')
$IntroText = "The following licenses have not yet been found at Sherweb, and are expiring within 7 days:
$dataHTML"
if ($data.SherwebMig -like '*buy*') {
$introText = "The following licenses have not yet been found at Sherweb, and are expiring within 7 days. We have started the process to automatically buy these licenses:
$dataHTML"
}
}
if ($InputObject -eq 'sherwebmigfailcancel') {
- $DataHTML = ($Data | ConvertTo-Html | Out-String).Replace('', ' ')
+ $DataHTML = ($Data | ConvertTo-Html -Fragment | Out-String).Replace('', ' ')
$IntroText = "The following licenses have not been cancelled due to an API error at the old provider:
$dataHTML"
}
if ($InputObject -eq 'sherwebmigBuyFail') {
- $DataHTML = ($Data | ConvertTo-Html | Out-String).Replace('', ' ')
+ $DataHTML = ($Data | ConvertTo-Html -Fragment | Out-String).Replace('', ' ')
$IntroText = "The following licenses have not been bought as we could not find a correctly matching license. Please login and buy the license:
$dataHTML"
}
if ($InputObject -eq 'table') {
#data can be a array of strings or a string, if it is, we need to convert it to an object so it shows up nicely, that object will have one header: message.
- $DataHTML = ($Data | Select-Object * -ExcludeProperty Etag, PartitionKey, TimeStamp | ConvertTo-Html | Out-String).Replace('', ' ')
+ $DataHTML = ($Data | Select-Object * -ExcludeProperty Etag, PartitionKey, TimeStamp | ConvertTo-Html -Fragment | Out-String).Replace('', ' ')
$IntroText = "You've configured CIPP to send you alerts based on the logbook. The following alerts match your configured rules
$dataHTML"
# Add alert comment if provided
diff --git a/Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1 b/Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1
index 6f7251b04034a..ea3e9ded38515 100644
--- a/Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1
@@ -88,6 +88,14 @@ function Set-CIPPSPOTenant {
if ($PSCmdlet.ShouldProcess(($Properties.Keys -join ', '), 'Set Tenant Properties')) {
New-GraphPostRequest -scope "$AdminURL/.default" -tenantid $TenantFilter -Uri "$AdminURL/_vti_bin/client.svc/ProcessQuery" -Type POST -Body $XML -ContentType 'text/xml' -AddedHeaders $AdditionalHeaders
+
+ # Invalidate cached tenant data so subsequent reads reflect the change
+ $Table = Get-CIPPTable -tablename 'cachespotenant'
+ $SafeTenantFilter = ConvertTo-CIPPODataFilterValue -Value $TenantFilter -Type String
+ $CacheEntity = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'Tenant' and RowKey eq '$SafeTenantFilter'"
+ if ($CacheEntity) {
+ Remove-AzDataTableEntity @Table -Entity $CacheEntity
+ }
}
}
}
diff --git a/Modules/CIPPCore/Public/Set-CIPPStandardsCompareField.ps1 b/Modules/CIPPCore/Public/Set-CIPPStandardsCompareField.ps1
index ab01757ac4e6f..f22252fc4165c 100644
--- a/Modules/CIPPCore/Public/Set-CIPPStandardsCompareField.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPStandardsCompareField.ps1
@@ -70,7 +70,7 @@ function Set-CIPPStandardsCompareField {
if ($ExistingHash.ContainsKey($Field.FieldName)) {
$Entity = $ExistingHash[$Field.FieldName]
$Entity.Value = $NormalizedValue
- $Entity | Add-Member -NotePropertyName TemplateId -NotePropertyValue ([string]$script:CippStandardInfoStorage.Value.StandardTemplateId) -Force
+ $Entity | Add-Member -NotePropertyName TemplateId -NotePropertyValue ([string]$global:CippStandardInfoStorage.Value.StandardTemplateId) -Force
$Entity | Add-Member -NotePropertyName LicenseAvailable -NotePropertyValue ([bool]$Field.LicenseAvailable) -Force
$Entity | Add-Member -NotePropertyName CurrentValue -NotePropertyValue ([string]$Field.CurrentValue) -Force
$Entity | Add-Member -NotePropertyName ExpectedValue -NotePropertyValue ([string]$Field.ExpectedValue) -Force
@@ -79,7 +79,7 @@ function Set-CIPPStandardsCompareField {
PartitionKey = [string]$TenantName.defaultDomainName
RowKey = [string]$Field.FieldName
Value = $NormalizedValue
- TemplateId = [string]$script:CippStandardInfoStorage.Value.StandardTemplateId
+ TemplateId = [string]$global:CippStandardInfoStorage.Value.StandardTemplateId
LicenseAvailable = [bool]$Field.LicenseAvailable
CurrentValue = [string]$Field.CurrentValue
ExpectedValue = [string]$Field.ExpectedValue
@@ -106,7 +106,7 @@ function Set-CIPPStandardsCompareField {
try {
if ($Existing) {
$Existing.Value = $NormalizedValue
- $Existing | Add-Member -NotePropertyName TemplateId -NotePropertyValue ([string]$script:CippStandardInfoStorage.Value.StandardTemplateId) -Force
+ $Existing | Add-Member -NotePropertyName TemplateId -NotePropertyValue ([string]$global:CippStandardInfoStorage.Value.StandardTemplateId) -Force
$Existing | Add-Member -NotePropertyName LicenseAvailable -NotePropertyValue ([bool]$LicenseAvailable) -Force
$Existing | Add-Member -NotePropertyName CurrentValue -NotePropertyValue ([string]$CurrentValue) -Force
$Existing | Add-Member -NotePropertyName ExpectedValue -NotePropertyValue ([string]$ExpectedValue) -Force
@@ -116,7 +116,7 @@ function Set-CIPPStandardsCompareField {
PartitionKey = [string]$TenantName.defaultDomainName
RowKey = [string]$FieldName
Value = $NormalizedValue
- TemplateId = [string]$script:CippStandardInfoStorage.Value.StandardTemplateId
+ TemplateId = [string]$global:CippStandardInfoStorage.Value.StandardTemplateId
LicenseAvailable = [bool]$LicenseAvailable
CurrentValue = [string]$CurrentValue
ExpectedValue = [string]$ExpectedValue
diff --git a/Modules/CIPPCore/Public/Test-CIPPAccessPermissions.ps1 b/Modules/CIPPCore/Public/Test-CIPPAccessPermissions.ps1
index 9843f4c7de098..fe23662fcb033 100644
--- a/Modules/CIPPCore/Public/Test-CIPPAccessPermissions.ps1
+++ b/Modules/CIPPCore/Public/Test-CIPPAccessPermissions.ps1
@@ -115,11 +115,6 @@ function Test-CIPPAccessPermissions {
}
}
$Success = $false
- $Links.Add([PSCustomObject]@{
- Text = 'Permissions'
- Href = 'https://docs.cipp.app/setup/installation/permissions'
- }
- ) | Out-Null
} else {
$Messages.Add('You have all the required permissions.') | Out-Null
}
diff --git a/Modules/CIPPCore/Public/Test-CIPPGDAPRelationships.ps1 b/Modules/CIPPCore/Public/Test-CIPPGDAPRelationships.ps1
index b078eead29325..590fef5f8ddf8 100644
--- a/Modules/CIPPCore/Public/Test-CIPPGDAPRelationships.ps1
+++ b/Modules/CIPPCore/Public/Test-CIPPGDAPRelationships.ps1
@@ -20,7 +20,7 @@ function Test-CIPPGDAPRelationships {
Issue = 'This tenant only has a MLT(Microsoft Led Transition) relationship. This is a read-only relationship. You must migrate this tenant to GDAP.'
Tenant = [string]$Tenant.Group.customer.displayName
Relationship = [string]$Tenant.Group.displayName
- Link = 'https://docs.cipp.app/setup/gdap/index'
+ Link = 'https://docs.cipp.app/setup/installation/gdap-invite-wizard'
}) | Out-Null
}
foreach ($Group in $Tenant.Group) {
diff --git a/Modules/CIPPCore/Public/Test-CustomScriptSecurity.ps1 b/Modules/CIPPCore/Public/Test-CustomScriptSecurity.ps1
index 0eb7f4b522b04..323ef953cb5f2 100644
--- a/Modules/CIPPCore/Public/Test-CustomScriptSecurity.ps1
+++ b/Modules/CIPPCore/Public/Test-CustomScriptSecurity.ps1
@@ -59,7 +59,10 @@ function Test-CustomScriptSecurity {
'ConvertTo-Json', 'ConvertFrom-Json', 'Write-Output', 'Write-Host',
# CIPP data access (read-only)
- 'New-CIPPDbRequest', 'Get-CIPPDbItem', 'Get-CIPPTestData'
+ 'New-CIPPDbRequest', 'Get-CIPPDbItem', 'Get-CIPPTestData',
+
+ # Test specific methods
+ 'Add-CIPPTestResult'
)
# Find all command invocations (exclude hashtable key assignments and property access)
diff --git a/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1 b/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1
index 5887377fd3c07..5f5e997a0eb01 100644
--- a/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1
+++ b/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1
@@ -19,6 +19,10 @@ function Get-CIPPSchedulerBlockedCommands {
'Get-CIPPAuthentication'
'New-CIPPAzServiceSAS'
+ # Az Functions cmdlet
+ 'Get-CIPPAzFunctionAppSetting'
+ 'Update-CIPPAzFunctionAppSetting'
+
# Extension authentication tokens
'Get-GradientToken'
'Get-HaloToken'
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheOneDriveUsage.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheOneDriveUsage.ps1
index 152bd22aa1d5e..4dedf324a0c20 100644
--- a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheOneDriveUsage.ps1
+++ b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheOneDriveUsage.ps1
@@ -17,14 +17,52 @@ function Set-CIPPDBCacheOneDriveUsage {
)
try {
- Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching OneDrive usage' -sev Debug
-
- $OneDriveUsage = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getOneDriveUsageAccountDetail(period='D7')?`$format=application%2fjson" -tenantid $TenantFilter
- $OneDriveUsage | ForEach-Object { $_ | Add-Member -NotePropertyName 'userPrincipalName' -NotePropertyValue $_.ownerPrincipalName -Force }
- Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'OneDriveUsage' -Data $OneDriveUsage
- Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'OneDriveUsage' -Data $OneDriveUsage -Count
- $OneDriveUsage = $null
- Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached OneDrive usage successfully' -sev Debug
+ Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching OneDrive site listing and usage' -sev Debug
+
+ $BulkRequests = @(
+ @{
+ id = 'listAllSites'
+ method = 'GET'
+ url = "sites/getAllSites?`$filter=isPersonalSite eq true&`$select=id,createdDateTime,description,name,displayName,isPersonalSite,lastModifiedDateTime,webUrl,siteCollection,sharepointIds&`$top=999"
+ }
+ @{
+ id = 'usage'
+ method = 'GET'
+ url = "reports/getOneDriveUsageAccountDetail(period='D7')?`$format=application/json&`$top=999"
+ }
+ )
+
+ $Result = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($BulkRequests) -asapp $true
+ $Sites = @(($Result | Where-Object { $_.id -eq 'listAllSites' }).body.value)
+ $UsageBase64 = ($Result | Where-Object { $_.id -eq 'usage' }).body
+ $UsageJson = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($UsageBase64))
+ $OneDriveUsage = @(($UsageJson | ConvertFrom-Json).value)
+
+ foreach ($UsageRow in $OneDriveUsage) {
+ $UsageRow | Add-Member -NotePropertyName 'id' -NotePropertyValue $UsageRow.siteId -Force
+ $UsageRow | Add-Member -NotePropertyName 'userPrincipalName' -NotePropertyValue $UsageRow.ownerPrincipalName -Force
+ }
+
+ $OneDriveListing = [System.Collections.Generic.List[object]]::new()
+ foreach ($Site in $Sites) {
+ $OneDriveListing.Add([PSCustomObject]@{
+ id = $Site.id
+ sharepointIds = $Site.sharepointIds
+ createdDateTime = $Site.createdDateTime
+ displayName = $Site.displayName
+ webUrl = $Site.webUrl
+ isPersonalSite = $Site.isPersonalSite
+ AutoMapUrl = ''
+ })
+ }
+
+ Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'OneDriveSiteListing' -Data @($OneDriveListing)
+ Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'OneDriveSiteListing' -Data @($OneDriveListing) -Count
+
+ Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'OneDriveUsage' -Data @($OneDriveUsage)
+ Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'OneDriveUsage' -Data @($OneDriveUsage) -Count
+
+ Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached OneDrive site listing and usage successfully' -sev Debug
} catch {
Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache OneDrive usage: $($_.Exception.Message)" -sev Error
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1
new file mode 100644
index 0000000000000..90ab81351b7af
--- /dev/null
+++ b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1
@@ -0,0 +1,96 @@
+function Set-CIPPDBCacheSharePointSiteUsage {
+ <#
+ .SYNOPSIS
+ Caches SharePoint site listing and site usage details for a tenant
+
+ .PARAMETER TenantFilter
+ The tenant to cache SharePoint site usage for
+
+ .PARAMETER QueueId
+ The queue ID to update with total tasks (optional)
+ #>
+ [CmdletBinding()]
+ param(
+ [Parameter(Mandatory = $true)]
+ [string]$TenantFilter,
+ [string]$QueueId
+ )
+
+ try {
+ Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching SharePoint site listing and usage' -sev Debug
+
+ $Tenant = Get-Tenants -TenantFilter $TenantFilter
+ $TenantId = $Tenant.customerId
+
+ $BulkRequests = @(
+ @{
+ id = 'listAllSites'
+ method = 'GET'
+ url = "sites/getAllSites?`$filter=isPersonalSite eq false&`$select=id,createdDateTime,description,name,displayName,isPersonalSite,lastModifiedDateTime,webUrl,siteCollection,sharepointIds&`$top=999"
+ }
+ @{
+ id = 'usage'
+ method = 'GET'
+ url = "reports/getSharePointSiteUsageDetail(period='D7')?`$format=application/json&`$top=999"
+ }
+ )
+
+ $Result = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($BulkRequests) -asapp $true
+ $Sites = @(($Result | Where-Object { $_.id -eq 'listAllSites' }).body.value)
+ $UsageBase64 = ($Result | Where-Object { $_.id -eq 'usage' }).body
+ $UsageJson = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($UsageBase64))
+ $UsageRows = @(($UsageJson | ConvertFrom-Json).value)
+
+ # Ensure a stable row key for usage rows.
+ foreach ($UsageRow in $UsageRows) {
+ $UsageRow | Add-Member -NotePropertyName 'id' -NotePropertyValue $UsageRow.siteId -Force
+ }
+
+ $SiteListing = [System.Collections.Generic.List[object]]::new()
+ foreach ($Site in $Sites) {
+ $SiteListing.Add([PSCustomObject]@{
+ id = $Site.id
+ sharepointIds = $Site.sharepointIds
+ createdDateTime = $Site.createdDateTime
+ displayName = $Site.displayName
+ webUrl = $Site.webUrl
+ isPersonalSite = $Site.isPersonalSite
+ AutoMapUrl = ''
+ })
+ }
+
+ $RequestId = 0
+ $ListRequests = foreach ($Site in $SiteListing) {
+ @{
+ id = $RequestId++
+ method = 'GET'
+ url = "sites/$($Site.sharepointIds.siteId)/lists?`$select=id,name,list,parentReference"
+ }
+ }
+
+ $LibraryLists = @()
+ if ($ListRequests.Count -gt 0) {
+ try {
+ $LibraryLists = @((New-GraphBulkRequest -tenantid $TenantFilter -scope 'https://graph.microsoft.com/.default' -Requests @($ListRequests) -asapp $true).body.value | Where-Object { $_.list.template -eq 'DocumentLibrary' })
+ } catch {
+ Write-LogMessage -Message "Error getting auto map urls for SharePoint cache: $($_.Exception.Message)" -Sev 'Error' -tenant $TenantFilter -API 'CIPPDBCache' -LogData (Get-CippException -Exception $_)
+ }
+ }
+
+ foreach ($Site in $SiteListing) {
+ $ListId = ($LibraryLists | Where-Object { $_.parentReference.siteId -like "*$($Site.sharepointIds.siteId)*" } | Select-Object -First 1 -ExpandProperty id)
+ $Site.AutoMapUrl = "tenantId=$($TenantId)&webId={$($Site.sharepointIds.webId)}&siteid={$($Site.sharepointIds.siteId)}&webUrl=$($Site.webUrl)&listId={$($ListId)}"
+ }
+
+ Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SharePointSiteListing' -Data @($SiteListing)
+ Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SharePointSiteListing' -Data @($SiteListing) -Count
+
+ Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SharePointSiteUsage' -Data @($UsageRows)
+ Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SharePointSiteUsage' -Data @($UsageRows) -Count
+
+ Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached SharePoint site listing and usage successfully' -sev Debug
+
+ } catch {
+ Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache SharePoint site usage: $($_.Exception.Message)" -sev Error -LogData (Get-CippException -Exception $_)
+ }
+}
\ No newline at end of file
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCache.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCache.ps1
index 51a56d7ff61a0..0a4d9b5e1fe2b 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCache.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCache.ps1
@@ -13,6 +13,11 @@ function Invoke-ExecCIPPDBCache {
$Name = $Request.Query.Name
$Types = $Request.Query.Types
+ $ParsedTypes = @()
+ if (-not [string]::IsNullOrWhiteSpace($Types)) {
+ $ParsedTypes = @($Types -split ',' | ForEach-Object { $_.Trim() } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -and $_ -ne 'None' })
+ }
+
Write-Information "ExecCIPPDBCache called with Name: '$Name', TenantFilter: '$TenantFilter', Types: '$Types'"
try {
@@ -66,8 +71,8 @@ function Invoke-ExecCIPPDBCache {
QueueId = $Queue.RowKey
}
# Add Types parameter if provided
- if ($Types) {
- $BatchItem | Add-Member -NotePropertyName 'Types' -NotePropertyValue @($Types -split ',') -Force
+ if ($ParsedTypes.Count -gt 0) {
+ $BatchItem | Add-Member -NotePropertyName 'Types' -NotePropertyValue $ParsedTypes -Force
}
$BatchItem
}
@@ -91,8 +96,8 @@ function Invoke-ExecCIPPDBCache {
QueueId = $Queue.RowKey
}
# Add Types parameter if provided
- if ($Types) {
- $BatchItem | Add-Member -NotePropertyName 'Types' -NotePropertyValue @($Types -split ',') -Force
+ if ($ParsedTypes.Count -gt 0) {
+ $BatchItem | Add-Member -NotePropertyName 'Types' -NotePropertyValue $ParsedTypes -Force
}
$InputObject = [PSCustomObject]@{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1
index 61a8266714f32..8f98217f1ed2b 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1
@@ -1,9 +1,9 @@
-Function Invoke-GetVersion {
+function Invoke-GetVersion {
<#
.FUNCTIONALITY
Entrypoint,AnyTenant
.ROLE
- CIPP.AppSettings.Read
+ CIPP.Core.Read
#>
[CmdletBinding()]
param($Request, $TriggerMetadata)
@@ -15,5 +15,4 @@ Function Invoke-GetVersion {
StatusCode = [HttpStatusCode]::OK
Body = $Version
})
-
}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1
index 4452b4023795e..8315d00c1ca67 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1
@@ -29,6 +29,7 @@ function Invoke-ExecApiClient {
}
}
'AddUpdate' {
+ $Results = [System.Collections.Generic.List[object]]::new()
if ($Request.Body.ClientId -or $Request.Body.AppName) {
$ClientId = $Request.Body.ClientId.value ?? $Request.Body.ClientId
$AddUpdateSuccess = $false
@@ -75,12 +76,16 @@ function Invoke-ExecApiClient {
}
}
+ $IPValidationErrors = [System.Collections.Generic.List[string]]::new()
if ($Request.Body.IpRange.value) {
$IpRange = [System.Collections.Generic.List[string]]::new()
$regexPattern = '^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:/\d{1,2})?|(?:[0-9A-Fa-f]{1,4}:){1,7}[0-9A-Fa-f]{1,4}(?:/\d{1,3})?)$'
foreach ($IP in @($Request.Body.IPRange.value)) {
+ $IP = $IP.Trim()
if ($IP -match $regexPattern) {
$IpRange.Add($IP)
+ } else {
+ $IPValidationErrors.Add("'$IP' is not a valid IP address or CIDR range.")
}
}
} else {
@@ -88,8 +93,8 @@ function Invoke-ExecApiClient {
}
if (!$AddUpdateSuccess) {
- $Body = @{
- Results = @($AddedText)
+ if ($AddedText) {
+ $Results.Add($AddedText)
}
} else {
$ExistingClient = Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq '$($ClientId)'"
@@ -100,13 +105,13 @@ function Invoke-ExecApiClient {
$Client.Enabled = $Request.Body.Enabled ?? $false
Write-LogMessage -headers $Request.Headers -API 'ExecApiClient' -message "Updated API client $($Request.Body.ClientId)" -Sev 'Info'
if ($APIConfig.ApplicationSecret) {
- $Results = @{
- resultText = "API client updated and application secret reset for '$($Client.AppName)'. Use the Copy to Clipboard button to retrieve the new secret."
- copyField = $APIConfig.ApplicationSecret
- state = 'success'
- }
+ $Results.Add(@{
+ resultText = "API client updated and application secret reset for '$($Client.AppName)'. Use the Copy to Clipboard button to retrieve the new secret."
+ copyField = $APIConfig.ApplicationSecret
+ state = 'success'
+ })
} else {
- $Results = 'API client updated'
+ $Results.Add('API client updated')
}
} else {
$Client = @{
@@ -117,14 +122,30 @@ function Invoke-ExecApiClient {
'IPRange' = "$(@($IpRange) | ConvertTo-Json -Compress)"
'Enabled' = $Request.Body.Enabled ?? $false
}
- $Results = @{
- resultText = "API Client created with the name '$($Client.AppName)'. Use the Copy to Clipboard button to retrieve the secret."
- copyField = $APIConfig.ApplicationSecret
- state = 'success'
- }
+ $Results.Add(@{
+ resultText = "API Client created with the name '$($Client.AppName)'. Use the Copy to Clipboard button to retrieve the secret."
+ copyField = $APIConfig.ApplicationSecret
+ state = 'success'
+ })
}
Add-CIPPAzDataTableEntity @Table -Entity $Client -Force | Out-Null
+ }
+
+ if ($IPValidationErrors.Count -gt 0) {
+ foreach ($ValidationError in $IPValidationErrors) {
+ $Results.Add(@{
+ resultText = $ValidationError
+ state = 'warning'
+ })
+ }
+ }
+
+ if (!$AddUpdateSuccess) {
+ $Body = @{
+ Results = @($Results)
+ }
+ } else {
$Body = @($Results)
}
}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1
index 5913bf9275e72..fb26f73d997c1 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1
@@ -14,7 +14,7 @@ function Invoke-ExecRestoreBackup {
$AzureTableTypes = @(
[string], [int], [long], [double], [bool], [datetime], [guid], [byte[]]
)
- $RestrictedTables = @('AccessRoleGroups', 'CustomRoles') # tables that require superadmin to restore
+ $RestrictedTables = @('AccessRoleGroups', 'AccessIPRanges', 'CustomRoles') # tables that require superadmin to restore
# Resolve the calling user's roles, including Entra group-based roles
$CallingUser = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1
index 2c631f69154f5..b6f95c20f1127 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1
@@ -190,7 +190,7 @@ function Invoke-EditUser {
Write-Host "About to add $($UserObj.userPrincipalName) to $GroupName. Group ID is: $GroupID and type is: $GroupType"
try {
- if ($GroupType -eq 'Distribution list' -or $GroupType -eq 'Mail-Enabled Security') {
+ if ($GroupType -eq 'distributionList' -or $GroupType -eq 'security') {
Write-Host 'Adding to group via Add-DistributionGroupMember'
$Params = @{ Identity = $GroupID; Member = $UserObj.id; BypassSecurityGroupManagerCheck = $true }
$null = New-ExoRequest -tenantid $UserObj.tenantFilter -cmdlet 'Add-DistributionGroupMember' -cmdParams $params -UseSystemMailbox $true
@@ -222,7 +222,7 @@ function Invoke-EditUser {
Write-Host "About to remove $($UserObj.userPrincipalName) from $GroupName. Group ID is: $GroupID and type is: $GroupType"
try {
- if ($GroupType -eq 'Distribution list' -or $GroupType -eq 'Mail-Enabled Security') {
+ if ($GroupType -eq 'distributionList' -or $GroupType -eq 'security') {
Write-Host 'Removing From group via Remove-DistributionGroupMember'
$Params = @{ Identity = $GroupID; Member = $UserObj.id; BypassSecurityGroupManagerCheck = $true }
$null = New-ExoRequest -tenantid $UserObj.tenantFilter -cmdlet 'Remove-DistributionGroupMember' -cmdParams $params -UseSystemMailbox $true
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRefresh.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRefresh.ps1
new file mode 100644
index 0000000000000..19f79b929263e
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRefresh.ps1
@@ -0,0 +1,41 @@
+function Invoke-ExecTestRefresh {
+ <#
+ .FUNCTIONALITY
+ Entrypoint
+ .ROLE
+ Tenant.Tests.ReadWrite
+ #>
+ param($Request, $TriggerMetadata)
+
+ $APIName = $TriggerMetadata.FunctionName
+ Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message 'Accessed this API' -Sev 'Debug'
+
+ try {
+ $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+ $TestName = $Request.Query.testName ?? $Request.Body.testName
+ $Function = 'Invoke-CippTest{0}' -f $TestName
+ if (Get-Command -Name $Function -Module 'CIPPTests' -ErrorAction SilentlyContinue) {
+ $TestResult = & $Function -Tenant $TenantFilter
+ $Table = Get-CippTable -tablename 'CippTestResults'
+ Add-CIPPAzDataTableEntity @Table -Entity $TestResult -Force
+ $StatusCode = [HttpStatusCode]::OK
+ $Body = [PSCustomObject]@{ Results = "Successfully updated test $TestName for tenant $TenantFilter"; Metadata = $TestResult }
+ } else {
+ return ([HttpResponseContext]@{
+ StatusCode = [HttpStatusCode]::NotFound
+ Body = @{ Message = "Test function not found: $Function" }
+ })
+ }
+ } catch {
+ $StatusCode = [HttpStatusCode]::BadRequest
+ $Body = @{
+ Message = "Failed to update test $TestName for $TenantFilter"
+ Error = Get-CippException -Exception $_
+ }
+ }
+
+ return ([HttpResponseContext]@{
+ StatusCode = $StatusCode
+ Body = $Body
+ })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1
index dd112c3f16eca..d8aae26f59985 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1
@@ -12,7 +12,7 @@ function Invoke-ListSites {
$TenantFilter = $Request.Query.TenantFilter
$Type = $Request.Query.Type
- $UserUPN = $Request.Query.UserUPN
+ $UseReportDB = $Request.Query.UseReportDB
if (!$TenantFilter) {
return ([HttpResponseContext]@{
@@ -28,6 +28,31 @@ function Invoke-ListSites {
})
}
+ if ($TenantFilter -eq 'AllTenants' -or $UseReportDB -eq 'true') {
+ try {
+ if ($Type -eq 'SharePointSiteUsage') {
+ $GraphRequest = Get-CIPPSharePointSiteUsageReport -TenantFilter $TenantFilter -ErrorAction Stop
+ } elseif ($Type -eq 'OneDriveUsageAccount') {
+ $GraphRequest = Get-CIPPOneDriveUsageReport -TenantFilter $TenantFilter -ErrorAction Stop
+ }
+ $StatusCode = [HttpStatusCode]::OK
+ } catch {
+ $StatusCode = [HttpStatusCode]::InternalServerError
+ $GraphRequest = $_.Exception.Message
+ }
+
+ if ($null -ne $GraphRequest) {
+ if ($Request.query.URLOnly -eq 'true') {
+ $GraphRequest = $GraphRequest | Where-Object { $null -ne $_.webUrl }
+ }
+
+ return ([HttpResponseContext]@{
+ StatusCode = $StatusCode
+ Body = @($GraphRequest | Sort-Object -Property displayName)
+ })
+ }
+ }
+
$Tenant = Get-Tenants -TenantFilter $TenantFilter
$TenantId = $Tenant.customerId
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCAExclusion.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCAExclusion.ps1
index 47eb7477cc389..f8936e91f4d1a 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCAExclusion.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCAExclusion.ps1
@@ -37,7 +37,9 @@ function Invoke-ExecCAExclusion {
$VacationGroupName = "Vacation Exclusion - $($Policy.displayName)"
$escapedGroupName = $VacationGroupName -replace "'", "''"
- $VacationGroups = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$select=id,displayName&`$filter=displayName eq '$escapedGroupName' and mailEnabled eq false and securityEnabled eq true" -tenantid $TenantFilter)
+ $groupFilter = "displayName eq '$escapedGroupName' and mailEnabled eq false and securityEnabled eq true"
+ $encodedGroupFilter = [System.Uri]::EscapeDataString($groupFilter)
+ $VacationGroups = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$select=id,displayName&`$filter=$encodedGroupFilter" -tenantid $TenantFilter)
$DuplicateGroupWarning = $null
if ($VacationGroups.Count -eq 0) {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPContracts.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPContracts.ps1
index 0fdf23c0c47bb..a5d762ea88c42 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPContracts.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPContracts.ps1
@@ -13,7 +13,7 @@ function Invoke-ListGDAPContracts {
$Uri = "https://graph.microsoft.com/beta/contracts?`$top=$Top"
try {
- $Results = New-GraphGetRequest -Uri $Uri -tenantid $env:TenantID -NoAuthCheck $true -NoPagination $true -ComplexFilter
+ $Results = New-GraphGetRequest -Uri $Uri -tenantid $env:TenantID -NoAuthCheck $true -ComplexFilter
$Body = @{
Results = @($Results)
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPRelationships.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPRelationships.ps1
index f5893471754ab..c332fc11236e9 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPRelationships.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPRelationships.ps1
@@ -22,7 +22,7 @@ function Invoke-ListGDAPRelationships {
if ($Filter) {
$Uri = "$Uri&`$filter=$Filter"
}
- $Results = New-GraphGetRequest -Uri $Uri -tenantid $env:TenantID -NoAuthCheck $true -NoPagination $true -ComplexFilter
+ $Results = New-GraphGetRequest -Uri $Uri -tenantid $env:TenantID -NoAuthCheck $true -ComplexFilter
}
$Body = @{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPServicePrincipals.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPServicePrincipals.ps1
index ff6c3b2ee1829..2b5cda845dcf6 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPServicePrincipals.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPServicePrincipals.ps1
@@ -49,7 +49,7 @@ function Invoke-ListGDAPServicePrincipals {
$Uri = "https://graph.microsoft.com/beta/servicePrincipals?`$top=$Top&`$select=$Select&`$count=true&`$filter=$Filter"
try {
- $Results = New-GraphGetRequest -Uri $Uri -tenantid $TenantFilter -NoPagination $true -ComplexFilter
+ $Results = New-GraphGetRequest -Uri $Uri -tenantid $TenantFilter -ComplexFilter
$Body = @{
Results = @($Results)
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecUpdateDriftDeviation.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecUpdateDriftDeviation.ps1
index d30a4e899fcd5..78c556cf7abef 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecUpdateDriftDeviation.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecUpdateDriftDeviation.ps1
@@ -43,6 +43,7 @@ function Invoke-ExecUpdateDriftDeviation {
if ($Deviation.status -eq 'DeniedRemediate') {
$Setting = $Deviation.standardName -replace 'standards\.', ''
$StandardTemplate = Get-CIPPTenantAlignment -TenantFilter $TenantFilter | Where-Object -Property standardType -EQ 'drift'
+ $DriftTemplateId = $StandardTemplate.StandardId
if ($Setting -like '*IntuneTemplate*') {
$Setting = 'IntuneTemplate'
$TemplateId = $Deviation.standardName.split('.') | Select-Object -Index 2
@@ -91,7 +92,8 @@ function Invoke-ExecUpdateDriftDeviation {
}
$TaskBody = @{
TenantFilter = $TenantFilter
- Name = "One Off Drift Remediation: $Setting - $TenantFilter"
+ Name = "One Off Drift Remediation: $Setting - $TenantFilter - $DriftTemplateId"
+ Tag = "DriftRemediation_$DriftTemplateId"
Command = @{
value = "Invoke-CIPPStandard$Setting"
label = "Invoke-CIPPStandard$Setting"
@@ -114,7 +116,8 @@ function Invoke-ExecUpdateDriftDeviation {
if ($PersistentDeny) {
$PersistentTaskBody = @{
TenantFilter = $TenantFilter
- Name = "Persistent Drift Remediation: $Setting - $TenantFilter"
+ Name = "Persistent Drift Remediation: $Setting - $TenantFilter - $DriftTemplateId"
+ Tag = "DriftRemediation_$DriftTemplateId"
Command = @{
value = "Invoke-CIPPStandard$Setting"
label = "Invoke-CIPPStandard$Setting"
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveStandardTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveStandardTemplate.ps1
index 8289b20e28294..94444123db7f2 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveStandardTemplate.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveStandardTemplate.ps1
@@ -26,7 +26,20 @@ function Invoke-RemoveStandardTemplate {
}
$Entities = Get-AzDataTableEntity @Table -Filter $Filter
Remove-AzDataTableEntity -Force @Table -Entity $Entities
+
+ # Remove any drift remediation scheduled tasks associated with this template
+ $ScheduledTasksTable = Get-CIPPTable -TableName 'ScheduledTasks'
+ $SafeTag = ConvertTo-CIPPODataFilterValue -Value "DriftRemediation_$SafeID"
+ $DriftTasks = Get-CIPPAzDataTableEntity @ScheduledTasksTable -Filter "PartitionKey eq 'ScheduledTask' and Tag eq '$SafeTag'"
+ foreach ($DriftTask in $DriftTasks) {
+ Remove-AzDataTableEntity -Force @ScheduledTasksTable -Entity $DriftTask
+ Write-LogMessage -Headers $Headers -API $APIName -message "Removed drift remediation scheduled task: $($DriftTask.Name)" -Sev Info
+ }
+
$Result = "Removed Standards Template named: '$($TemplateName)' with id: $($ID)"
+ if ($DriftTasks) {
+ $Result += ". Also removed $(@($DriftTasks).Count) associated drift remediation scheduled task(s)."
+ }
Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev Info
$StatusCode = [HttpStatusCode]::OK
} catch {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1
index 9c1a246e30261..42ed1cad9c171 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1
@@ -23,7 +23,7 @@ function Invoke-ListCommunityRepos {
$Repos = Get-CIPPAzDataTableEntity @Table -Filter $Filter
if (!$Request.Query.WriteAccess) {
- $CommunityRepos = Join-Path $env:CIPPRootPath 'CommunityRepos.json'
+ $CommunityRepos = Join-Path $env:CIPPRootPath 'Config\CommunityRepos.json'
$DefaultCommunityRepos = [System.IO.File]::ReadAllText($CommunityRepos) | ConvertFrom-Json
$DefaultsMissing = $false
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
index 630fae2c07470..fb2bb660567b6 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
@@ -51,7 +51,7 @@ function Invoke-CIPPStandardDelegateSentItems {
}
$Mailboxes = New-CippDbRequest -TenantFilter $Tenant -Type 'Mailboxes'
if ($Settings.IncludeUserMailboxes -eq $true) {
- $Mailboxes = $Mailboxes | Where-Object { $_.recipientTypeDetails -ne 'DiscoveryMailbox' -and ($_.MessageCopyForSendOnBehalfEnabled -eq $false -or $_.MessageCopyForSentAsEnabled -eq $false) }
+ $Mailboxes = $Mailboxes | Where-Object { $_.recipientTypeDetails -in @('UserMailbox', 'SharedMailbox') -and ($_.MessageCopyForSendOnBehalfEnabled -eq $false -or $_.MessageCopyForSentAsEnabled -eq $false) }
} else {
$Mailboxes = $Mailboxes | Where-Object { $_.recipientTypeDetails -eq 'SharedMailbox' -and ($_.MessageCopyForSendOnBehalfEnabled -eq $false -or $_.MessageCopyForSentAsEnabled -eq $false) }
}
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1
new file mode 100644
index 0000000000000..871aacadaef7a
--- /dev/null
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1
@@ -0,0 +1,90 @@
+function Invoke-CIPPStandardDisableEWS {
+ <#
+ .FUNCTIONALITY
+ Internal
+ .COMPONENT
+ (APIName) DisableEWS
+ .SYNOPSIS
+ (Label) Disable Exchange Web Services
+ .DESCRIPTION
+ (Helptext) Disables Exchange Web Services (EWS) organization-wide. This reduces the attack surface by blocking legacy API access to mailbox data. Warning: This may break Office web add-ins on builds older than 16.0.19127.
+ (DocsDescription) Disables Exchange Web Services (EWS) at the organization level to reduce attack surface. EWS provides cross-platform API access to sensitive Exchange Online data such as emails, meetings, and contacts. If compromised, attackers can access confidential data, send phishing emails, or spoof identities. Disabling EWS also reduces legacy app usage and minimizes exploitable endpoints. Note that this may break first-party features including web add-ins for Word, Excel, PowerPoint, and Outlook on builds older than 16.0.19127.
+ .NOTES
+ CAT
+ Exchange Standards
+ TAG
+ EXECUTIVETEXT
+ Disables Exchange Web Services (EWS) across the organization to reduce attack surface and prevent legacy API access to sensitive mailbox data. This aligns with Microsoft's Baseline Security Mode recommendation to minimize exploitable endpoints while requiring updates to applications that depend on EWS.
+ ADDEDCOMPONENT
+ IMPACT
+ High Impact
+ ADDEDDATE
+ 2026-04-28
+ POWERSHELLEQUIVALENT
+ Set-OrganizationConfig -EwsEnabled $false
+ RECOMMENDEDBY
+ "CIPP"
+ REQUIREDCAPABILITIES
+ "EXCHANGE_S_STANDARD"
+ "EXCHANGE_S_ENTERPRISE"
+ "EXCHANGE_S_STANDARD_GOV"
+ "EXCHANGE_S_ENTERPRISE_GOV"
+ "EXCHANGE_LITE"
+ UPDATECOMMENTBLOCK
+ Run the Tools\Update-StandardsComments.ps1 script to update this comment block
+ .LINK
+ https://docs.cipp.app/user-documentation/tenant/standards/list-standards
+ #>
+
+ param($Tenant, $Settings)
+ $TestResult = Test-CIPPStandardLicense -StandardName 'DisableEWS' -TenantFilter $Tenant -RequiredCapabilities @('EXCHANGE_S_STANDARD', 'EXCHANGE_S_ENTERPRISE', 'EXCHANGE_S_STANDARD_GOV', 'EXCHANGE_S_ENTERPRISE_GOV', 'EXCHANGE_LITE')
+
+ if ($TestResult -eq $false) {
+ return $true
+ }
+
+ try {
+ $EwsStatus = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').EwsEnabled
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableEWS state for $Tenant. Error: $ErrorMessage" -Sev Error
+ return
+ }
+
+ if ($Settings.remediate -eq $true) {
+ if ($EwsStatus -eq $false) {
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Exchange Web Services is already disabled.' -Sev Info
+ } else {
+ try {
+ New-ExoRequest -tenantid $Tenant -cmdlet 'Set-OrganizationConfig' -cmdParams @{ EwsEnabled = $false } -UseSystemMailbox $true
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Successfully disabled Exchange Web Services.' -Sev Info
+ $EwsStatus = $false
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Failed to disable Exchange Web Services. Error: $ErrorMessage" -Sev Error
+ }
+ }
+ }
+
+ if ($Settings.alert -eq $true) {
+ if ($EwsStatus -eq $false) {
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Exchange Web Services is disabled.' -Sev Info
+ } else {
+ Write-StandardsAlert -message 'Exchange Web Services is enabled.' -object $EwsStatus -tenant $Tenant -standardName 'DisableEWS' -standardId $Settings.standardId
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Exchange Web Services is enabled.' -Sev Info
+ }
+ }
+
+ if ($Settings.report -eq $true) {
+ $StateIsCorrect = $EwsStatus -eq $false
+
+ $CurrentValue = [PSCustomObject]@{
+ DisableEWS = $StateIsCorrect
+ }
+ $ExpectedValue = [PSCustomObject]@{
+ DisableEWS = $true
+ }
+ Set-CIPPStandardsCompareField -FieldName 'standards.DisableEWS' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+ Add-CIPPBPAField -FieldName 'DisableEWS' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
+ }
+}
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1
index bd774e10251c9..88cfc645fec0b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1
@@ -6,7 +6,7 @@ function Invoke-CIPPStandardDisableEntraPortal {
(APIName) DisableEntraPortal
.SYNOPSIS
(Label) Disables the Entra Portal for standard users
- https://docs.cipp.app/user-documentation/tenant/standards/edit-standards
+ https://docs.cipp.app/user-documentation/tenant/standards/list-standards
#>
param($Tenant, $Settings)
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1
new file mode 100644
index 0000000000000..61ad08f64475c
--- /dev/null
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1
@@ -0,0 +1,98 @@
+function Invoke-CIPPStandardSPDisableCustomScripts {
+ <#
+ .FUNCTIONALITY
+ Internal
+ .COMPONENT
+ (APIName) SPDisableCustomScripts
+ .SYNOPSIS
+ (Label) Disable custom scripts on SharePoint sites
+ .DESCRIPTION
+ (Helptext) Prevents users from running custom scripts on SharePoint and OneDrive sites. Custom scripts can modify site behaviors and bypass governance controls.
+ (DocsDescription) Disables the ability to add and run custom scripts on SharePoint and OneDrive sites at the tenant level. When custom scripts are allowed, governance cannot be enforced, and the capabilities of inserted code cannot be scoped or blocked. Microsoft recommends using the SharePoint Framework instead of custom scripts.
+ .NOTES
+ CAT
+ SharePoint Standards
+ TAG
+ EXECUTIVETEXT
+ Blocks custom scripts from being added to SharePoint and OneDrive sites, enforcing governance controls and preventing unscoped code execution. This aligns with Microsoft's Baseline Security Mode recommendation to permanently remove the ability to add new custom scripts, directing organizations to use the SharePoint Framework instead.
+ ADDEDCOMPONENT
+ IMPACT
+ High Impact
+ ADDEDDATE
+ 2026-04-28
+ POWERSHELLEQUIVALENT
+ Set-SPOTenant -CustomScriptsRestrictMode $true
+ RECOMMENDEDBY
+ "CIPP"
+ REQUIREDCAPABILITIES
+ "SHAREPOINTWAC"
+ "SHAREPOINTSTANDARD"
+ "SHAREPOINTENTERPRISE"
+ "SHAREPOINTENTERPRISE_EDU"
+ "ONEDRIVE_BASIC"
+ "ONEDRIVE_ENTERPRISE"
+ UPDATECOMMENTBLOCK
+ Run the Tools\Update-StandardsComments.ps1 script to update this comment block
+ .LINK
+ https://docs.cipp.app/user-documentation/tenant/standards/list-standards
+ #>
+
+ param($Tenant, $Settings)
+ $TestResult = Test-CIPPStandardLicense -StandardName 'SPDisableCustomScripts' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+
+ if ($TestResult -eq $false) {
+ return $true
+ }
+
+ try {
+ $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SPDisableCustomScripts state for $Tenant. Error: $ErrorMessage" -Sev Error
+ return
+ }
+
+ if ($null -eq $CurrentState._ObjectIdentity_) {
+ $ErrorDetail = $CurrentState.ErrorInfo ?? 'No tenant data returned from CSOM query'
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SPDisableCustomScripts state for $Tenant. Error: $ErrorDetail" -Sev Error
+ return
+ }
+
+ # CSOM property is CustomScriptsRestrictMode (true = scripts blocked)
+ # NoScriptSite is only a PnP/SPO PowerShell parameter name, not a CSOM property
+ $StateIsCorrect = ($CurrentState.CustomScriptsRestrictMode -eq $true)
+
+ if ($Settings.remediate -eq $true) {
+ if ($StateIsCorrect -eq $true) {
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Custom scripts are already disabled on SharePoint sites.' -Sev Info
+ } else {
+ try {
+ $CurrentState | Set-CIPPSPOTenant -Properties @{ CustomScriptsRestrictMode = $true }
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Successfully disabled custom scripts on SharePoint sites.' -Sev Info
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Failed to disable custom scripts on SharePoint sites. Error: $ErrorMessage" -Sev Error
+ }
+ }
+ }
+
+ if ($Settings.alert -eq $true) {
+ if ($StateIsCorrect -eq $true) {
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Custom scripts are disabled on SharePoint sites.' -Sev Info
+ } else {
+ Write-StandardsAlert -message 'Custom scripts are enabled on SharePoint sites.' -object $CurrentState -tenant $Tenant -standardName 'SPDisableCustomScripts' -standardId $Settings.standardId
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Custom scripts are enabled on SharePoint sites.' -Sev Info
+ }
+ }
+
+ if ($Settings.report -eq $true) {
+ $CurrentValue = [PSCustomObject]@{
+ SPDisableCustomScripts = $StateIsCorrect
+ }
+ $ExpectedValue = [PSCustomObject]@{
+ SPDisableCustomScripts = $true
+ }
+ Set-CIPPStandardsCompareField -FieldName 'standards.SPDisableCustomScripts' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+ Add-CIPPBPAField -FieldName 'SPDisableCustomScripts' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
+ }
+}
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1
new file mode 100644
index 0000000000000..593f40f925014
--- /dev/null
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1
@@ -0,0 +1,97 @@
+function Invoke-CIPPStandardSPDisableStoreAccess {
+ <#
+ .FUNCTIONALITY
+ Internal
+ .COMPONENT
+ (APIName) SPDisableStoreAccess
+ .SYNOPSIS
+ (Label) Disable SharePoint Store access
+ .DESCRIPTION
+ (Helptext) Disables end users from installing applications from the Microsoft Store into SharePoint sites.
+ (DocsDescription) Removes the ability for end users to install applications directly from the Microsoft Store into SharePoint. This prevents uncontrolled app installations that can increase governance costs and go against organizational policies.
+ .NOTES
+ CAT
+ SharePoint Standards
+ TAG
+ EXECUTIVETEXT
+ Prevents end users from installing applications from the Microsoft Store into SharePoint sites, ensuring that only approved applications are available. This reduces governance overhead and aligns with Microsoft's Baseline Security Mode recommendations.
+ ADDEDCOMPONENT
+ IMPACT
+ Low Impact
+ ADDEDDATE
+ 2026-04-28
+ POWERSHELLEQUIVALENT
+ Set-SPOTenant -DisableSharePointStoreAccess $true
+ RECOMMENDEDBY
+ "CIPP"
+ REQUIREDCAPABILITIES
+ "SHAREPOINTWAC"
+ "SHAREPOINTSTANDARD"
+ "SHAREPOINTENTERPRISE"
+ "SHAREPOINTENTERPRISE_EDU"
+ "ONEDRIVE_BASIC"
+ "ONEDRIVE_ENTERPRISE"
+ UPDATECOMMENTBLOCK
+ Run the Tools\Update-StandardsComments.ps1 script to update this comment block
+ .LINK
+ https://docs.cipp.app/user-documentation/tenant/standards/list-standards
+ #>
+
+ param($Tenant, $Settings)
+ $TestResult = Test-CIPPStandardLicense -StandardName 'SPDisableStoreAccess' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+
+ if ($TestResult -eq $false) {
+ return $true
+ }
+
+ try {
+ $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant |
+ Select-Object _ObjectIdentity_, TenantFilter, DisableSharePointStoreAccess
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SPDisableStoreAccess state for $Tenant. Error: $ErrorMessage" -Sev Error
+ return
+ }
+
+ if ($null -eq $CurrentState._ObjectIdentity_) {
+ $ErrorDetail = $CurrentState.ErrorInfo ?? 'No tenant data returned from CSOM query'
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SPDisableStoreAccess state for $Tenant. CSOM error: $ErrorDetail" -Sev Error
+ return
+ }
+
+ $StateIsCorrect = ($CurrentState.DisableSharePointStoreAccess -eq $true)
+
+ if ($Settings.remediate -eq $true) {
+ if ($StateIsCorrect -eq $true) {
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'SharePoint Store access is already disabled.' -Sev Info
+ } else {
+ try {
+ $CurrentState | Set-CIPPSPOTenant -Properties @{ DisableSharePointStoreAccess = $true }
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Successfully disabled SharePoint Store access.' -Sev Info
+ } catch {
+ $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Failed to disable SharePoint Store access. Error: $ErrorMessage" -Sev Error
+ }
+ }
+ }
+
+ if ($Settings.alert -eq $true) {
+ if ($StateIsCorrect -eq $true) {
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'SharePoint Store access is disabled.' -Sev Info
+ } else {
+ Write-StandardsAlert -message 'SharePoint Store access is enabled.' -object $CurrentState -tenant $Tenant -standardName 'SPDisableStoreAccess' -standardId $Settings.standardId
+ Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'SharePoint Store access is enabled.' -Sev Info
+ }
+ }
+
+ if ($Settings.report -eq $true) {
+ $CurrentValue = [PSCustomObject]@{
+ SPDisableStoreAccess = $StateIsCorrect
+ }
+ $ExpectedValue = [PSCustomObject]@{
+ SPDisableStoreAccess = $true
+ }
+ Set-CIPPStandardsCompareField -FieldName 'standards.SPDisableStoreAccess' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+ Add-CIPPBPAField -FieldName 'SPDisableStoreAccess' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
+ }
+}
diff --git a/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady001.ps1 b/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady001.ps1
index cce1278c262fc..fb7dd130ff2de 100644
--- a/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady001.ps1
+++ b/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady001.ps1
@@ -20,13 +20,10 @@ function Invoke-CippTestCopilotReady001 {
return
}
- # LicenseOverview is stored as a single item; unwrap if needed
- $Skus = if ($LicenseData.Licenses) { $LicenseData.Licenses } else { $LicenseData }
-
$EligibleSkus = [System.Collections.Generic.List[object]]::new()
$AssignableCount = 0
- foreach ($Sku in $Skus) {
+ foreach ($Sku in $LicenseData) {
$HasQualifyingPlan = $Sku.ServicePlans | Where-Object { $_.servicePlanName -in $PrerequisiteServicePlans }
if ($HasQualifyingPlan -and [int]$Sku.TotalLicenses -gt 0) {
$EligibleSkus.Add($Sku) | Out-Null
diff --git a/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady002.ps1 b/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady002.ps1
index f83387ef48f48..2be9ef3320ad3 100644
--- a/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady002.ps1
+++ b/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady002.ps1
@@ -7,8 +7,8 @@ function Invoke-CippTestCopilotReady002 {
# Copilot add-on licenses are matched by friendly name (License field) since CIPP's LicenseOverview
# caches display names rather than raw SKU part numbers. All Copilot add-on SKUs contain 'Copilot'.
- # Service plan anchor: 'M365_COPILOT' is present in all Copilot add-on SKUs.
- $CopilotServicePlan = 'M365_COPILOT'
+ # Service plan anchor: 'COPILOT' is present in all Copilot add-on SKUs.
+ $CopilotServicePlan = 'COPILOT'
try {
$LicenseData = Get-CIPPTestData -TenantFilter $Tenant -Type 'LicenseOverview'
@@ -18,16 +18,14 @@ function Invoke-CippTestCopilotReady002 {
return
}
- $Skus = if ($LicenseData.Licenses) { $LicenseData.Licenses } else { $LicenseData }
-
$CopilotLicenses = [System.Collections.Generic.List[object]]::new()
$TotalEnabled = 0
$TotalConsumed = 0
$TotalAvailable = 0
- foreach ($Sku in $Skus) {
- $IsCopilot = ($Sku.License -like '*Copilot*') -or
- ($Sku.ServicePlans | Where-Object { $_.servicePlanName -eq $CopilotServicePlan })
+ foreach ($Sku in $LicenseData) {
+ $IsCopilot = ($Sku.License -match 'Copilot') -or
+ ($Sku.ServicePlans | Where-Object { $_.servicePlanName -match $CopilotServicePlan })
if ($IsCopilot) {
$CopilotLicenses.Add($Sku) | Out-Null
$Enabled = [int]$Sku.TotalLicenses
@@ -41,7 +39,7 @@ function Invoke-CippTestCopilotReady002 {
if ($CopilotLicenses.Count -eq 0) {
$Status = 'Failed'
$Result = "No Microsoft 365 Copilot add-on licenses were found in this tenant.`n`n"
- $Result += "Purchase Microsoft 365 Copilot licenses and assign them to eligible users to enable Copilot features."
+ $Result += 'Purchase Microsoft 365 Copilot licenses and assign them to eligible users to enable Copilot features.'
} elseif ($TotalConsumed -eq 0) {
$Status = 'Failed'
$Result = "Microsoft 365 Copilot licenses exist (**$TotalEnabled** seats) but **none are assigned** to any users.`n`n"
diff --git a/Modules/CippEntrypoints/CippEntrypoints.psm1 b/Modules/CippEntrypoints/CippEntrypoints.psm1
index 05f154b0ee3b8..1f953f3055a3f 100644
--- a/Modules/CippEntrypoints/CippEntrypoints.psm1
+++ b/Modules/CippEntrypoints/CippEntrypoints.psm1
@@ -502,7 +502,7 @@ function Receive-CIPPTimerTrigger {
$InstancesTable = Get-CippTable -TableName ('{0}Instances' -f ($FunctionName -replace '-', ''))
$Instance = Get-CIPPAzDataTableEntity @InstancesTable -Filter "PartitionKey eq '$($FunctionStatus.OrchestratorId)'" -Property PartitionKey, RowKey, RuntimeStatus
if ($Instance.RuntimeStatus -eq 'Running') {
- Write-LogMessage -API 'TimerFunction' -message "$($Function.Command) - $($FunctionStatus.OrchestratorId) is still running" -sev Warn -LogData $FunctionStatus
+ Write-LogMessage -API 'TimerFunction' -message "$($Function.Command) - $($FunctionStatus.OrchestratorId) is still running" -sev Warning -LogData $FunctionStatus
Write-Warning "CIPP Timer: $($Function.Command) - $($FunctionStatus.OrchestratorId) is still running, skipping execution"
continue
}
diff --git a/Shared/CIPPSharp/CIPPRestClient.cs b/Shared/CIPPSharp/CIPPRestClient.cs
index da1356adf71f5..5b1e8b0208223 100644
--- a/Shared/CIPPSharp/CIPPRestClient.cs
+++ b/Shared/CIPPSharp/CIPPRestClient.cs
@@ -761,11 +761,18 @@ private sealed class TokenCacheEntry
private static readonly ConcurrentDictionary _entries =
new(StringComparer.OrdinalIgnoreCase);
+ // Per-key semaphores to prevent thundering herd / cache stampede.
+ // When multiple runspaces miss the cache for the same key simultaneously,
+ // only one acquires a token while the others wait and reuse the result.
+ private static readonly ConcurrentDictionary _keyLocks =
+ new(StringComparer.OrdinalIgnoreCase);
+
private static long _hits;
private static long _misses;
private static long _sets;
private static long _invalidations;
private static long _expiredRemovals;
+ private static long _lockWaits;
public static string BuildKey(
string tenantId,
@@ -862,6 +869,37 @@ public static int CompactExpired(int refreshSkewSeconds = 0, int maxRemovals = 1
return removed;
}
+ ///
+ /// Acquire a per-key lock to prevent thundering herd on cache miss.
+ /// Returns true if the lock was acquired within the timeout.
+ /// After acquiring, the caller should Lookup() again (double-check),
+ /// then acquire the token and Store() it, then ReleaseLock().
+ ///
+ public static bool AcquireLock(string key, int timeoutMs = 30000)
+ {
+ if (string.IsNullOrWhiteSpace(key))
+ return false;
+
+ var sem = _keyLocks.GetOrAdd(key, _ => new SemaphoreSlim(1, 1));
+ Interlocked.Increment(ref _lockWaits);
+ return sem.Wait(timeoutMs);
+ }
+
+ ///
+ /// Release the per-key lock after token acquisition and Store().
+ /// Safe to call even if AcquireLock returned false (no-ops gracefully).
+ ///
+ public static void ReleaseLock(string key)
+ {
+ if (string.IsNullOrWhiteSpace(key))
+ return;
+
+ if (_keyLocks.TryGetValue(key, out var sem))
+ {
+ try { sem.Release(); } catch (SemaphoreFullException) { /* already released */ }
+ }
+ }
+
public static string GetDiagnostics()
{
return JsonSerializer.Serialize(new
@@ -872,6 +910,8 @@ public static string GetDiagnostics()
Sets = Interlocked.Read(ref _sets),
Invalidations = Interlocked.Read(ref _invalidations),
ExpiredRemovals = Interlocked.Read(ref _expiredRemovals),
+ LockWaits = Interlocked.Read(ref _lockWaits),
+ ActiveLocks = _keyLocks.Count,
}, new JsonSerializerOptions { WriteIndented = true });
}
@@ -882,6 +922,7 @@ public static void ResetDiagnostics()
Interlocked.Exchange(ref _sets, 0);
Interlocked.Exchange(ref _invalidations, 0);
Interlocked.Exchange(ref _expiredRemovals, 0);
+ Interlocked.Exchange(ref _lockWaits, 0);
}
}
}
diff --git a/Shared/CIPPSharp/bin/CIPPSharp.dll b/Shared/CIPPSharp/bin/CIPPSharp.dll
index edd5471793046..8d10347e22696 100644
Binary files a/Shared/CIPPSharp/bin/CIPPSharp.dll and b/Shared/CIPPSharp/bin/CIPPSharp.dll differ
diff --git a/Tools/Update-IntuneCollection.ps1 b/Tools/Update-IntuneCollection.ps1
index c2e2b8b53b7f2..80201a95ae5b2 100644
--- a/Tools/Update-IntuneCollection.ps1
+++ b/Tools/Update-IntuneCollection.ps1
@@ -90,7 +90,7 @@ Set-Location $PSScriptRoot
$json = $collection | ConvertTo-Json -Depth 5
# CIPP-API root (used by Compare-CIPPIntuneObject.ps1 at runtime)
-$apiPath = Join-Path $PSScriptRoot '..\intuneCollection.json'
+$apiPath = Join-Path $PSScriptRoot '..\Config\intuneCollection.json'
$json | Set-Content -Path $apiPath -Encoding utf8NoBOM
Write-Host "Written: $(Resolve-Path $apiPath)" -ForegroundColor Green
diff --git a/host.json b/host.json
index e5c89cc14cb2a..fd86e95d90370 100644
--- a/host.json
+++ b/host.json
@@ -16,7 +16,7 @@
"distributedTracingEnabled": false,
"version": "None"
},
- "defaultVersion": "10.4.1",
+ "defaultVersion": "10.4.2",
"versionMatchStrategy": "Strict",
"versionFailureStrategy": "Fail"
}