groups

Author: KelvinTegelaar

Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1

@@ -35,14 +35,23 @@ function Push-CIPPDBCacheData {
         # Build grouped collection tasks — one activity per license category instead of one per cache type
         $Tasks = [System.Collections.Generic.List[object]]::new()
 
-        # Graph collection always runs (no special license needed) — 26 cache types in one activity
+        # Graph collection always runs (no special license needed) — 25 cache types in one activity
         $Tasks.Add(@{
                 FunctionName   = 'ExecCIPPDBCache'
                 CollectionType = 'Graph'
                 TenantFilter   = $TenantFilter
                 QueueId        = $QueueId
                 QueueName      = "DB Cache Graph - $TenantFilter"
             })
+        # MFAState runs as its own activity — it makes 6+ API calls, bulk group/role member
+        # resolution, and O(users × policies) CPU work that can take minutes on large tenants
+        $Tasks.Add(@{
+                FunctionName = 'ExecCIPPDBCache'
+                Name         = 'MFAState'
+                TenantFilter = $TenantFilter
+                QueueId      = $QueueId
+                QueueName    = "DB Cache MFAState - $TenantFilter"
+            })
 
         # Exchange collections — split into config (quick policy calls), data (usage reports), and mailboxes (heavy, spawns permission/rule child orchestrators)
         if ($ExchangeCapable) {

Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1

@@ -67,7 +67,6 @@ function Invoke-CIPPDBCacheCollection {
             'OAuth2PermissionGrants'
             'AppRoleAssignments'
             'LicenseOverview'
-            'MFAState'
             'BitlockerKeys'
         )
         ExchangeConfig     = @(