Merge pull request #612 from KelvinTegelaar/dev

pull[bot] · web-flow · commit b8c663ab8b79 · 2025-12-14T00:41:20.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/CIPPTimers.json b/CIPPTimers.json
@@ -203,5 +203,14 @@
     "Priority": 20,
     "RunOnProcessor": true,
     "IsSystem": true
+  },
+  {
+    "Id": "b8f3c2e1-5d4a-4f7b-9a2c-1e6d8f3b5a7c",
+    "Command": "Start-BackupRetentionCleanup",
+    "Description": "Timer to cleanup old backups based on retention policy",
+    "Cron": "0 0 2 * * *",
+    "Priority": 21,
+    "RunOnProcessor": true,
+    "IsSystem": true
   }
 ]
diff --git a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertGlobalAdminAllowList.ps1 b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertGlobalAdminAllowList.ps1
@@ -0,0 +1,84 @@
+function Get-CIPPAlertGlobalAdminAllowList {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $false)]
+        [Alias('input')]
+        $InputValue,
+        $TenantFilter
+    )
+    try {
+        $AllowedAdmins = @()
+        $AlertEachAdmin = $false
+        if ($InputValue -is [hashtable] -or $InputValue -is [pscustomobject]) {
+            $AlertEachAdmin = [bool]($InputValue['AlertEachAdmin'])
+            $ApprovedValue = if ($InputValue.ContainsKey('ApprovedGlobalAdmins') -or ($InputValue.PSObject.Properties.Name -contains 'ApprovedGlobalAdmins')) {
+                $InputValue['ApprovedGlobalAdmins']
+            } else {
+                $null
+            }
+            $InputValue = $ApprovedValue
+        }
+        if ($null -ne $InputValue) {
+            if ($InputValue -is [string]) {
+                $AllowedAdmins = $InputValue -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ }
+            } elseif ($InputValue -is [System.Collections.IEnumerable]) {
+                $AllowedAdmins = $InputValue | ForEach-Object { $_.ToString().Trim() } | Where-Object { $_ }
+            } else {
+                $AllowedAdmins = @("$InputValue")
+            }
+        }
+        $AllowedLookup = $AllowedAdmins | ForEach-Object { $_.ToLowerInvariant() } | Select-Object -Unique
+
+        if (-not $AllowedLookup -or $AllowedLookup.Count -eq 0) {
+            return
+        }
+
+        $GlobalAdmins = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/directoryRoles/roleTemplateId=62e90394-69f5-4237-9190-012177145e10/members?`$select=id,displayName,userPrincipalName" -tenantid $TenantFilter -AsApp $true -ErrorAction Stop | Where-Object {
+            $_.'@odata.type' -eq '#microsoft.graph.user' -and $_.displayName -ne 'On-Premises Directory Synchronization Service Account'
+        }
+
+        $UnapprovedAdmins = foreach ($admin in $GlobalAdmins) {
+            if ([string]::IsNullOrWhiteSpace($admin.userPrincipalName)) { continue }
+            $UpnPrefix = ($admin.userPrincipalName -split '@')[0].ToLowerInvariant()
+            if ($AllowedLookup -notcontains $UpnPrefix) {
+                [PSCustomObject]@{
+                    Admin      = $admin
+                    UpnPrefix  = $UpnPrefix
+                }
+            }
+        }
+
+        if ($UnapprovedAdmins) {
+            if ($AlertEachAdmin) {
+                $AlertData = foreach ($item in $UnapprovedAdmins) {
+                    $admin = $item.Admin
+                    $UpnPrefix = $item.UpnPrefix
+                    [PSCustomObject]@{
+                        Message           = "$($admin.userPrincipalName) has Global Administrator role but is not in the approved allow list (prefix '$UpnPrefix')."
+                        DisplayName       = $admin.displayName
+                        UserPrincipalName = $admin.userPrincipalName
+                        Id                = $admin.id
+                        AllowedList       = if ($AllowedAdmins) { $AllowedAdmins -join ', ' } else { 'Not provided' }
+                        Tenant            = $TenantFilter
+                    }
+                }
+            } else {
+                $NonCompliantUpns = @($UnapprovedAdmins.Admin.userPrincipalName)
+                $AlertData = @([PSCustomObject]@{
+                        Message            = "Found $($NonCompliantUpns.Count) Global Administrator account(s) not in the approved allow list."
+                        NonCompliantUsers  = $NonCompliantUpns
+                        ApprovedPrefixes   = if ($AllowedAdmins) { $AllowedAdmins -join ', ' } else { 'Not provided' }
+                        Tenant             = $TenantFilter
+                    })
+            }
+
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
+        }
+    } catch {
+        Write-AlertMessage -tenant $TenantFilter -message "Failed to check approved Global Admins: $(Get-NormalizedError -message $_.Exception.Message)"
+    }
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-SchedulerCIPPNotifications.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-SchedulerCIPPNotifications.ps1
@@ -115,6 +115,7 @@ function Push-SchedulerCIPPNotifications {
             }
 
             if ($CurrentStandardsLogs) {
+                $Data = $CurrentStandardsLogs
                 $JSONContent = New-CIPPAlertTemplate -Data $Data -Format 'json' -InputObject 'table' -CIPPURL $CIPPURL
                 $CurrentStandardsLogs | ConvertTo-Json -Compress
                 Send-CIPPAlert -Type 'webhook' -JSONContent $JSONContent -TenantFilter $Tenant -APIName 'Alerts'
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsApplyBatch.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsApplyBatch.ps1
@@ -7,23 +7,29 @@ function Push-CIPPStandardsApplyBatch {
 
     try {
         # Aggregate all standards from all tenants
-        $AllStandards = @($Item.Results | Where-Object { $_ -and $_.FunctionName -eq 'CIPPStandard' })
+        $AllStandards = $Item.Results | ForEach-Object {
+            foreach ($Standard in $_) {
+                if ($Standard -and $Standard.FunctionName -eq 'CIPPStandard') {
+                    $Standard
+                }
+            }
+        }
 
         if ($AllStandards.Count -eq 0) {
             Write-Information 'No standards to apply across all tenants'
             return
         }
 
-        Write-Information "Aggregated $($AllStandards.Count) standards from all tenants"
+        Write-Information "Aggregated $($AllStandards.Count) standards from all tenants: $($AllStandards | ConvertTo-Json -Depth 5 -Compress)"
 
         # Start orchestrator to apply standards
         $InputObject = [PSCustomObject]@{
             OrchestratorName = 'StandardsApply'
             Batch            = @($AllStandards)
             SkipLog          = $true
-        }
-
-        $InstanceId = Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Depth 5 -Compress)
+        } | ConvertTo-Json -Depth 25 -Compress
+        Write-Host "Standards InputObject: $InputObject"
+        $InstanceId = Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject $InputObject
         Write-Information "Started standards apply orchestrator with ID = '$InstanceId'"
 
     } catch {
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1
@@ -170,7 +170,7 @@ function Push-CIPPStandardsList {
 
                         # Remove if both unchanged
                         if (-not $PolicyChanged -and -not $StandardTemplateChanged) {
-                            [void]$ComputedStandards.Remove($Key)
+x                            [void]$ComputedStandards.Remove($Key)
                         }
                     }
                 } catch {
@@ -181,7 +181,7 @@ function Push-CIPPStandardsList {
 
         Write-Host "Returning $($ComputedStandards.Count) standards for tenant $TenantFilter after filtering."
         # Return filtered standards
-        $ComputedStandards.Values | ForEach-Object {
+        $FilteredStandards = $ComputedStandards.Values | ForEach-Object {
             [PSCustomObject]@{
                 Tenant       = $_.Tenant
                 Standard     = $_.Standard
@@ -190,6 +190,8 @@ function Push-CIPPStandardsList {
                 FunctionName = 'CIPPStandard'
             }
         }
+        Write-Host "Sending back $($FilteredStandards.Count) standards: $($FilteredStandards | ConvertTo-Json -Depth 5 -Compress)"
+        return $FilteredStandards
 
     } catch {
         Write-Warning "Error listing standards for $TenantFilter : $($_.Exception.Message)"
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackupRetentionConfig.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackupRetentionConfig.ps1
@@ -0,0 +1,56 @@
+function Invoke-ExecBackupRetentionConfig {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        CIPP.AppSettings.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+    $Table = Get-CIPPTable -TableName Config
+    $Filter = "PartitionKey eq 'BackupRetention' and RowKey eq 'Settings'"
+
+    $results = try {
+        if ($Request.Query.List) {
+            $RetentionSettings = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+            if (!$RetentionSettings) {
+                # Return default values if not set
+                @{
+                    RetentionDays = 30
+                }
+            } else {
+                @{
+                    RetentionDays = [int]$RetentionSettings.RetentionDays
+                }
+            }
+        } else {
+            $RetentionDays = [int]$Request.Body.RetentionDays
+
+            # Validate minimum value
+            if ($RetentionDays -lt 7) {
+                throw 'Retention days must be at least 7 days'
+            }
+
+            $RetentionConfig = @{
+                'RetentionDays' = $RetentionDays
+                'PartitionKey'  = 'BackupRetention'
+                'RowKey'        = 'Settings'
+            }
+
+            Add-CIPPAzDataTableEntity @Table -Entity $RetentionConfig -Force | Out-Null
+            Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -message "Set backup retention to $RetentionDays days" -Sev 'Info'
+            "Successfully set backup retention to $RetentionDays days"
+        }
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -message "Failed to set backup retention configuration: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        "Failed to set configuration: $($ErrorMessage.NormalizedError)"
+    }
+
+    $body = [pscustomobject]@{'Results' = $Results }
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = $body
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecDevicePasscodeAction.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecDevicePasscodeAction.ps1
@@ -0,0 +1,53 @@
+function Invoke-ExecDevicePasscodeAction {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Endpoint.MEM.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+
+    $Action = $Request.Body.Action
+    $DeviceFilter = $Request.Body.GUID
+    $TenantFilter = $Request.Body.tenantFilter
+
+    try {
+        $GraphResponse = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices('$DeviceFilter')/$($Action)" -type POST -tenantid $TenantFilter -body '{}'
+
+        $Result = switch ($Action) {
+            'resetPasscode' {
+                if ($GraphResponse.value) {
+                    "Passcode reset successfully. New passcode: $($GraphResponse.value)"
+                } else {
+                    "Passcode reset queued for device $DeviceFilter. The new passcode will be generated and can be retrieved from the device details."
+                }
+            }
+            'removeDevicePasscode' {
+                "Successfully removed passcode requirement from device $DeviceFilter"
+            }
+            default {
+                "Successfully queued $Action on device $DeviceFilter"
+            }
+        }
+
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Info
+        $StatusCode = [HttpStatusCode]::OK
+        $Results = $Result
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Result = "Failed to execute $Action on device $DeviceFilter : $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -Sev Error -LogData $ErrorMessage
+        $StatusCode = [HttpStatusCode]::InternalServerError
+        $Results = $Result
+    }
+
+    Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = @{Results = $Results }
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1
@@ -32,6 +32,7 @@ function Invoke-ExecJITAdmin {
                 'UserPrincipalName' = $Username
             }
             Expiration   = $Expiration
+            StartDate    = $Start
             Reason       = $Request.Body.reason
             Action       = 'Create'
             TenantFilter = $TenantFilter
@@ -152,6 +153,7 @@ function Invoke-ExecJITAdmin {
         Action       = 'AddRoles'
         Reason       = $Request.Body.Reason
         Expiration   = $Expiration
+        StartDate    = $Start
         Headers      = $Headers
         APIName      = $APIName
     }
@@ -173,7 +175,7 @@ function Invoke-ExecJITAdmin {
         }
         Add-CIPPScheduledTask -Task $TaskBody -hidden $false
         if ($Request.Body.userAction -ne 'create') {
-            Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $Request.Body.existingUser.value -Expiration $Expiration -Reason $Request.Body.Reason
+            Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $Request.Body.existingUser.value -Expiration $Expiration -StartDate $Start -Reason $Request.Body.Reason -CreatedBy (([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails)
         }
         $Results.Add("Scheduling JIT Admin enable task for $Username")
     } else {
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdmin.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdmin.ps1
@@ -46,7 +46,9 @@
                 accountEnabled     = $_.accountEnabled
                 jitAdminEnabled    = $_.($Schema.id).jitAdminEnabled
                 jitAdminExpiration = $_.($Schema.id).jitAdminExpiration
+                jitAdminStartDate  = $_.($Schema.id).jitAdminStartDate
                 jitAdminReason     = $_.($Schema.id).jitAdminReason
+                jitAdminCreatedBy  = $_.($Schema.id).jitAdminCreatedBy
                 memberOf           = $MemberOf
             }
         }
@@ -109,7 +111,9 @@
                         accountEnabled     = $UserObject.accountEnabled
                         jitAdminEnabled    = $UserObject.jitAdminEnabled
                         jitAdminExpiration = $UserObject.jitAdminExpiration
+                        jitAdminStartDate  = $UserObject.jitAdminStartDate
                         jitAdminReason     = $UserObject.jitAdminReason
+                        jitAdminCreatedBy  = $UserObject.jitAdminCreatedBy
                         memberOf           = $UserObject.memberOf
                     }
                 )
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-CIPPStandardsRun.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-CIPPStandardsRun.ps1
@@ -54,6 +54,7 @@ function Invoke-CIPPStandardsRun {
         }
 
         # Get tenant list for batch processing
+        write-host "Getting tenants for filter: $TenantFilter"
         $AllTenantsList = if ($TenantFilter -eq 'allTenants') {
             Get-Tenants
         } else {
diff --git a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-BackupRetentionCleanup.ps1 b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-BackupRetentionCleanup.ps1
diff --git a/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1 b/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1
diff --git a/Modules/CIPPCore/Public/Set-CIPPUserJITAdminProperties.ps1 b/Modules/CIPPCore/Public/Set-CIPPUserJITAdminProperties.ps1
diff --git a/Modules/CippEntrypoints/CippEntrypoints.psm1 b/Modules/CippEntrypoints/CippEntrypoints.psm1
diff --git a/Tests/Alerts/Get-CIPPAlertGlobalAdminAllowList.Tests.ps1 b/Tests/Alerts/Get-CIPPAlertGlobalAdminAllowList.Tests.ps1

Original file line number	Diff line number	Diff line change
`@@ -115,6 +115,7 @@ function Push-SchedulerCIPPNotifications {`
`115`	`115`	`}`
`116`	`116`
`117`	`117`	`if ($CurrentStandardsLogs) {`
	`118`	`+ $Data = $CurrentStandardsLogs`
`118`	`119`	`$JSONContent = New-CIPPAlertTemplate -Data $Data -Format 'json' -InputObject 'table' -CIPPURL $CIPPURL`
`119`	`120`	`$CurrentStandardsLogs \| ConvertTo-Json -Compress`
`120`	`121`	`Send-CIPPAlert -Type 'webhook' -JSONContent $JSONContent -TenantFilter $Tenant -APIName 'Alerts'`
Original file line number	Diff line number	Diff line change
`@@ -170,7 +170,7 @@ function Push-CIPPStandardsList {`
`170`	`170`
`171`	`171`	`# Remove if both unchanged`
`172`	`172`	`if (-not $PolicyChanged -and -not $StandardTemplateChanged) {`
`173`		`- [void]$ComputedStandards.Remove($Key)`
	`173`	`+x [void]$ComputedStandards.Remove($Key)`
`174`	`174`	`}`
`175`	`175`	`}`
`176`	`176`	`} catch {`
`@@ -181,7 +181,7 @@ function Push-CIPPStandardsList {`
`181`	`181`
`182`	`182`	`Write-Host "Returning $($ComputedStandards.Count) standards for tenant $TenantFilter after filtering."`
`183`	`183`	`# Return filtered standards`
`184`		`- $ComputedStandards.Values \| ForEach-Object {`
	`184`	`+ $FilteredStandards = $ComputedStandards.Values \| ForEach-Object {`
`185`	`185`	`[PSCustomObject]@{`
`186`	`186`	`Tenant = $_.Tenant`
`187`	`187`	`Standard = $_.Standard`
`@@ -190,6 +190,8 @@ function Push-CIPPStandardsList {`
`190`	`190`	`FunctionName = 'CIPPStandard'`
`191`	`191`	`}`
`192`	`192`	`}`
	`193`	`+ Write-Host "Sending back $($FilteredStandards.Count) standards: $($FilteredStandards \| ConvertTo-Json -Depth 5 -Compress)"`
	`194`	`+ return $FilteredStandards`
`193`	`195`
`194`	`196`	`} catch {`
`195`	`197`	`Write-Warning "Error listing standards for $TenantFilter : $($_.Exception.Message)"`
Original file line number	Diff line number	Diff line change
`@@ -32,6 +32,7 @@ function Invoke-ExecJITAdmin {`
`32`	`32`	`'UserPrincipalName' = $Username`
`33`	`33`	`}`
`34`	`34`	`Expiration = $Expiration`
	`35`	`+ StartDate = $Start`
`35`	`36`	`Reason = $Request.Body.reason`
`36`	`37`	`Action = 'Create'`
`37`	`38`	`TenantFilter = $TenantFilter`
`@@ -152,6 +153,7 @@ function Invoke-ExecJITAdmin {`
`152`	`153`	`Action = 'AddRoles'`
`153`	`154`	`Reason = $Request.Body.Reason`
`154`	`155`	`Expiration = $Expiration`
	`156`	`+ StartDate = $Start`
`155`	`157`	`Headers = $Headers`
`156`	`158`	`APIName = $APIName`
`157`	`159`	`}`
`@@ -173,7 +175,7 @@ function Invoke-ExecJITAdmin {`
`173`	`175`	`}`
`174`	`176`	`Add-CIPPScheduledTask -Task $TaskBody -hidden $false`
`175`	`177`	`if ($Request.Body.userAction -ne 'create') {`
`176`		`- Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $Request.Body.existingUser.value -Expiration $Expiration -Reason $Request.Body.Reason`
	`178`	`+ Set-CIPPUserJITAdminProperties -TenantFilter $TenantFilter -UserId $Request.Body.existingUser.value -Expiration $Expiration -StartDate $Start -Reason $Request.Body.Reason -CreatedBy (([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) \| ConvertFrom-Json).userDetails)`
`177`	`179`	`}`
`178`	`180`	`$Results.Add("Scheduling JIT Admin enable task for $Username")`
`179`	`181`	`} else {`
Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,9 @@`
`46`	`46`	`accountEnabled = $_.accountEnabled`
`47`	`47`	`jitAdminEnabled = $_.($Schema.id).jitAdminEnabled`
`48`	`48`	`jitAdminExpiration = $_.($Schema.id).jitAdminExpiration`
	`49`	`+ jitAdminStartDate = $_.($Schema.id).jitAdminStartDate`
`49`	`50`	`jitAdminReason = $_.($Schema.id).jitAdminReason`
	`51`	`+ jitAdminCreatedBy = $_.($Schema.id).jitAdminCreatedBy`
`50`	`52`	`memberOf = $MemberOf`
`51`	`53`	`}`
`52`	`54`	`}`
`@@ -109,7 +111,9 @@`
`109`	`111`	`accountEnabled = $UserObject.accountEnabled`
`110`	`112`	`jitAdminEnabled = $UserObject.jitAdminEnabled`
`111`	`113`	`jitAdminExpiration = $UserObject.jitAdminExpiration`
	`114`	`+ jitAdminStartDate = $UserObject.jitAdminStartDate`
`112`	`115`	`jitAdminReason = $UserObject.jitAdminReason`
	`116`	`+ jitAdminCreatedBy = $UserObject.jitAdminCreatedBy`
`113`	`117`	`memberOf = $UserObject.memberOf`
`114`	`118`	`}`
`115`	`119`	`)`
Original file line number	Diff line number	Diff line change
`@@ -54,6 +54,7 @@ function Invoke-CIPPStandardsRun {`
`54`	`54`	`}`
`55`	`55`
`56`	`56`	`# Get tenant list for batch processing`
	`57`	`+ write-host "Getting tenants for filter: $TenantFilter"`
`57`	`58`	`$AllTenantsList = if ($TenantFilter -eq 'allTenants') {`
`58`	`59`	`Get-Tenants`
`59`	`60`	`} else {`