Merge pull request #1020 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1

@@ -11,10 +11,12 @@ function Push-ExecScheduledCommand {
     $OrchestratorBasedCommands = @('Invoke-CIPPOffboardingJob')
 
     # Initialize AsyncLocal storage for thread-safe per-invocation context
-    if (-not $global:CippScheduledTaskIdStorage) {
-        $global:CippScheduledTaskIdStorage = [System.Threading.AsyncLocal[string]]::new()
-    }
-    $global:CippScheduledTaskIdStorage.Value = $Item.TaskInfo.RowKey
+    # Store task id in CIPPCore module-scoped AsyncLocal storage so Write-LogMessage can read it -
+    # global vars are unreliable in Azure Functions
+    Set-CippScheduledTaskContext -TaskId $Item.TaskInfo.RowKey
+
+    # Store action source + creating user identity (from stored headers) for outbound User-Agent attribution
+    Set-CippUserAgentContext -Headers $Item.Parameters.Headers -Source 'scheduled-task' -TaskId $Item.TaskInfo.RowKey
 
     $Table = Get-CippTable -tablename 'ScheduledTasks'
     $task = $Item.TaskInfo
@@ -179,7 +181,7 @@ function Push-ExecScheduledCommand {
         return
     }
 
-    if ($Command.Module -notin @('CIPPCore', 'CIPPAlerts', 'CIPPStandards', 'CIPPTests', 'CIPPDB', 'CippExtensions')) {
+    if ($Command.Module -notin @('CIPPCore', 'CIPPAlerts', 'CIPPStandards', 'CIPPTests', 'CIPPDB', 'CippExtensions', 'CIPPActivityTriggers')) {
         $State = 'Failed'
         Write-LogMessage -headers $Headers -API 'ScheduledTask' -message "Blocked attempt to schedule command from unauthorized module: $($Command.ModuleName)\$($Item.Command)" -Sev 'Warning'
         $Results = "Task blocked: The command '$($Item.Command)' is not permitted to run as a scheduled task."

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1

@@ -46,12 +46,12 @@ function Push-CIPPStandard {
         return
     }
 
-    # Initialize AsyncLocal storage for thread-safe per-invocation context
-    # Uses $global: so Write-LogMessage (CIPPCore module) can read it across module boundaries
-    if (-not $global:CippStandardInfoStorage) {
-        $global:CippStandardInfoStorage = [System.Threading.AsyncLocal[object]]::new()
-    }
-    $global:CippStandardInfoStorage.Value = $StandardInfo
+    # Store standard info in CIPPCore module-scoped AsyncLocal storage so Write-LogMessage and
+    # Set-CIPPStandardsCompareField can read it - global vars are unreliable in Azure Functions
+    Set-CippStandardInfoContext -StandardInfo $StandardInfo
+
+    # Store action source + template id for outbound User-Agent attribution
+    Set-CippUserAgentContext -Source 'standard' -TemplateId $Item.TemplateId
 
     # ---- Standard execution telemetry ----
     $runId = [guid]::NewGuid().ToString()
@@ -131,8 +131,6 @@ function Push-CIPPStandard {
                 Error        = $err
             } | ConvertTo-Json -Compress)
 
-        if ($global:CippStandardInfoStorage) {
-            $global:CippStandardInfoStorage.Value = $null
-        }
+        Set-CippStandardInfoContext -StandardInfo $null
     }
 }

Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1

@@ -70,7 +70,7 @@ function Add-CIPPScheduledTask {
             $ImportedModules = [System.Collections.Generic.List[string]]::new()
             if (-not $Command) {
                 try {
-                    foreach ($SiblingModule in @('CIPPStandards', 'CIPPAlerts', 'CIPPTests', 'CIPPDB', 'CippExtensions')) {
+                    foreach ($SiblingModule in @('CIPPStandards', 'CIPPAlerts', 'CIPPTests', 'CIPPDB', 'CippExtensions', 'CIPPActivityTriggers')) {
                         if (-not (Get-Module -Name $SiblingModule)) {
                             Import-Module $SiblingModule -ErrorAction SilentlyContinue
                             if (Get-Module -Name $SiblingModule) {
@@ -91,7 +91,7 @@ function Add-CIPPScheduledTask {
                 return "Error - The command '$RequestedCommand' does not exist and cannot be scheduled."
             }
 
-            if ($Command.Module -notin @('CIPPCore', 'CIPPAlerts', 'CIPPStandards', 'CIPPTests', 'CIPPDB', 'CippExtensions')) {
+            if ($Command.Module -notin @('CIPPCore', 'CIPPAlerts', 'CIPPStandards', 'CIPPTests', 'CIPPDB', 'CippExtensions', 'CIPPActivityTriggers')) {
                 Write-LogMessage -headers $Headers -API 'ScheduledTask' -message "Blocked attempt to schedule command from unauthorized module: $($Command.ModuleName)\$RequestedCommand" -Sev 'Warning'
                 return "Error - The command '$RequestedCommand' is not permitted to run as a scheduled task."
             }

Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1

@@ -61,6 +61,9 @@ function New-CippCoreRequest {
         }
     }
 
+    # Store action source + acting identity for outbound User-Agent attribution
+    Set-CippUserAgentContext -Headers $Request.Headers
+
     # Check if endpoint is disabled via feature flags
     $FeatureFlags = Get-CIPPFeatureFlag
 

Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1

@@ -5,6 +5,7 @@ function Start-CIPPStatsTimer {
     #>
     [CmdletBinding(SupportsShouldProcess = $true)]
     param()
+
     #These stats are sent to a central server to help us understand how many tenants are using the product, and how many are using the latest version, this information allows the CIPP team to make decisions about what features to support, and what features to deprecate.
 
 
@@ -31,6 +32,7 @@ function Start-CIPPStatsTimer {
         $FunctionOffloading = (Get-CIPPAzDataTableEntity @ConfigTable -Filter "RowKey eq 'OffloadFunctions' and PartitionKey eq 'OffloadFunctions'").state
         $OffloadingEnabled = $false
         [bool]::TryParse($FunctionOffloading, [ref]$OffloadingEnabled) | Out-Null
+        $CIPPNG = $env:CIPPNG -eq 'true'
 
         # Get counts of various entities across all tenants
         $counts = Get-CIPPDbItem -TenantFilter AllTenants -CountsOnly
@@ -39,30 +41,42 @@ function Start-CIPPStatsTimer {
         $groupsCount = ($counts | Where-Object { $_.RowKey -eq 'Groups-Count' } | Measure-Object -Property DataCount -Sum).Sum
         $managedDevicesCount = ($counts | Where-Object { $_.RowKey -eq 'ManagedDevices-Count' } | Measure-Object -Property DataCount -Sum).Sum
         $policyCount = ($counts | Where-Object { $_.RowKey -match 'Intune' -and $_.RowKey -match 'Policies|Policy' } | Measure-Object -Property DataCount -Sum).Sum
+        $deployedApps = ($counts | Where-Object { $_.RowKey -eq 'IntuneApplications-Count' } | Measure-Object -Property DataCount -Sum).Sum
+        $ReportsTable = Get-CippTable -tablename 'ReportBuilderTemplates'
+        $CustomReportCount = (Get-CIPPAzDataTableEntity @ReportsTable -Filter "PartitionKey eq 'ReportBuilderTemplates'").count
+        $uniqueStandardsApplied = Get-CIPPStatsUniqueStandardsApplied
+        $driftStandardsCount = Get-CIPPStatsDriftStandardsCount
+        $mobileEnrollment = Get-CIPPStatsMobileEnrollment
 
         $SendingObject = [PSCustomObject]@{
-            rgid                = $env:WEBSITE_SITE_NAME
-            SetupComplete       = $SetupComplete
-            Hosted              = $env:CIPP_HOSTED -eq 'true'
-            OffloadingEnabled   = $OffloadingEnabled
-            RunningVersionAPI   = $APIVersion.trim()
-            CountOfTotalTenants = $TenantCount
-            uid                 = $env:TenantID
-            UserCount           = $userCount
-            DeviceCount         = $deviceCount
-            GroupsCount         = $groupsCount
-            ManagedDevicesCount = $managedDevicesCount
-            PolicyCount         = $policyCount
-            CIPPAPI             = $RawExt.CIPPAPI.Enabled
-            Hudu                = $RawExt.Hudu.Enabled
-            Sherweb             = $RawExt.Sherweb.Enabled
-            Gradient            = $RawExt.Gradient.Enabled
-            NinjaOne            = $RawExt.NinjaOne.Enabled
-            haloPSA             = $RawExt.haloPSA.Enabled
-            HIBP                = $RawExt.HIBP.Enabled
-            PWPush              = $RawExt.PWPush.Enabled
-            CFZTNA              = $RawExt.CFZTNA.Enabled
-            GitHub              = $RawExt.GitHub.Enabled
+            rgid                   = $env:WEBSITE_SITE_NAME
+            SetupComplete          = $SetupComplete
+            Hosted                 = $env:CIPP_HOSTED -eq 'true'
+            CIPPNG                 = $CIPPNG
+            OffloadingEnabled      = $OffloadingEnabled
+            RunningVersionAPI      = $APIVersion.trim()
+            CountOfTotalTenants    = $TenantCount
+            uid                    = $env:TenantID
+            UserCount              = $userCount
+            DeviceCount            = $deviceCount
+            GroupsCount            = $groupsCount
+            ManagedDevicesCount    = $managedDevicesCount
+            PolicyCount            = $policyCount
+            UniqueStandardsApplied = $uniqueStandardsApplied
+            DriftStandardsCount    = $driftStandardsCount
+            MobileEnrollment       = $mobileEnrollment
+            DeployedApps           = $deployedApps
+            CustomReportCount      = $CustomReportCount
+            CIPPAPI                = $RawExt.CIPPAPI.Enabled
+            Hudu                   = $RawExt.Hudu.Enabled
+            Sherweb                = $RawExt.Sherweb.Enabled
+            Gradient               = $RawExt.Gradient.Enabled
+            NinjaOne               = $RawExt.NinjaOne.Enabled
+            haloPSA                = $RawExt.haloPSA.Enabled
+            HIBP                   = $RawExt.HIBP.Enabled
+            PWPush                 = $RawExt.PWPush.Enabled
+            CFZTNA                 = $RawExt.CFZTNA.Enabled
+            GitHub                 = $RawExt.GitHub.Enabled
         } | ConvertTo-Json
 
         try {

Modules/CIPPCore/Public/Get-CIPPStatsDriftStandardsCount.ps1

@@ -0,0 +1,55 @@
+function Get-CIPPStatsDriftStandardsCount {
+    [CmdletBinding()]
+    param()
+
+    try {
+        $Standards = @(Get-CIPPStandards -TenantFilter allTenants)
+        $TemplateTable = Get-CippTable -tablename 'templates'
+        $TemplateRows = @(Get-CIPPAzDataTableEntity @TemplateTable -Filter "PartitionKey eq 'StandardsTemplateV2'")
+
+        $TemplateTypeByGuid = @{}
+        foreach ($TemplateRow in $TemplateRows) {
+            if ([string]::IsNullOrWhiteSpace($TemplateRow.JSON)) { continue }
+
+            try {
+                $TemplateData = $TemplateRow.JSON | ConvertFrom-Json -Depth 30 -ErrorAction Stop
+            } catch {
+                continue
+            }
+
+            $TemplateGuid = [string]($TemplateData.GUID ?? $TemplateRow.GUID)
+            if ([string]::IsNullOrWhiteSpace($TemplateGuid)) { continue }
+
+            $TemplateTypeByGuid[$TemplateGuid] = [string]$TemplateData.type
+        }
+
+        $DriftStandardIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        foreach ($Standard in $Standards) {
+            if ([string]::IsNullOrWhiteSpace($Standard.TemplateId)) { continue }
+            if ([string]::IsNullOrWhiteSpace($Standard.Standard)) { continue }
+            if (-not $TemplateTypeByGuid.ContainsKey([string]$Standard.TemplateId)) { continue }
+            if ($TemplateTypeByGuid[[string]$Standard.TemplateId] -ne 'drift') { continue }
+
+            $TemplateValue = $null
+            if ($Standard.Settings -and $Standard.Settings.PSObject.Properties['TemplateList']) {
+                if ($Standard.Settings.TemplateList -and $Standard.Settings.TemplateList.PSObject.Properties['value']) {
+                    $TemplateValue = [string]$Standard.Settings.TemplateList.value
+                }
+            }
+
+            $Id = if ([string]::IsNullOrWhiteSpace($TemplateValue)) {
+                [string]$Standard.Standard
+            } else {
+                "{0}|{1}" -f $Standard.Standard, $TemplateValue
+            }
+
+            if ([string]::IsNullOrWhiteSpace($Id)) { continue }
+            [void]$DriftStandardIds.Add($Id)
+        }
+
+        return $DriftStandardIds.Count
+    } catch {
+        Write-LogMessage -API 'CIPPStatsTimer' -tenant $env:TenantID -message "Failed to calculate DriftStandardsCount: $($_.Exception.Message)" -sev Warning
+        return 0
+    }
+}

Modules/CIPPCore/Public/Get-CIPPStatsMobileEnrollment.ps1

@@ -0,0 +1,28 @@
+function Get-CIPPStatsMobileEnrollment {
+    [CmdletBinding()]
+    param()
+
+    try {
+        $MobileEnrollment = 0
+        $ManagedDeviceRows = Get-CIPPDbItem -TenantFilter allTenants -Type 'ManagedDevices'
+        foreach ($ManagedDeviceRow in $ManagedDeviceRows) {
+            if (-not $ManagedDeviceRow.Data) { continue }
+
+            try {
+                $ManagedDevice = $ManagedDeviceRow.Data | ConvertFrom-Json -Depth 20 -ErrorAction Stop
+            } catch {
+                continue
+            }
+
+            $OperatingSystem = [string]$ManagedDevice.operatingSystem
+            if ($OperatingSystem -match 'iOS|iPadOS|Android') {
+                $MobileEnrollment++
+            }
+        }
+
+        return $MobileEnrollment
+    } catch {
+        Write-LogMessage -API 'CIPPStatsTimer' -tenant $env:TenantID -message "Failed to calculate MobileEnrollment: $($_.Exception.Message)" -sev Warning
+        return 0
+    }
+}

Modules/CIPPCore/Public/Get-CIPPStatsUniqueStandardsApplied.ps1

@@ -0,0 +1,34 @@
+function Get-CIPPStatsUniqueStandardsApplied {
+    [CmdletBinding()]
+    param()
+
+    try {
+        $Standards = @(Get-CIPPStandards -TenantFilter allTenants)
+        $DistinctStandards = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+
+        foreach ($Standard in $Standards) {
+            if (-not $Standard.Standard) { continue }
+
+            $TemplateValue = $null
+            if ($Standard.Settings -and $Standard.Settings.PSObject.Properties['TemplateList']) {
+                if ($Standard.Settings.TemplateList -and $Standard.Settings.TemplateList.PSObject.Properties['value']) {
+                    $TemplateValue = [string]$Standard.Settings.TemplateList.value
+                }
+            }
+
+            $Id = if ([string]::IsNullOrWhiteSpace($TemplateValue)) {
+                [string]$Standard.Standard
+            } else {
+                '{0}|{1}' -f $Standard.Standard, $TemplateValue
+            }
+
+            if ([string]::IsNullOrWhiteSpace($Id)) { continue }
+            [void]$DistinctStandards.Add($Id)
+        }
+
+        return $DistinctStandards.Count
+    } catch {
+        Write-LogMessage -API 'CIPPStatsTimer' -tenant $env:TenantID -message "Failed to calculate UniqueStandardsApplied: $($_.Exception.Message)" -sev Warning
+        return 0
+    }
+}

Modules/CIPPCore/Public/GraphHelper/Get-CippUserAgent.ps1

@@ -0,0 +1,34 @@
+function Get-CippUserAgent {
+    <#
+    .SYNOPSIS
+        Builds the User-Agent string for outbound M365 API requests.
+    .DESCRIPTION
+        Returns 'CIPP/<version>' optionally suffixed with semicolon-delimited 'key:value' context segments
+        set via Set-CippUserAgentContext, e.g. 'CIPP/8.2.0 (user:john@msp.com)' or
+        'CIPP/8.2.0 (scheduled-task:<taskid>; user:john@msp.com)'.
+        This allows MDR/security teams to attribute CIPP activity in M365 audit logs.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    $Version = $env:CippVersion ?? $env:APP_VERSION ?? '1.0'
+    $Context = $script:CippUserAgentContextStorage.Value
+
+    if ($Context.Source) {
+        $Segments = [System.Collections.Generic.List[string]]::new()
+        if ($Context.Source -in @('user', 'api')) {
+            # Identity belongs to the source itself, e.g. user:john@msp.com or api:<appid>
+            $Segments.Add($Context.Identity ? ('{0}:{1}' -f $Context.Source, $Context.Identity) : $Context.Source)
+        } else {
+            $Id = @($Context.TaskId, $Context.TemplateId) | Where-Object { $_ } | Select-Object -First 1
+            $Segments.Add($Id ? ('{0}:{1}' -f $Context.Source, $Id) : $Context.Source)
+            if ($Context.Identity) {
+                $Segments.Add('user:{0}' -f $Context.Identity)
+            }
+        }
+        return ('CIPP/{0} ({1})' -f $Version, ($Segments -join '; '))
+    }
+    return ('CIPP/{0}' -f $Version)
+}

Modules/CIPPCore/Public/GraphHelper/New-GraphGetRequest.ps1

@@ -54,7 +54,7 @@ function New-GraphGetRequest {
         }
 
         if (!$headers['User-Agent']) {
-            $headers['User-Agent'] = "CIPP/$($global:CippVersion ?? '1.0')"
+            $headers['User-Agent'] = Get-CippUserAgent
         }