Merge pull request #1057 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

Config/MaliciousApps.json

@@ -1587,8 +1587,8 @@
       "ZTNA21807",
       "ZTNA21810"
     ],
-    "helpText": "Disables users from being able to consent to applications, except for those specified in the field below",
-    "docsDescription": "Requires users to get administrator consent before sharing data with applications. You can preapprove specific applications.",
+    "helpText": "Disables users from being able to consent to applications, except for those specified in the field below. This standard conflicts with the \"Allow users to consent to applications with low security risk\" standard; only one of the two should be assigned per tenant.",
+    "docsDescription": "Requires users to get administrator consent before sharing data with applications. You can preapprove specific applications. This standard conflicts with the \"Allow users to consent to applications with low security risk\" (OauthConsentLowSec) standard. Enabling both on the same tenant causes a remediation conflict, so only assign one.",
     "executiveText": "Requires administrative approval before employees can grant applications access to company data, preventing unauthorized data sharing and potential security breaches. This protects against malicious applications while allowing approved business tools to function normally.",
     "addedComponent": [
       {
@@ -1609,8 +1609,8 @@
     "name": "standards.OauthConsentLowSec",
     "cat": "Entra (AAD) Standards",
     "tag": ["IntegratedApps"],
-    "helpText": "Sets the default oauth consent level so users can consent to applications that have low risks.",
-    "docsDescription": "Allows users to consent to applications with low assigned risk.",
+    "helpText": "Sets the default oauth consent level so users can consent to applications that have low risks. This standard conflicts with the \"Require admin consent for applications\" standard; only one of the two should be assigned per tenant.",
+    "docsDescription": "Allows users to consent to applications with low assigned risk. This standard conflicts with the \"Require admin consent for applications (Prevent OAuth phishing)\" (OauthConsent) standard. Enabling both on the same tenant causes a remediation conflict, so only assign one.",
     "executiveText": "Allows employees to approve low-risk applications without administrative intervention, balancing security with productivity. This provides a middle ground between complete restriction and open access, enabling business agility while maintaining protection against high-risk applications.",
     "label": "Allow users to consent to applications with low security risk (Prevent OAuth phishing. Lower impact, less secure)",
     "impact": "Medium Impact",

Config/standards.json

@@ -11,6 +11,27 @@ function Push-CIPPStandard {
 
     $Tenant = $Item.Tenant
     $Standard = $Item.Standard
+
+    # FUTURE USE - ZAC
+    # Grouped Conditional Access batch: deploy all of a tenant's CA templates in one sequential
+    # pass. Per-template rerun checks and standard-info context are handled inside the batch
+    # function, so we bypass the generic per-item dispatch below.
+    # if ($Item.BatchTemplates) {
+    #     $TemplateCount = @($Item.BatchTemplates).Count
+    #     Write-Information "Received Conditional Access batch for $Tenant with $TemplateCount template(s)."
+    #     Set-CippUserAgentContext -Source 'standard' -TemplateId $Item.TemplateId
+    #     $QueuedTime = if ($Item.QueuedTime) { [int64]$Item.QueuedTime } else { 0 }
+    #     try {
+    #         Invoke-CIPPCATemplateBatch -Tenant $Tenant -Templates $Item.BatchTemplates -QueuedTime $QueuedTime
+    #         Write-Information "Conditional Access batch completed for tenant $Tenant"
+    #     } catch {
+    #         Write-LogMessage -API 'Standards' -tenant $Tenant -message "Error running Conditional Access batch for tenant $Tenant - $($_.Exception.Message)" -sev Error -LogData (Get-CippException -Exception $_)
+    #         Write-Warning "Error running Conditional Access batch for tenant $Tenant - $($_.Exception.Message)"
+    #         throw $_.Exception.Message
+    #     }
+    #     return
+    # }
+
     $FunctionName = 'Invoke-CIPPStandard{0}' -f $Standard
 
     Write-Information "We'll be running $FunctionName"

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1

@@ -20,6 +20,32 @@ function Push-CIPPStandardsApplyBatch {
             return
         }
 
+        # FUTURE USE - ZAC
+        # Group all ConditionalAccessTemplate standards per tenant into a single batch item so
+        # they deploy sequentially (one activity per tenant) instead of fanning out one activity
+        # per template. This removes the 429 storm against the ~1 req/s CA write endpoint and the
+        # duplicate named location / c1-c99 / 1040 races. Non-CA standards pass through unchanged.
+        # $CAStandards = @($AllStandards | Where-Object { $_.Standard -eq 'ConditionalAccessTemplate' })
+        # if ($CAStandards.Count -gt 0) {
+        #     $OtherStandards = @($AllStandards | Where-Object { $_.Standard -ne 'ConditionalAccessTemplate' })
+        #     $GroupedCA = foreach ($TenantGroup in ($CAStandards | Group-Object -Property Tenant)) {
+        #         [pscustomobject]@{
+        #             Tenant         = $TenantGroup.Name
+        #             Standard       = 'ConditionalAccessTemplate'
+        #             FunctionName   = 'CIPPStandard'
+        #             QueuedTime     = ($TenantGroup.Group | Select-Object -First 1).QueuedTime
+        #             BatchTemplates = @($TenantGroup.Group | ForEach-Object {
+        #                     [pscustomobject]@{
+        #                         Settings   = $_.Settings
+        #                         TemplateId = $_.TemplateId
+        #                     }
+        #                 })
+        #         }
+        #     }
+        #     $AllStandards = @($OtherStandards) + @($GroupedCA)
+        #     Write-Information "Grouped $($CAStandards.Count) Conditional Access template standards into $(@($GroupedCA).Count) per-tenant batch item(s)."
+        # }
+
         Write-Information "Aggregated $($AllStandards.Count) standards from all tenants: $($AllStandards | ConvertTo-Json -Depth 5 -Compress)"
 
         # Start orchestrator to apply standards

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsApplyBatch.ps1

@@ -3,7 +3,7 @@ function Get-CIPPAlertHuntressRogueApps {
     .SYNOPSIS
         Check for rogue apps in a Tenant
     .DESCRIPTION
-        This function checks for rogue apps in the tenant by comparing the service principals in the tenant with a list of known rogue apps provided by Huntress.
+        This function checks for rogue apps in the tenant by comparing the service principals in the tenant with a list of known rogue apps provided by Huntress and a CIPP collections of appids.
     .FUNCTIONALITY
         Entrypoint
     .LINK
@@ -19,8 +19,23 @@ function Get-CIPPAlertHuntressRogueApps {
 
     try {
         $RogueApps = Invoke-RestMethod -Uri 'https://huntresslabs.github.io/rogueapps/rogueapps.json'
-        $RogueAppFilter = $RogueApps.appId -join "','"
-        $ServicePrincipals = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$filter=appId in ('$RogueAppFilter')" -tenantid $TenantFilter
+        $CippRogueApps = (Get-Content -Path (Join-Path $env:CIPPRootPath 'Config\schemaDefinitions.json') | ConvertFrom-Json).applications.appId
+        $HuntressRogueApps = $RogueApps.appId
+        $RogueAppIds = @($CippRogueApps) + @($HuntressRogueApps) | Where-Object { $_ } | Select-Object -Unique
+        $Requests = for ($i = 0; $i -lt $RogueAppIds.Count; $i += 15) {
+            $Chunk = $RogueAppIds[$i..([Math]::Min($i + 14, $RogueAppIds.Count - 1))]
+            @{
+                id     = [string]$i
+                method = 'GET'
+                url    = "servicePrincipals?`$filter=appId in ('$($Chunk -join "','")')"
+            }
+        }
+        $Requests = @($Requests)
+
+        $ServicePrincipals = if ($Requests.Count -gt 0) {
+            $Responses = New-GraphBulkRequest -Requests $Requests -tenantid $TenantFilter
+            foreach ($Response in $Responses) { $Response.body.value }
+        }
         # If IgnoreDisabledApps is true, filter out disabled service principals
         if ($InputValue -eq $true) {
             $ServicePrincipals = $ServicePrincipals | Where-Object { $_.accountEnabled -eq $true }

Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertHuntressRogueApps.ps1

@@ -48,6 +48,12 @@ function Start-CIPPStatsTimer {
         $driftStandardsCount = Get-CIPPStatsDriftStandardsCount
         $mobileEnrollment = Get-CIPPStatsMobileEnrollment
 
+        # Feature flags
+        $FeatureFlags = @{}
+        Get-CIPPFeatureFlag | Select-Object -Property Id, Enabled | ForEach-Object {
+            $FeatureFlags[$_.Id] = $_.Enabled
+        }
+
         $SendingObject = [PSCustomObject]@{
             rgid                   = $env:WEBSITE_SITE_NAME
             SetupComplete          = $SetupComplete
@@ -77,6 +83,10 @@ function Start-CIPPStatsTimer {
             PWPush                 = $RawExt.PWPush.Enabled
             CFZTNA                 = $RawExt.CFZTNA.Enabled
             GitHub                 = $RawExt.GitHub.Enabled
+            BestPracticeAnalyser   = $FeatureFlags.BestPracticeAnalyser
+            SuperAdminNG           = $FeatureFlags.SuperAdminNG
+            CopilotAI              = $FeatureFlags.CopilotAI
+            MCPServer              = $FeatureFlags.MCPServer
         } | ConvertTo-Json
 
         try {