feat: dev to release

.github/copilot-instructions.md

@@ -91,3 +91,14 @@ churn; these patterns do.
   members: once anything has enumerated `Properties`, the reserved `pstypenames` sits among the instance members).
 - A Pester test whose code under test uses a `[CIPP.*]` type must `Add-Type` `Shared/CIPPSharp/bin/CIPPSharp.dll` in
   `BeforeAll`; helpers that fall back when the type is missing otherwise pass while testing the wrong path.
+
+## Helper functions
+
+Every function is one more place a contributor has to look, so a new one has to earn its place.
+
+- Write logic that has one caller inline where it is used. Add a function only when it has two or more real callers, or
+  it is a generic building block like the Graph, Exchange, table and tenant helpers in `CIPPCore/Public/GraphHelper`.
+- Don't wrap a single call to an existing function (a new function whose body is one `Start-CIPPOrchestrator` call):
+  call the existing function directly.
+- Don't declare functions inside functions. Put the branch inline, or compute the input first and classify it once.
+- Search for an existing helper before writing one, and extend it rather than adding a near-copy.

.github/workflows/CodeQL_Analyser.yml

@@ -31,12 +31,12 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v6
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.38.2
+        uses: github/codeql-action/init@v4.38.3
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
           config-file: ./.github/codeql/codeql-config.yml
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.38.2
+        uses: github/codeql-action/autobuild@v4.38.3
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.38.2
+        uses: github/codeql-action/analyze@v4.38.3

.github/workflows/Label_Issues.yml

@@ -12,16 +12,22 @@ jobs:
       issues: write
     steps:
       - name: Label Issues
-        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          add-labels: "bug"
+          script: |
+            const issue = { ...context.repo, issue_number: context.issue.number }
+            await github.rest.issues.addLabels({ ...issue, labels: ['bug'] })
+            await github.rest.issues.update({ ...issue, type: 'Bug' })
   label_issues_frs:
     if: github.repository_owner == 'CyberDrain' && contains(github.event.issue.title, 'Feature')
     runs-on: ubuntu-slim
     permissions:
       issues: write
     steps:
       - name: Label Issues
-        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          add-labels: "Feature, no-priority"
+          script: |
+            const issue = { ...context.repo, issue_number: context.issue.number }
+            await github.rest.issues.addLabels({ ...issue, labels: ['Feature', 'no-priority'] })
+            await github.rest.issues.update({ ...issue, type: 'Feature' })

backend/AddMSPApp/ninja.app.json

@@ -59,5 +59,6 @@
     "v10_1607": true
   },
   "notes": "CIPP Uploaded application",
-  "minimumMemoryInMB": 1
+  "minimumMemoryInMB": 1,
+  "setupFilePath": "install.ps1"
 }

backend/Config/BaselineStandards/Entra (AAD) Standards/DisableAgentBlueprintCreation.json

@@ -0,0 +1,52 @@
+{
+  "name": "DisableAgentBlueprintCreation",
+  "label": "Disable agent identity blueprint creation by users",
+  "cat": "Entra (AAD) Standards",
+  "tag": [],
+  "impact": "Low Impact",
+  "helpText": "Disables the ability for users to register agent identity blueprints in the tenant. This is a separate setting from 'Users can register applications'; disabling app registrations does not stop users from creating agent identity blueprints.",
+  "executiveText": "Prevents regular employees from creating AI agent identity blueprints, which are the templates that agent identities are issued from. Restricting this to designated roles keeps agent identities and their credentials under IT governance and avoids a sprawl of unmanaged agent registrations.",
+  "docsDescription": "Sets the Entra default user role permission 'Users can register agent identity blueprints' (defaultUserRolePermissions.allowedToCreateAgentIdentityBlueprints on the Graph beta authorization policy) to No. Microsoft enables this for all users by default, and the creator of a blueprint becomes its owner and can manage its credentials. This setting is independent of 'Users can register applications', so apply both standards to keep application and agent identity creation limited to the Agent ID Developer and Agent ID Administrator roles.",
+  "impactColour": "info",
+  "addedDate": "2026-10-15",
+  "powershellEquivalent": "Update-MgBetaPolicyAuthorizationPolicy -DefaultUserRolePermissions @{ allowedToCreateAgentIdentityBlueprints = $false }",
+  "appliesToTest": [],
+  "recommendedBy": ["CIPP"],
+  "requiredCapabilities": [],
+  "secureScoreImpact": 0,
+  "compare": "subset",
+  "variables": {
+    "allowAgentBlueprintCreation": {
+      "type": "switch",
+      "label": "Allow users to register agent identity blueprints",
+      "default": false,
+      "recommended": false
+    }
+  },
+  "expected": {
+    "allowedToCreateAgentIdentityBlueprints": "%allowAgentBlueprintCreation%"
+  },
+  "read": {
+    "cacheType": "AuthorizationPolicy",
+    "object": "defaultUserRolePermissions"
+  },
+  "writeTarget": "authorizationPolicy",
+  "writeTargetProperties": {
+    "defaultUserRolePermissions.allowedToCreateAgentIdentityBlueprints": "%allowAgentBlueprintCreation%"
+  },
+  "remediate": {
+    "executor": "GraphRequest",
+    "requests": [
+      {
+        "method": "PATCH",
+        "asApp": false,
+        "uri": "policies/authorizationPolicy/authorizationPolicy",
+        "body": {
+          "defaultUserRolePermissions": {
+            "allowedToCreateAgentIdentityBlueprints": "%allowAgentBlueprintCreation%"
+          }
+        }
+      }
+    ]
+  }
+}

backend/Config/BaselineStandards/Exchange Standards/MessageEncryption.json

@@ -0,0 +1,176 @@
+{
+  "name": "MessageEncryption",
+  "label": "Enable Purview Message Encryption",
+  "cat": "Exchange Standards",
+  "tag": [],
+  "impact": "Low Impact",
+  "helpText": "Enables Microsoft Purview Message Encryption by turning on Azure RMS licensing for Exchange Online, and turns on simplified client access so the Encrypt button appears in Outlook on the web and the new Outlook. The optional settings default to \"Do not change\", which leaves the tenant's current value alone and out of the drift check. Branding is configured in the Set Encrypted Message Branding (OME) standard.",
+  "executiveText": "Turns on the built-in encryption that lets staff send protected email to anyone, including recipients outside the organization. Uses licensing the organization already owns, removing the need for a separate secure-email product.",
+  "docsDescription": "Grades AzureRMSLicensingEnabled and SimplifiedClientAccessEnabled as true, plus EnablePdfEncryption, DecryptAttachmentForEncryptOnly, SimplifiedClientAccessDoNotForwardDisabled, SimplifiedClientAccessEncryptOnlyDisabled and TransportDecryptionSetting when the baseline picks a value. Remediation sends the graded values in one Set-IRMConfiguration call.",
+  "impactColour": "info",
+  "addedDate": "2026-08-04",
+  "powershellEquivalent": "Set-IRMConfiguration -AzureRMSLicensingEnabled $true -SimplifiedClientAccessEnabled $true",
+  "recommendedBy": [],
+  "requiredCapabilities": [
+    "EXCHANGE_S_STANDARD",
+    "EXCHANGE_S_ENTERPRISE",
+    "EXCHANGE_S_STANDARD_GOV",
+    "EXCHANGE_S_ENTERPRISE_GOV",
+    "EXCHANGE_LITE"
+  ],
+  "disabledFeatures": {
+    "report": false,
+    "warn": false,
+    "remediate": false
+  },
+  "secureScoreImpact": 0,
+  "compare": "subset",
+  "variables": {
+    "EnablePdfEncryption": {
+      "type": "autoComplete",
+      "multiple": false,
+      "creatable": false,
+      "label": "Encrypt PDF attachments",
+      "helperText": "Applies Encrypt-only and Do Not Forward protection to PDF attachments as well as the message body.",
+      "omitWhenBlank": true,
+      "options": [
+        {
+          "label": "Do not change",
+          "value": ""
+        },
+        {
+          "label": "Enable",
+          "value": true
+        },
+        {
+          "label": "Disable",
+          "value": false
+        }
+      ],
+      "default": ""
+    },
+    "DecryptAttachmentForEncryptOnly": {
+      "type": "autoComplete",
+      "multiple": false,
+      "creatable": false,
+      "label": "Let recipients save Encrypt-only attachments unprotected",
+      "helperText": "When enabled, attachments on Encrypt-only mail are decrypted when the recipient downloads them.",
+      "omitWhenBlank": true,
+      "options": [
+        {
+          "label": "Do not change",
+          "value": ""
+        },
+        {
+          "label": "Enable",
+          "value": true
+        },
+        {
+          "label": "Disable",
+          "value": false
+        }
+      ],
+      "default": ""
+    },
+    "SimplifiedClientAccessDoNotForwardDisabled": {
+      "type": "autoComplete",
+      "multiple": false,
+      "creatable": false,
+      "label": "Do Not Forward option in the Outlook Encrypt menu",
+      "omitWhenBlank": true,
+      "options": [
+        {
+          "label": "Do not change",
+          "value": ""
+        },
+        {
+          "label": "Hide",
+          "value": true
+        },
+        {
+          "label": "Show",
+          "value": false
+        }
+      ],
+      "default": ""
+    },
+    "SimplifiedClientAccessEncryptOnlyDisabled": {
+      "type": "autoComplete",
+      "multiple": false,
+      "creatable": false,
+      "label": "Encrypt-only option in the Outlook Encrypt menu",
+      "omitWhenBlank": true,
+      "options": [
+        {
+          "label": "Do not change",
+          "value": ""
+        },
+        {
+          "label": "Hide",
+          "value": true
+        },
+        {
+          "label": "Show",
+          "value": false
+        }
+      ],
+      "default": ""
+    },
+    "TransportDecryptionSetting": {
+      "type": "autoComplete",
+      "multiple": false,
+      "creatable": false,
+      "label": "Transport decryption",
+      "helperText": "Disabled leaves protected mail encrypted in transit, Optional decrypts it where possible and delivers either way, Mandatory rejects mail it cannot decrypt.",
+      "omitWhenBlank": true,
+      "options": [
+        {
+          "label": "Do not change",
+          "value": ""
+        },
+        {
+          "label": "Disabled",
+          "value": "Disabled"
+        },
+        {
+          "label": "Optional",
+          "value": "Optional"
+        },
+        {
+          "label": "Mandatory",
+          "value": "Mandatory"
+        }
+      ],
+      "default": ""
+    }
+  },
+  "expected": {
+    "AzureRMSLicensingEnabled": true,
+    "SimplifiedClientAccessEnabled": true,
+    "EnablePdfEncryption": "%EnablePdfEncryption%",
+    "DecryptAttachmentForEncryptOnly": "%DecryptAttachmentForEncryptOnly%",
+    "SimplifiedClientAccessDoNotForwardDisabled": "%SimplifiedClientAccessDoNotForwardDisabled%",
+    "SimplifiedClientAccessEncryptOnlyDisabled": "%SimplifiedClientAccessEncryptOnlyDisabled%",
+    "TransportDecryptionSetting": "%TransportDecryptionSetting%"
+  },
+  "read": {
+    "cacheType": "ExoIRMConfiguration"
+  },
+  "remediate": {
+    "executor": "ExoRequest",
+    "cmdlets": [
+      {
+        "cmdlet": "Set-IRMConfiguration",
+        "params": {
+          "AzureRMSLicensingEnabled": true,
+          "SimplifiedClientAccessEnabled": true,
+          "EnablePdfEncryption": "%EnablePdfEncryption%",
+          "DecryptAttachmentForEncryptOnly": "%DecryptAttachmentForEncryptOnly%",
+          "SimplifiedClientAccessDoNotForwardDisabled": "%SimplifiedClientAccessDoNotForwardDisabled%",
+          "SimplifiedClientAccessEncryptOnlyDisabled": "%SimplifiedClientAccessEncryptOnlyDisabled%",
+          "TransportDecryptionSetting": "%TransportDecryptionSetting%"
+        }
+      }
+    ]
+  }
+}

backend/Config/BaselineStandards/Exchange Standards/SetDefaultMailboxFont.json

@@ -0,0 +1,93 @@
+{
+  "name": "SetDefaultMailboxFont",
+  "label": "Set default mailbox font, size and colour",
+  "cat": "Exchange Standards",
+  "tag": [],
+  "impact": "Low Impact",
+  "helpText": "Sets the default compose font name, size and colour for all user and shared mailboxes. Font size is the 1-7 scale Exchange stores, not a point size. Applies to Outlook on the web and new Outlook only - classic Outlook for Windows/Mac uses its own local font settings and is not affected.",
+  "executiveText": "Applies a consistent default font, size and colour to outgoing email so that messages from across the organisation look uniform and on-brand. This affects the web and new Outlook clients; users can still change the font on an individual message.",
+  "docsDescription": "Loops through all UserMailbox and SharedMailbox recipients and sets the Outlook on the web default compose font using `Set-MailboxMessageConfiguration`. The font is read from the MailboxMessageConfiguration cache, refreshed when older than 3 hours, and mailboxes already matching the configured font are skipped, so steady-state runs make no writes. Mailboxes whose message configuration cannot be read are reported as drift. Font size is the integer 1-7 scale Exchange stores rather than a point size: 3 is the Exchange default and corresponds to 12pt. Note that these settings apply to Outlook on the web and the new Outlook client only; classic Outlook for Windows and Mac read their compose font from local client settings. See [Microsoft's documentation.](https://learn.microsoft.com/powershell/module/exchangepowershell/set-mailboxmessageconfiguration)",
+  "impactColour": "info",
+  "addedDate": "2026-08-04",
+  "powershellEquivalent": "Set-MailboxMessageConfiguration -DefaultFontName -DefaultFontSize -DefaultFontColor",
+  "recommendedBy": [],
+  "requiredCapabilities": [
+    "EXCHANGE_S_STANDARD",
+    "EXCHANGE_S_ENTERPRISE",
+    "EXCHANGE_S_STANDARD_GOV",
+    "EXCHANGE_S_ENTERPRISE_GOV",
+    "EXCHANGE_LITE"
+  ],
+  "secureScoreImpact": 0,
+  "compare": "subset",
+  "variables": {
+    "DefaultFontName": {
+      "type": "autoComplete",
+      "multiple": false,
+      "creatable": true,
+      "required": true,
+      "label": "Default font name",
+      "helperText": "Font applied to new messages. You can type a font that is not in this list.",
+      "options": [
+        { "label": "Aptos", "value": "Aptos" },
+        { "label": "Arial", "value": "Arial" },
+        { "label": "Calibri", "value": "Calibri" },
+        { "label": "Cambria", "value": "Cambria" },
+        { "label": "Georgia", "value": "Georgia" },
+        { "label": "Helvetica", "value": "Helvetica" },
+        { "label": "Segoe UI", "value": "Segoe UI" },
+        { "label": "Tahoma", "value": "Tahoma" },
+        { "label": "Times New Roman", "value": "Times New Roman" },
+        { "label": "Trebuchet MS", "value": "Trebuchet MS" },
+        { "label": "Verdana", "value": "Verdana" }
+      ]
+    },
+    "DefaultFontSize": {
+      "type": "number",
+      "required": true,
+      "label": "Default font size (1-7)",
+      "default": 3,
+      "helperText": "Exchange stores a 1-7 size scale, not a point size. 3 is the Exchange default and corresponds to 12pt; lower is smaller, higher is larger.",
+      "validators": {
+        "min": { "value": 1, "message": "Minimum value is 1" },
+        "max": { "value": 7, "message": "Maximum value is 7" }
+      }
+    },
+    "DefaultFontColor": {
+      "type": "textField",
+      "required": true,
+      "label": "Default font colour",
+      "placeholder": "#000000",
+      "helperText": "Six-digit hex colour in the #xxxxxx format, for example #000000. Exchange stores six digits, so shorthand such as #000 is not accepted.",
+      "validators": {
+        "pattern": {
+          "value": "^#[0-9A-Fa-f]{6}$",
+          "message": "Must be a six-digit hex colour such as #000000"
+        }
+      }
+    }
+  },
+  "expected": {
+    "offenders": [],
+    "unreadable": []
+  },
+  "read": {
+    "cacheType": "MailboxMessageConfiguration",
+    "requiredCaches": ["MailboxMessageConfiguration"]
+  },
+  "prepare": "Get-CIPPBaselineSetDefaultMailboxFontState",
+  "remediate": {
+    "executor": "ExoBulkSweep",
+    "writes": [
+      {
+        "cmdlet": "Set-MailboxMessageConfiguration",
+        "params": {
+          "Identity": "%id%",
+          "DefaultFontName": "%DefaultFontName%",
+          "DefaultFontSize": "%DefaultFontSize%",
+          "DefaultFontColor": "%DefaultFontColor%"
+        }
+      }
+    ]
+  }
+}