Frontend PR: KelvinTegelaar/CIPP#6238

The `SetAuthMethod` endpoint only toggled state and group targeting, so
every method-specific option was unreachable from the portal. This
forwards those settings through `Invoke-SetAuthMethod` and applies them
in `Set-CIPPAuthenticationPolicy`.

**Added/exposed settings**
- TAP: `isUsableOnce`, min/max/default lifetime, default length
- Microsoft Authenticator: software OATH + display-app-info /
display-location / companion-app feature states
- Email OTP: external-ID state, exclude groups (empty list now
explicitly clears `excludeTargets`)
- QR Code PIN: lifetime + PIN length
- FIDO2: `isAttestationEnforced` + `isSelfServiceRegistrationAllowed`
(were hardcoded on enable)
- Voice: `isOfficePhoneAllowed`
- SMS: `isUsableForSignIn` (stamped onto each include-target)

Log messages now spell out the changed values per method.

**Tests:** adds `Tests/Private/Set-CIPPAuthenticationPolicy.Tests.ps1`
(7 cases) — `Invoke-Pester -Path
./Tests/Private/Set-CIPPAuthenticationPolicy.Tests.ps1`.

Add the SMTP client authentication state to the mailbox details
response, enhancing the information available for mailbox configuration.

Frontend: KelvinTegelaar/CIPP#6180

Introduce functionality to allow specific user profile fields to be
cleared when editing a user. Currently the property is just quietly
dropped with a success message.

Frontend PR: KelvinTegelaar/CIPP#6261

Group display names are matched with -like, which treats square brackets as
a wildcard character class, so a literal group such as [WIN] Company Devices
never matched itself and assignment failed with No matching groups resolved.
Escape only [ and ] before the match so bracketed names resolve literally,
while * and ? wildcards (documented in the assignment UI, 'Wildcards (*) are
allowed') keep working. Applied to the six group-resolution sites in
Set-CIPPAssignedApplication, Set-CIPPAssignedPolicy and
Compare-CIPPIntuneAssignments (include and exclude). Filter-name matching is
unchanged.

Resolves KelvinTegelaar/CIPP#6246

add scheduling capability in API
add pester test

## Summary

Today, every CIPP-generated HaloPSA ticket lands on the client's
**General User** contact (`userlookup.id = -1`), regardless of which
end-user the alert is actually about. This PR adds a single integration
toggle that, when enabled, splits per-user alerts into one ticket each
and links them to the matching HaloPSA contact - or falls back cleanly
to the General User when no match exists.

Companion PR for the CIPP frontend: KelvinTegelaar/CIPP equivalent
(linked separately).

- **New integration setting `HaloPSA.LinkTicketsToUsers`** (default off,
no behavioural change for existing installs until opted in).
- **New helper `Get-HaloUser`** that looks up a HaloPSA contact by Azure
Object ID first (via `?advanced_search=` against
`azureoid`/`aaduserid`), falling back to email/UPN against
`emailaddress`/`networklogin`/`aaduserid`. The basic `?search=`
parameter doesn't index the AD-sync fields, so we exact-match via
advanced_search where possible and silently fall back when an instance
doesn't whitelist those filter names. IDs are cast to `[int]` so
PowerShell doesn't serialise them back as `95.0`.
- **Per-user splitter in `Send-CIPPScheduledTaskAlert`** - when the
toggle is on and a scheduled-alert task returns rows containing a
UPN-like field
(`UserPrincipalName`/`userPrincipalName`/`UPN`/`userId`/`Userkey`),
groups by user and emits one PSA call per user with an `AffectedUser`
payload.
- **`AffectedUser` parameter on `Send-CIPPAlert -Type 'psa'`** that
threads through to `New-CippExtAlert` and `New-HaloPSATicket`.
- **Audit-log path** (`Invoke-CippWebhookProcessing`) now extracts the
affected user from `ObjectId`/`UserId`/`Userkey` (and their CIPP-mapped
variants) so role-change, password-reset, sessions-revoked,
MFA-disabled, inbox-rule etc. tickets land on the right contact too.
- **`New-HaloPSATicket`** populates `userlookup.id`, `user_name` and
`site_id` from the matched contact when found, and casts `client_id` to
`[int]` so storage-resident IDs (which are stored as strings) don't
break Halo's payload validation.
- **Unmatched users** keep today's General User behaviour but get an
italic notice appended to the description and a Warning logged for
follow-up.
- **Recovery from note-add failures** in the consolidation path: when
adding a note to an existing ticket fails (permission on the configured
outcome, ticket type mismatch, etc.) the function now falls through to
creating a new ticket so the alert isn't silently lost.
- **Diagnostics** in the PSA branch of `Send-CIPPAlert`: explicit "PSA
delivery skipped" message when `sendtoIntegration` is off, plus surfaces
the result string from the Halo call.

Resolves KelvinTegelaar/CIPP#6246

## Problem

Intune assignment resolves group and assignment-filter names with
PowerShell's `-like`
operator. `-like` treats `[ ]` as wildcard character-class syntax, so a
literal group
named `[WIN] Company Devices` never matches itself. Deploying an app (or
policy) to such
a group fails with `No matching groups resolved for assignment
request.`, even though the
group exists with that exact name. Bracket-prefixed naming schemes
(`[WIN]`, `[PROD]`,
`[Pilot]`, ...) are common, so this hits real tenants. Other wildcard
metacharacters in a
literal name (`?`, `*`) are affected the same way.

## Fix

Escape only the square brackets in the supplied name (`` `[ `` / `` `]
``) before the `-like`
match, so `[` and `]` are treated as literal characters instead of a
wildcard character-class.
`*` and `?` are left untouched, so the documented wildcard matching (the
assignment UI labels
say "Wildcards (*) are allowed") keeps working exactly as before. Only
the unintended
bracket-as-character-class behaviour is fixed.

The same root cause is present in every Intune assignment group-name
lookup, so all six
group-resolution sites are fixed together rather than only the one path
in the report:

| File | Group lookups fixed |
|---|---|
| `Set-CIPPAssignedApplication.ps1` | include, exclude |
| `Set-CIPPAssignedPolicy.ps1` | include, exclude |
| `Compare-CIPPIntuneAssignments.ps1` | include, exclude |

This covers app deployment (Standards "Deploy Application", the
Chrome-extension standard,
Office-app deploy, the assign-app endpoint), configuration-policy
assignment, and the
assignment drift/comparison reporting, all of which share the predicate.

Assignment-filter name matching (which also uses `-like`) is
deliberately left unchanged:
`Compare-CIPPIntuneAssignments` documents the filter name as supporting
wildcards, so
escaping it would remove a documented feature. Only group-name
resolution, which is matched
against exact names, is made literal here.

## Behaviour note

Wildcards `*` and `?` still work exactly as documented - only `[` and
`]` are escaped. So
`Sales*` keeps matching every Sales group, while a literal `[WIN]
Company Devices` now
resolves to itself instead of being read as the character-class `[WIN]`.

## Verification

Validated by inspection plus a standalone logic harness that reproduces
the resolution
predicate (old vs new) against a realistic group set including
bracketed, parenthesised and
near-collision names. The harness confirms: the bug pre-fix (bracketed
name resolves to
nothing), the fix post-fix (resolves to the correct group only), plain
names still resolve,
comma-separated multi-group input works, and no over-matching across
similar names.

## Related (separate issue)

`Get-CIPPAlertGroupMembershipChange` uses the same `-like` pattern when
matching audit-log
group names against the admin's monitored-group list. Bracketed
monitored group names would
silently never alert. It is intentionally left out of this PR and raised
separately, because
that path may be intended to support wildcard monitoring and the desired
behaviour is a
maintainer decision.

Return only 1 line instead of 5 per device. 
It's not much more readable. Each device that is added, also is written
to logdata making it a lot easier to find tenants devices were added to.

… dev

Existing tests hardcoded module paths that break whenever a
function moves between modules. Resolve the function under
test by filename under Modules/ instead, so tests keep
passing after file moves. Fixes the Intune/Alert/Standards
tests currently failing on dev.

Set-CIPPMailboxAccess, Invoke-ExecEditMailboxPermissions and
Invoke-ExecModifyMBPerms each duplicated the permission-level
to EXO cmdlet mapping. Route all three through the existing
Set-CIPPMailboxPermission helper (~230 fewer lines) and add
Pester coverage for the three refactored functions.

Intended behavior changes:
- ExecEditMailboxPermissions drops a redundant Graph id
  lookup; the UPN is passed straight to EXO as identity.
- SendOnBehalf now syncs the permission cache, matching
  FullAccess/SendAs.

Bulk processing in ExecModifyMBPerms is unchanged.

Pester coverage for Set-CIPPMailboxPermission,
Set-CIPPMailboxVacation and Remove-CIPPMailboxPermissions:
permission-level to EXO cmdlet mapping, cache sync,
Add/Remove actions and error paths. Tests dot-source the
function under test and stub CIPP helpers, per house style.

Ensure container image build timestamps are converted from PowerShell DateTime values into UTC ISO 8601 strings before they are returned or stored. This avoids ambiguous unspecified kinds and keeps timer-driven update checks and container management responses consistent.

Resolve container update settings through the shared sync path so never-saved fields default to auto-restart on, hourly checks, and 23:00 while still respecting explicit disabled or empty values. Also tighten status reconciliation after restarts and fix check-time validation/formatting so early UTC hours are accepted correctly.

… dev

Refactors the SSO migration checks in `Test-CIPPAccess` to use explicit permission flags. This keeps the forced migration prompt limited to users who can manage app settings and skips migration lookups for users with no assigned permissions.

Add a shared Autopilot profile name validator and use it in both the HTTP endpoint and default deployment profile flow. This catches unsupported Intune characters before submission so the API returns a clear bad request or logged error instead of an opaque service-side 500.

Add `Resolve-CIPPDlpAdvancedRule` and apply it across template capture, policy deploy, and drift comparison so DLP rules keep either `AdvancedRule` or flat condition fields, never both. Update DLP rule field metadata to expose `RuleConditions` and include `AdvancedRule`, then normalize advanced-rule JSON during comparison to avoid false drift from formatting or key-order differences.

… missing"

This reverts commit 24db2c5.

Suppress the SSO migration prompt until the SAM app is configured, matching the same setup-completion check used by GetCippAlerts.

Synced from CyberDrain/CIPP@e8fffcd

chore: Update repository links to new owner

Synced from CyberDrain/CIPP@15b92c3

Synced from CyberDrain/CIPP@7cd0f5b

Guard the forced SSO migration prompt behind initial setup completion. The setup wizard must run first and the SAM app must be configured before ExecSSOSetup can create the CIPP-SSO registration. Backend checks ApplicationID env var; frontend passes setupCompleted prop to ForcedSsoMigrationDialog.

Synced from CyberDrain/CIPP@805cd1b

Synced from CyberDrain/CIPP@7f5ae70

Add a new Super Admin custom domains experience for the CIPP App Service. This includes a backend endpoint to list, validate, add, secure, and remove hostname bindings, plus a frontend wizard and tab entry to guide DNS setup and managed certificate provisioning.

Synced from CyberDrain/CIPP@48b0ca6

Add '*/organization' to the list of URIs that bypass tenant authorization checks, allowing organization-level Graph API calls to proceed without tenant filtering.

Synced from CyberDrain/CIPP@a47d53f

Synced from CyberDrain/CIPP@34507d2

…anagement

Updated the Invoke-CIPPSharePointTemplateDeploy function to support site type differentiation (SharePoint or Teams) and added an override option for site types. Enhanced the UI components to reflect these changes, including site type selection in the template builder.

Synced from CyberDrain/CIPP@9ff328b

… deployment

Enhanced the Invoke-CIPPSharePointTemplateDeploy function to track and log failures during permission setting for sites and libraries. Introduced a mechanism to summarize failures and update deployment status accordingly. Updated UI text for clarity in permission management options.

Synced from CyberDrain/CIPP@a683180

Fresh deployments carry template placeholder values (e.g. LongApplicationId, AppSecret) until the setup wizard completes. Previously these were treated as valid credentials, causing EasyAuth issuer reconciliation to rewrite a correctly configured issuer and break sign-in. Now placeholder values are detected and the instance is treated as unconfigured.

Synced from CyberDrain/CIPP@77776c5

Synced from CyberDrain/CIPP@f079294

Adds a full SharePoint Permissions report with cached data collection, PDF export, and oversharing signal detection (tenant-wide grants, external grants, direct Full Control, detached libraries).

Key additions:
- Backend: SharePointPermissions cache type, batched site collection via activity triggers, REST API endpoints for listing/setting/removing library permissions, role definitions, site user access, and multi-queue status
- Frontend: Permissions Report page with charts and filters, Library Permissions dialog (add/change/remove/inheritance control), Check User Access dialog, multi-queue progress tracker, query refresh button, reusable PDF primitives
- Sharing report enhancements: sprawl signals (anonymous editable links, never-expiring links, folder shares, external recipients), top libraries/recipients charts, PDF export, queue progress tracking

Synced from CyberDrain/CIPP@a2156f3

Clean up the CIPP_SSO_RESET app setting when EasyAuth is already active (setup completed externally), and skip auto-configuration when the flag is set without EasyAuth — directing users to the setup wizard instead.

Also remove the flag at the end of successful SSO setup flows (both migration and manual credential paths) so warmup's auto-configure can proceed on the next restart.

Synced from CyberDrain/CIPP@4f8da0f

Synced from CyberDrain/CIPP@f5833a7