Merge branch 'KelvinTegelaar:master' into master

Author: chase-vgo

Config/CIPPTimers.json

@@ -241,7 +241,7 @@
     "Id": "5e8a9b4c-2d6f-4a3e-b7c1-9d0e5f3a8b2c",
     "Command": "Start-IntuneReportExportOrchestrator",
     "Description": "Submit Intune report-export jobs ahead of nightly DB cache run",
-    "Cron": "0 0 2 * * *",
+    "Cron": "0 0 1 * * *",
     "Priority": 22,
     "RunOnProcessor": true,
     "TZOffset": true,

Config/ConversionTable.csv

@@ -81,5 +81,20 @@
     ],
     "Pages": [],
     "Hidden": false
+  },
+  {
+    "Id": "AppInsights",
+    "Name": "App Insights",
+    "Description": "App Insights page not used in NG",
+    "Enabled": true,
+    "AllowUserToggle": false,
+    "Timers": [],
+    "Endpoints": [
+      "ExecAppInsightsQuery"
+    ],
+    "Pages": [
+      "/cipp/advanced/diagnostics"
+    ],
+    "Hidden": true
   }
-]
+]

Config/FeatureFlags.json

@@ -378,8 +378,8 @@
     "cat": "Global Standards",
     "tag": ["CIS M365 7.0.0 (1.3.6)", "CustomerLockBoxEnabled"],
     "appliesToTest": ["CIS_1_3_6"],
-    "helpText": "**Requires Entra ID P2.** Enables Customer Lockbox that offers an approval process for Microsoft support to access organization data",
-    "docsDescription": "**Requires Entra ID P2.** Customer Lockbox ensures that Microsoft can't access your content to do service operations without your explicit approval. Customer Lockbox ensures only authorized requests allow access to your organizations data.",
+    "helpText": "**Requires CustomerLockbox (E5, E7, A5, Purview Addon for BP, EDU or FL)** Enables Customer Lockbox that offers an approval process for Microsoft support to access organization data",
+    "docsDescription": "**Requires CustomerLockbox (E5, E7, A5, Purview Addon for BP, EDU or FL)** Customer Lockbox ensures that Microsoft can't access your content to do service operations without your explicit approval. Customer Lockbox ensures only authorized requests allow access to your organizations data.",
     "executiveText": "Requires explicit organizational approval before Microsoft support staff can access company data for service operations. This provides an additional layer of data protection and ensures the organization maintains control over who can access sensitive business information, even during technical support scenarios.",
     "addedComponent": [],
     "label": "Enable Customer Lockbox",
@@ -4157,12 +4157,10 @@
         "defaultValue": false
       },
       {
-        "type": "autoComplete",
-        "multiple": true,
-        "creatable": true,
+        "type": "LanguageCodeMultiSelect",
         "required": false,
         "name": "standards.SpamFilterPolicy.LanguageBlockList",
-        "label": "Languages to block (uppercase ISO 639-1 two-letter)",
+        "label": "Languages to block (ISO 639-1 two-letter)",
         "condition": {
           "field": "standards.SpamFilterPolicy.EnableLanguageBlockList",
           "compareType": "is",
@@ -4176,12 +4174,10 @@
         "defaultValue": false
       },
       {
-        "type": "autoComplete",
-        "multiple": true,
-        "creatable": true,
+        "type": "CountryCodeMultiSelect",
         "required": false,
         "name": "standards.SpamFilterPolicy.RegionBlockList",
-        "label": "Regions to block (uppercase ISO 3166-1 two-letter)",
+        "label": "Regions to block (ISO 3166-1 two-letter)",
         "condition": {
           "field": "standards.SpamFilterPolicy.EnableRegionBlockList",
           "compareType": "is",
@@ -5865,7 +5861,7 @@
       {
         "type": "switch",
         "name": "standards.TeamsFederationConfiguration.AllowTeamsConsumer",
-        "label": "Allow users to communicate with other organizations"
+        "label": "Allow users to communicate with consumer Teams accounts"
       },
       {
         "type": "autoComplete",
@@ -7255,6 +7251,12 @@
         "label": "Block Android if partner data unavailable",
         "defaultValue": false
       },
+      {
+        "type": "switch",
+        "name": "standards.DefenderCompliancePolicy.grantMobileThreatDefensePartnerRole",
+        "label": "Grant MTD role to MDE on enrolled Android COBO/COPE devices",
+        "defaultValue": false
+      },
       {
         "type": "switch",
         "name": "standards.DefenderCompliancePolicy.ConnectIos",
@@ -7264,13 +7266,19 @@
       {
         "type": "switch",
         "name": "standards.DefenderCompliancePolicy.ConnectIosCompliance",
-        "label": "Connect iOS 13.0+ (App-based MAM)",
+        "label": "Connect iOS/iPadOS devices for app protection policy evaluation (MAM)",
         "defaultValue": false
       },
       {
         "type": "switch",
         "name": "standards.DefenderCompliancePolicy.appSync",
-        "label": "Enable App Sync for iOS",
+        "label": "Enable App Sync (sending application inventory) for iOS/iPadOS devices",
+        "defaultValue": false
+      },
+      {
+        "type": "switch",
+        "name": "standards.DefenderCompliancePolicy.allowPartnerToCollectIosPersonalApplicationMetadata",
+        "label": "Send full application inventory data on personally-owned iOS/iPadOS devices",
         "defaultValue": false
       },
       {
@@ -7282,13 +7290,13 @@
       {
         "type": "switch",
         "name": "standards.DefenderCompliancePolicy.allowPartnerToCollectIosCertificateMetadata",
-        "label": "Collect certificate metadata from iOS",
+        "label": "Enable Certificate Sync for iOS/iPadOS devices",
         "defaultValue": false
       },
       {
         "type": "switch",
         "name": "standards.DefenderCompliancePolicy.allowPartnerToCollectIosPersonalCertificateMetadata",
-        "label": "Collect personal certificate metadata from iOS",
+        "label": "Send full certificate inventory data on personally-owned iOS/iPadOS devices",
         "defaultValue": false
       },
       {

openapi.json Config/openapi.jsonopenapi.json renamed to Config/openapi.json

@@ -16,7 +16,7 @@ function Push-TableCleanupTask {
                     if ($Table) {
                         Write-Information "Deleting table $($Table.Context.TableName)"
                         try {
-                            Remove-AzDataTable -Context $Table.Context -Force
+                            Remove-AzDataTable -Context $Table.Context
                         } catch {
                             #Write-LogMessage -API 'TableCleanup' -message "Failed to delete table $($Table.Context.TableName)" -sev Error -LogData (Get-CippException -Exception $_)
                         }

Config/standards.json

@@ -25,6 +25,13 @@ function Push-IntuneReportExportSubmit {
                     'UserId', 'UserName', 'EmailAddress'
                 )
             }
+            'AppInstallStatusAggregate' {
+                @(
+                    'ApplicationId', 'DisplayName', 'Publisher', 'Platform', 'AppVersion', 'AppPlatform',
+                    'InstalledDeviceCount', 'FailedDeviceCount', 'FailedUserCount',
+                    'PendingInstallDeviceCount', 'NotInstalledDeviceCount', 'FailedDevicePercentage'
+                )
+            }
             default { throw "Unknown Intune report '$ReportName'" }
         }
 

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Maintenance/Push-TableCleanupTask.ps1

@@ -49,11 +49,11 @@ function Get-CIPPAlertIntunePolicyConflicts {
     }
 
     $AlertableStatuses = @(
-        if ($Config.AlertErrors) { 'error'; 'failed' }
+        if ($Config.AlertErrors) { 'error' }
         if ($Config.AlertConflicts) { 'conflict' }
     )
 
-    if (-not $AlertableStatuses) {
+    if (-not $AlertableStatuses -and -not ($Config.IncludeApplications -and $Config.AlertErrors)) {
         return
     }
 
@@ -64,56 +64,66 @@ function Get-CIPPAlertIntunePolicyConflicts {
 
     $Issues = [System.Collections.Generic.List[object]]::new()
 
-    if ($Config.IncludePolicies) {
-        try {
-            $ManagedDevices = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices?`$select=id,deviceName,userPrincipalName&`$expand=deviceConfigurationStates(`$select=displayName,state,settingStates)" -tenantid $TenantFilter
-
-            foreach ($Device in $ManagedDevices) {
-                $PolicyStates = $Device.deviceConfigurationStates | Where-Object { $_.state -and ($AlertableStatuses -contains $_.state) }
-                foreach ($State in $PolicyStates) {
-                    $Issues.Add([PSCustomObject]@{
-                            Message           = "Policy '$($State.displayName)' is $($State.state) on device '$($Device.deviceName)' for $($Device.userPrincipalName)."
-                            Tenant            = $TenantFilter
-                            Type              = 'Policy'
-                            PolicyName        = $State.displayName
-                            IssueStatus       = $State.state
-                            DeviceName        = $Device.deviceName
-                            UserPrincipalName = $Device.userPrincipalName
-                            DeviceId          = $Device.id
-                        })
+    if ($Config.IncludePolicies -and $AlertableStatuses) {
+        $PolicySources = @(
+            @{ Type = 'IntuneDeviceCompliancePolicies'; Kind = 'Compliance' }
+            @{ Type = 'IntuneDeviceConfigurations'; Kind = 'Configuration' }
+        )
+
+        foreach ($Source in $PolicySources) {
+            try {
+                $PolicyItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type $Source.Type | Where-Object { $_.RowKey -notlike '*-Count' }
+                foreach ($PolicyItem in $PolicyItems) {
+                    $Policy = try { $PolicyItem.Data | ConvertFrom-Json -ErrorAction Stop } catch { $null }
+                    if (-not $Policy.id) { continue }
+
+                    $StatusItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type "$($Source.Type)_$($Policy.id)" | Where-Object { $_.RowKey -notlike '*-Count' }
+                    foreach ($StatusItem in $StatusItems) {
+                        $State = try { $StatusItem.Data | ConvertFrom-Json -ErrorAction Stop } catch { $null }
+                        if (-not $State.status -or ($AlertableStatuses -notcontains $State.status.ToLowerInvariant())) { continue }
+
+                        $Issues.Add([PSCustomObject]@{
+                                Message           = "$($Source.Kind) policy '$($Policy.displayName)' is $($State.status) on device '$($State.deviceDisplayName)' for $($State.userPrincipalName)."
+                                Tenant            = $TenantFilter
+                                Type              = 'Policy'
+                                PolicyType        = $Source.Kind
+                                PolicyName        = $Policy.displayName
+                                IssueStatus       = $State.status
+                                DeviceName        = $State.deviceDisplayName
+                                UserPrincipalName = $State.userPrincipalName
+                                DeviceId          = $State.id
+                            })
+                    }
                 }
+            } catch {
+                $ErrorMessage = Get-CippException -Exception $_
+                Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Failed to read cached $($Source.Kind) policy states: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
             }
-        } catch {
-            $ErrorMessage = Get-CippException -Exception $_
-            Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Failed to query Intune policy states: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
         }
     }
 
-    if ($Config.IncludeApplications) {
+    if ($Config.IncludeApplications -and $Config.AlertErrors) {
         try {
-            $Applications = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?`$select=id,displayName&`$expand=deviceStatuses(`$select=installState,deviceName,userPrincipalName,deviceId)" -tenantid $TenantFilter
-
-            foreach ($App in $Applications) {
-                $BadStatuses = $App.deviceStatuses | Where-Object {
-                    $_.installState -and ($AlertableStatuses -contains $_.installState.ToLowerInvariant())
-                }
-
-                foreach ($Status in $BadStatuses) {
-                    $Issues.Add([PSCustomObject]@{
-                            Message           = "App '$($App.displayName)' install is $($Status.installState) on device '$($Status.deviceName)' for $($Status.userPrincipalName)."
-                            Tenant            = $TenantFilter
-                            Type              = 'Application'
-                            AppName           = $App.displayName
-                            IssueStatus       = $Status.installState
-                            DeviceName        = $Status.deviceName
-                            UserPrincipalName = $Status.userPrincipalName
-                            DeviceId          = $Status.deviceId
-                        })
-                }
+            $AppItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneAppInstallStatusAggregate' | Where-Object { $_.RowKey -notlike '*-Count' }
+            foreach ($AppItem in $AppItems) {
+                $App = try { $AppItem.Data | ConvertFrom-Json -ErrorAction Stop } catch { $null }
+                if (-not $App -or [int]($App.failedDeviceCount) -le 0) { continue }
+
+                $Issues.Add([PSCustomObject]@{
+                        Message           = "App '$($App.displayName)' failed to install on $($App.failedDeviceCount) device(s) ($($App.failedDevicePercentage)%)."
+                        Tenant            = $TenantFilter
+                        Type              = 'Application'
+                        AppName           = $App.displayName
+                        IssueStatus       = 'failed'
+                        FailedDeviceCount = [int]$App.failedDeviceCount
+                        FailedUserCount   = [int]$App.failedUserCount
+                        FailedPercentage  = $App.failedDevicePercentage
+                        Platform          = $App.platform
+                    })
             }
         } catch {
             $ErrorMessage = Get-CippException -Exception $_
-            Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Failed to query Intune application states: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+            Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Failed to read cached Intune app install status: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
         }
     }
 

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-IntuneReportExportSubmit.ps1

@@ -45,7 +45,7 @@
     # RequiredModules = @()
 
     # Assemblies that must be loaded prior to importing this module
-    # RequiredAssemblies = @()
+    RequiredAssemblies = @('..\..\Shared\CIPPSharp\bin\CIPPSharp.dll')
 
     # Script files (.ps1) that are run in the caller's environment prior to importing this module.
     # ScriptsToProcess = @()

Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1

@@ -72,6 +72,21 @@ function New-CIPPAuditLogSearchResultsCache {
                 Add-CIPPAzDataTableEntity @CacheWebhooksTable -Entity $cacheEntity -Force
             }
             Write-Information "Successfully cached search ID: $($SearchId) for tenant: $TenantFilter"
+
+            try {
+                $PrefetchIPs = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+                foreach ($sr in $searchResults) {
+                    $cip = $sr.auditData.clientip
+                    if (![string]::IsNullOrWhiteSpace($cip)) { $null = $PrefetchIPs.Add(([string]$cip).Trim()) }
+                }
+                if ($PrefetchIPs.Count -gt 0) {
+                    $null = Get-CIPPGeoIPLocationBatch -IPs @($PrefetchIPs)
+                    Write-Information "Geo prefetch: warmed cache for $($PrefetchIPs.Count) distinct IP(s) (search $SearchId)"
+                }
+            } catch {
+                Write-Information "Geo prefetch during ingestion failed for search ${SearchId}: $($_.Exception.Message)"
+            }
+
             try {
                 $FailedDownloadsTable = Get-CippTable -TableName 'FailedAuditLogDownloads'
                 $failedEntities = Get-CIPPAzDataTableEntity @FailedDownloadsTable -Filter "PartitionKey eq '$TenantFilter' and SearchId eq '$SearchId'"