Merge pull request #1104 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

Config/standards.json

@@ -1459,10 +1459,23 @@
     "cat": "Entra (AAD) Standards",
     "tag": ["CISA (MS.AAD.21.1v1)", "SMB1001 (2.8)"],
     "appliesToTest": ["SMB1001_2_8", "ZTNA21868"],
-    "helpText": "Restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc",
-    "docsDescription": "Users by default are allowed to create M365 groups. This restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc",
-    "executiveText": "Restricts the creation of Microsoft 365 groups, Teams, and SharePoint sites to authorized administrators, preventing uncontrolled proliferation of collaboration spaces. This ensures proper governance, naming conventions, and resource management while maintaining oversight of all collaborative environments.",
-    "addedComponent": [],
+    "helpText": "Restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc. Optionally allows members of a specific security group to keep creating groups (GroupCreationAllowedGroupId).",
+    "docsDescription": "Users by default are allowed to create M365 groups. This restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc. Optionally, a security group can be named whose members remain allowed to create groups; the group is resolved by display name in each tenant and can be created automatically when it does not exist. When no group is named, the existing GroupCreationAllowedGroupId value in the tenant is left untouched.",
+    "executiveText": "Restricts the creation of Microsoft 365 groups, Teams, and SharePoint sites to authorized administrators, preventing uncontrolled proliferation of collaboration spaces. This ensures proper governance, naming conventions, and resource management while maintaining oversight of all collaborative environments. An approved group of designated users can optionally retain the ability to create groups.",
+    "addedComponent": [
+      {
+        "type": "textField",
+        "name": "standards.DisableM365GroupUsers.AllowedGroupName",
+        "label": "Optional: name of the group whose members may still create M365 groups",
+        "required": false
+      },
+      {
+        "type": "switch",
+        "name": "standards.DisableM365GroupUsers.CreateGroup",
+        "label": "Create the allowed group if it does not exist",
+        "required": false
+      }
+    ],
     "label": "Disable M365 Group creation by users",
     "impact": "Low Impact",
     "impactColour": "info",
@@ -3219,6 +3232,21 @@
     "powershellEquivalent": "Get-Mailbox & Update-MgUser",
     "recommendedBy": ["CIS", "CIPP"]
   },
+  {
+    "name": "standards.TeamsDisableResourceAccounts",
+    "cat": "Teams Standards",
+    "tag": ["NIST CSF 2.0 (PR.AA-01)"],
+    "helpText": "Blocks sign-in for all Teams resource accounts used by Auto Attendants and Call Queues. Microsoft's guidance is to block sign-in for resource accounts as they do not require an interactive login to function.",
+    "docsDescription": "Teams resource accounts (the accounts backing Auto Attendants and Call Queues) do not require interactive sign-in to function. If sign-in is enabled and the password is reset, the account can be logged into directly, which presents a security risk. Microsoft's guidance is to block sign-in for these accounts. Accounts that are synced from on-premises AD are excluded, as account state is managed in the on-premises AD.",
+    "executiveText": "Prevents direct login to the service accounts that power phone system features like Auto Attendants and Call Queues. These accounts work without anyone signing into them, so blocking sign-in removes an unnecessary attack surface while keeping the phone system fully functional.",
+    "addedComponent": [],
+    "label": "Block sign-in for Teams resource accounts",
+    "impact": "Medium Impact",
+    "impactColour": "warning",
+    "addedDate": "2026-07-17",
+    "powershellEquivalent": "Get-CsOnlineApplicationInstance & Update-MgUser",
+    "recommendedBy": ["Microsoft", "CIPP"]
+  },
   {
     "name": "standards.DisableResourceMailbox",
     "cat": "Exchange Standards",

Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1

@@ -15,6 +15,7 @@ function Get-CIPPAlertQuotaUsed {
     $Threshold = if ($InputValue.QuotaUsedQuota) { [int]$InputValue.QuotaUsedQuota } else { 90 }
     $ExcludedRaw = Get-CIPPTextReplacement -TenantFilter $TenantFilter -Text ([string]$InputValue.QuotaUsedExcludedMailboxes)
     $Excluded = @($ExcludedRaw -split ',' | ForEach-Object { $_.Trim().ToLower() } | Where-Object { $_ })
+    $MailboxTypes = @($InputValue.QuotaUsedMailboxTypes.value | Where-Object { $_ })
 
     try {
         $AlertData = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getMailboxUsageDetail(period='D7')?`$format=application/json&`$top=999" -tenantid $TenantFilter
@@ -27,8 +28,10 @@ function Get-CIPPAlertQuotaUsed {
     $OverQuota = $AlertData | ForEach-Object {
         if (!$_.StorageUsedInBytes -or !$_.prohibitSendReceiveQuotaInBytes) { return }
         if ($Excluded -contains $_.userPrincipalName.ToLower()) { return }
+        # Report returns 'User'/'Shared' or 'UserMailbox'/'SharedMailbox' depending on tenant; normalize before matching
+        if ($MailboxTypes.Count -gt 0 -and ($_.recipientType -replace 'Mailbox$') -notin $MailboxTypes) { return }
         $UsagePercent = [math]::Round(($_.storageUsedInBytes / $_.prohibitSendReceiveQuotaInBytes) * 100)
-        if ($UsagePercent -gt $Threshold) {
+        if ($UsagePercent -ge $Threshold) {
             [PSCustomObject]@{
                 Message                         = "$($_.userPrincipalName): Mailbox is more than $($Threshold)% full. Mailbox is $UsagePercent% full"
                 Owner                           = $_.userPrincipalName

Modules/CIPPCore/Public/Add-CIPPApplicationPermission.ps1

@@ -31,11 +31,9 @@ function Add-CIPPApplicationPermission {
     } else {
         if (!$RequiredResourceAccess -and $TemplateId) {
             Write-Information "Adding application permissions for template $TemplateId"
-            $TemplateTable = Get-CIPPTable -TableName 'templates'
-            $Filter = "RowKey eq '$TemplateId' and PartitionKey eq 'AppApprovalTemplate'"
-            $Template = (Get-CIPPAzDataTableEntity @TemplateTable -Filter $Filter).JSON | ConvertFrom-Json -ErrorAction SilentlyContinue
-            $ApplicationId = $Template.AppId
-            $Permissions = $Template.Permissions
+            $TemplatePermissions = Get-CIPPAppApprovalPermissions -TemplateId $TemplateId
+            $ApplicationId = $TemplatePermissions.ApplicationId
+            $Permissions = $TemplatePermissions.Permissions
             $RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
             foreach ($AppId in $Permissions.PSObject.Properties.Name) {
                 $AppPermissions = @($Permissions.$AppId.applicationPermissions)

Modules/CIPPCore/Public/Add-CIPPDelegatedPermission.ps1

@@ -45,11 +45,9 @@ function Add-CIPPDelegatedPermission {
     } else {
         if (!$RequiredResourceAccess -and $TemplateId) {
             Write-Information "Adding delegated permissions for template $TemplateId"
-            $TemplateTable = Get-CIPPTable -TableName 'templates'
-            $Filter = "RowKey eq '$TemplateId' and PartitionKey eq 'AppApprovalTemplate'"
-            $Template = (Get-CIPPAzDataTableEntity @TemplateTable -Filter $Filter).JSON | ConvertFrom-Json -ErrorAction SilentlyContinue
-            $ApplicationId = $Template.AppId
-            $Permissions = $Template.Permissions
+            $TemplatePermissions = Get-CIPPAppApprovalPermissions -TemplateId $TemplateId
+            $ApplicationId = $TemplatePermissions.ApplicationId
+            $Permissions = $TemplatePermissions.Permissions
             $NoTranslateRequired = $true
             $RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
             foreach ($AppId in $Permissions.PSObject.Properties.Name) {

Modules/CIPPCore/Public/Get-CIPPAppApprovalPermissions.ps1

@@ -0,0 +1,51 @@
+function Get-CIPPAppApprovalPermissions {
+    <#
+    .SYNOPSIS
+        Resolves the effective permissions for an App Approval template.
+    .DESCRIPTION
+        App Approval templates persist a copy of the permission set at the time the template was saved.
+        That copy goes stale the moment the linked permission set is edited, so when a template links to
+        a permission set the set is treated as the source of truth. Templates without a PermissionSetId
+        (older or hand-built ones) fall back to the copy stored on the template.
+    .PARAMETER TemplateId
+        RowKey of the AppApprovalTemplate to resolve.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TemplateId
+    )
+
+    $TemplateTable = Get-CIPPTable -TableName 'templates'
+    $Filter = "RowKey eq '$TemplateId' and PartitionKey eq 'AppApprovalTemplate'"
+    $Template = (Get-CIPPAzDataTableEntity @TemplateTable -Filter $Filter).JSON | ConvertFrom-Json -ErrorAction SilentlyContinue
+
+    if (!$Template) {
+        Write-Information "App approval template $TemplateId not found"
+        return $null
+    }
+
+    $Permissions = $Template.Permissions
+
+    if ($Template.PermissionSetId) {
+        $PermissionsTable = Get-CIPPTable -TableName 'AppPermissions'
+        $SetFilter = "PartitionKey eq 'Templates' and RowKey eq '$($Template.PermissionSetId)'"
+        $PermissionSet = Get-CIPPAzDataTableEntity @PermissionsTable -Filter $SetFilter
+
+        if ($PermissionSet.Permissions) {
+            $SetPermissions = $PermissionSet.Permissions | ConvertFrom-Json -ErrorAction SilentlyContinue
+            if ($SetPermissions) {
+                $Permissions = $SetPermissions
+            } else {
+                Write-Information "Permission set $($Template.PermissionSetId) for template $TemplateId could not be parsed, falling back to the permissions stored on the template"
+            }
+        } else {
+            Write-Information "Permission set $($Template.PermissionSetId) for template $TemplateId not found, falling back to the permissions stored on the template"
+        }
+    }
+
+    return [PSCustomObject]@{
+        ApplicationId = $Template.AppId
+        Permissions   = $Permissions
+    }
+}