issue templates apply.
CI: Set issue type in Label Issues workflow
…tion - Get-CIPPSPOSite -Properties selects only the needed SiteProperties fields and emits sites per page - SPOSites cache reads, merges and writes sites in chunks of 500 - SharePoint site usage archive enrichment requests only its two fields
Add macOS LAPS password retrieval for Intune-managed devices, route requests by platform while preserving Windows as the default, and document the new device action.
feat(intune): add macOS LAPS retrieval
The CA check named users and groups only from the Users and Groups caches, which the CA standard never refreshes, so groups just created by a deploy or vacation mode stayed raw ids and showed as drift. Look up leftover ids live in one directoryObjects/getByIds call. Closes #927
Short names like [List[string]] only resolve where `using namespace` is in effect, which the compiled modules do not guarantee, so they fail at runtime on the path that hits them. Fix the last one and add a static test that fails on any short generic type name in CIPP-owned modules.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- mailbox permission, calendar and rules stores skip the write when a batch returned no result - calendar folder cache leaves out UPNs that are not valid table keys
- show the category path on picker results (index rows now carry categoryId) - exclude nested settings already in the policy from the picker - tooltip shows the setting id, with help text below when present - label the values summary as categories and fields - start new simple collections empty instead of with a blank entry Fixes #950
- Get-CIPPReportPage pages AllTenants report reads by whole tenants, scoped to allowed tenants
- report-backed list endpoints return { Results, Metadata.nextLink } when manualPagination is set
- their pages opt in via serverPagination; ListGraphRequest AllTenants tables page by default
- mailbox activity sorts in the table instead of on the server
…nges Detect secrets, certificates, permission grants, owner adds, and directory role membership when initiated by an application or a user, with KeyDescription diffing so credential alerts only fire on newly added Verify keys.
Keep backend and frontend copies in sync. Backend VendorTenantList.json is additive for upcoming consumers; existing offboarding still uses the frontend list.
- save only changed table pages and write them asynchronously - skip building discarded log messages and replace LokiJS key indexes with a hash index
Adds a Credentials tab (replacing the SSO tab) under Advanced > Authentication
with a CIPP-SAM card next to the existing SSO card, and the backend needed to
see, rotate, revoke and audit the app's credentials.
SAM card and ExecSAMCredentials endpoint
- Status: app and tenant, auth mode, stored secret liveness and expiry,
certificate registration and expiry, refresh token health (partner and direct
tenants), and every secret/certificate on the app registration with an owner
classification (this instance, other CIPP, external, unknown).
- Manage credentials opens the shared table dialog with Revoke, Mark as known
and Remove known flag as row actions. Rotate secret, Renew certificate and
Run token update confirm through CippApiDialog; Re-authenticate and Manual
override deep-link to the wizard.
- Ownership is tracked by storing the secret keyId in AppCache (SecretKeyId)
everywhere a secret is minted; the weekly timer now judges expiry on its own
secret instead of the newest one on the app.
- Known flags and provenance (source, actor, created by/at) live in Config
'SAMCredential' rows and are shown in the table and alerts.
Rotation and auth mode
- Update-CIPPSAMSecret extracts the mint/store/rollback logic the timer used;
the rotate action and the timer both call it.
- Disabling certificate auth on a secret-less install mints a tracked secret
with the certificate and only flips once the new secret works for both the
client-credentials and refresh-token grants.
- Status reads the CertificateAuthentication flag directly instead of the
per-runspace env mirror.
- New CredentialVersion marker on AppCache: writers bump it and Get-GraphToken
reloads credentials when it changes, so rotations and mode changes no longer
leave other runspaces on stale credentials.
Logging and alerting
- Every create, rotate, revoke, flag, renew, mode change and SSO rotation logs
at Alert severity with the acting user and credential id, never the value.
- Always-on hourly Start-SAMCredentialMonitorTimer diffs the app's credentials
against a snapshot and alerts on every added/removed credential via
Send-CIPPAlert (email, PSA, webhook). CIPP's own changes alert immediately
and are worded as expected ("Created by CIPP (scheduled rotation). No action
needed"); anything else says to review it.
SSO
- Status returns the client secret expiry; the weekly timer rotates the SSO
secret within 30 days of expiry and logs that a restart is required.
Shared components
- CippTableDialog no longer renders a second title; a CippDataTable inside a
dialog sizes to the dialog with a sticky header so only the rows scroll.
- Get-CippKeyVaultSecret gains -IncludeAttributes for the updated timestamp.
Tests: Pester for Update-CIPPSAMSecret (incl. rollback), owner classification,
snapshot diff wording, timer expiry and SSO rotation, certificate-auth
disable gate, Get-GraphToken credential-version reload; vitest for the SAM
card, SSO card, table dialog and data table.
Previously, disabling certificate auth while an existing (non-minted) client secret was still propagating would fall through to the "rotate the secret" error message instead of the propagating message. Now both minted and existing secrets get the appropriate propagating message, and Test-CIPPSAMSecret includes the refresh grant check since Entra activates it later than client_credentials. Adds a test covering the case where an existing secret is recently rotated and still propagating.
Add new credentials.md page documenting the CIPP-SAM and CIPP-SSO credential management UI, including status chips, actions, credential review, alerts/logging, and auth mode switching. Update SUMMARY.md, authentication README, sso.md, and sam-setup-wizard.md to reference and link the new page.
Zacgoose
approved these changes
Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.