[pull] dev from KelvinTegelaar:dev - #108

Fix: Move queryKey placement in SignInLogsDialog component

Synced from CyberDrain/CIPP@d4827a7

Synced from CyberDrain/CIPP@f079294

Adds a full SharePoint Permissions report with cached data collection, PDF export, and oversharing signal detection (tenant-wide grants, external grants, direct Full Control, detached libraries).

Key additions:
- Backend: SharePointPermissions cache type, batched site collection via activity triggers, REST API endpoints for listing/setting/removing library permissions, role definitions, site user access, and multi-queue status
- Frontend: Permissions Report page with charts and filters, Library Permissions dialog (add/change/remove/inheritance control), Check User Access dialog, multi-queue progress tracker, query refresh button, reusable PDF primitives
- Sharing report enhancements: sprawl signals (anonymous editable links, never-expiring links, folder shares, external recipients), top libraries/recipients charts, PDF export, queue progress tracking

Synced from CyberDrain/CIPP@a2156f3

fix: side-nav scroll desync

Synced from CyberDrain/CIPP@bb1804f

Synced from CyberDrain/CIPP@f5833a7

Synced from CyberDrain/CIPP@ec4ff81

Synced from CyberDrain/CIPP@0cdc800

Synced from CyberDrain/CIPP@0c7774f

- Updated backend logic to handle TemplateId more robustly, ensuring proper GUID generation and existing template retrieval.
- Improved frontend logic to differentiate between edit and copy modes, ensuring accurate template data fetching and form hydration.
- Adjusted API calls to prevent stale data from being displayed during template editing and copying.

Synced from CyberDrain/CIPP@793915b

- Updated backend to require a single tenant for template deployment, enhancing clarity and reducing complexity.
- Adjusted frontend to reflect the change from multiple tenant selection to a single tenant context, ensuring the Site/Team Owner picker is appropriately scoped.
- Improved logging and messaging to accurately represent the deployment status for the selected tenant.

Synced from CyberDrain/CIPP@0aa759a

…ation

- Enhanced backend logic to determine the SharePoint template type (Team or Communication) based on the provided site template data, defaulting to Team for older templates.
- Updated frontend to include a SharePoint template selection dialog, allowing users to choose between Team and Communication site templates during site creation.
- Introduced constants for SharePoint template options and integrated them into the site template card for better user experience.

Synced from CyberDrain/CIPP@711e461

Synced from CyberDrain/CIPP@2ac7c35

…template handling

- Added a 'templateEngineVersion' property to the SharePoint template object in the backend to ensure compatibility with the API.
- Stamped the current provisioning engine version in the frontend, allowing for better tracking of template versions during save operations.
- Updated the template initialization and submission logic to include the engine version, enhancing consistency across the application.

Synced from CyberDrain/CIPP@24e59ee

Synced from CyberDrain/CIPP@ef9d232

Synced from CyberDrain/CIPP@d3ac922

Synced from CyberDrain/CIPP@bd6b53f

Shift Teams voice/resource-account flows from MicrosoftTeams cmdlets to Graph-based endpoints and ConfigAPI paths via `New-TeamsRequestV2`, including number-type normalization and LIS location shape mapping. Remove the bundled MicrosoftTeams module from Docker images and delete the legacy `New-TeamsRequest` helper.

Add token-cache invalidation support (`Clear-CippTokenCache`, CIPPSharp tenant/global cache clear methods) and invoke it after consent/permission updates so new scopes apply immediately. Also add `TeamsUserConfiguration.Read.All` delegated/app IDs to permissions and SAM manifests.

Synced from CyberDrain/CIPP@39d8a4e

Update tenant onboarding and access validation to treat direct tenants separately from GDAP tenants. The backend now records direct-tenant service account metadata, blocks in-place GDAP→Direct conversion, cleans up stored direct refresh tokens when conversion is refused, and evaluates direct-tenant permissions from the authenticated service account (including Global Admin handling). Frontend settings pages were updated to show tenant type/service-account details, use AssignedRoles (with backward compatibility for GDAPRoles), hide GDAP-only actions where not applicable, and add a direct-tenant re-auth flow via wizard deep links. Adds Pester coverage for direct-token cleanup and the new direct-vs-GDAP access-check behavior.

Synced from CyberDrain/CIPP@b231564

Normalize vacation exclusion group naming to avoid Graph lookup/create issues when policy display names are long: cap at 120 chars, append an 8-char policy ID suffix when truncated, and reuse that computed name consistently for filtering and CA exclusion updates. Also update the wizard info text to document the new truncation-and-suffix behavior.

Synced from CyberDrain/CIPP@7a37d19

Add a reusable policy diff table and a new compare dialog used from Drift and Applied Standards to compare Intune template standards against live tenant policy state. Extend ExecCompareIntunePolicy with template-prepared resolution, tenantPolicyByTemplate lookup, fuzzy-name matching aligned to standard settings, and explicit missing-policy responses. Also extract Intune template type inference into a shared CIPPCore helper and reuse it in the IntuneTemplate standard.

Synced from CyberDrain/CIPP@2c9020b

Improve SharePoint admin link handling across backend and frontend. The API now requires `TenantFilter`, resolves and persists a valid admin URL, logs and returns clearer errors when resolution fails, and includes the URL in redirect responses. Tenant listing and portal UI now prefer the cached `SharepointAdminUrl` field (with fallback to the resolver endpoint), so portal links behave like other direct admin links after first resolution.

Synced from CyberDrain/CIPP@81a896f

Synced from CyberDrain/CIPP@96cbd11

Synced from CyberDrain/CIPP@8f5c2e2

Synced from CyberDrain/CIPP@3a6833e

Add `hideBulk: true` to the SharePoint page action config so this operation is only available for single-item runs, matching its non-bulk behavior.

Synced from CyberDrain/CIPP@b364eb2

Synced from CyberDrain/CIPP@cea42df

Synced from CyberDrain/CIPP@163e4c0

Synced from CyberDrain/CIPP@c1606bd

Synced from CyberDrain/CIPP@ca89185

Synced from CyberDrain/CIPP@e7010ce

Synced from CyberDrain/CIPP@078d671

Synced from CyberDrain/CIPP@bdf3b56

Synced from CyberDrain/CIPP@ab6d803

Adds /api/ListGuestUsers classifying guests as Active, Stale, Pending
Acceptance, Never Signed In or Disabled from Graph beta sign-in
activity, falling back to invitation-state-only statuses on tenants
without Entra ID P1. New guest-users page with clickable summary count
cards that filter the table, status filter presets, and a re-invite row
action reusing /api/AddGuest for pending or stale guests.

Synced from CyberDrain/CIPP@25dea1b

Adjust single-select default resolution in `CippAutocomplete` to handle duplicate option values safely. The component now only auto-resolves by `value` when there is exactly one match; when multiple options share the same value, it additionally requires a `label` match and otherwise keeps the stored form value to avoid incorrect remapping after option refreshes.

Synced from CyberDrain/CIPP@4887e6b

Synced from CyberDrain/CIPP@938c018

Synced from CyberDrain/CIPP@7ba43cd

Feat: Add Purview Message Encryption tools and configuration standard

Synced from CyberDrain/CIPP@547f533

The guest users page now reads cached data from the reporting database
by default, with a toggle back to live Graph and a sync action. The
Guests cache keeps the full beta property set and sponsors, and now
merges in signInActivity where the tenant is licensed for it, stamping
each row with signInLogsCapable so readers can tell a guest who never
signed in apart from a tenant without sign-in data. ListGuestUsers
gains a UseReportDB branch via Get-CIPPGuestUsersReport, AllTenants
support through the cache, and a sponsors column.

Synced from CyberDrain/CIPP@0831a04

Synced from CyberDrain/CIPP@0ca554a

Synced from CyberDrain/CIPP@0d164a8

Adds a 'Record Actions' mode to the support bundle dialog that lets users close the dialog, reproduce an issue, and return to stop recording. A persistent chip indicator is shown while recording is active. Also captures request bodies in the network recording and renames internal serialization fields for clarity.

Synced from CyberDrain/CIPP@a4cea97

Synced from CyberDrain/CIPP@661a9c5

Synced from CyberDrain/CIPP@067ed77

…eporting DB

Snapshot the Domain Analyser results already computed into the Domains
table into CippReportingDB as type DomainAnalyser during the Graph cache
collection, so custom tests and reports can read DNS hygiene, email
authentication state and domain health scores through Get-CIPPTestData
without needing network access from the test sandbox.

Rows are keyed by domain so nightly reruns upsert in place, and a tenant
the analyser has not run for is skipped rather than recorded as an
authoritative empty set.

Move the Domain Analyser timer from 05:30 to 01:30 so it completes ahead
of the 03:00 DB cache run and the 04:00 test run, matching the pattern
the Intune report-export timer already uses.

Closes #235

Synced from CyberDrain/CIPP@3f3247f

Synced from CyberDrain/CIPP@23fbd34

…the sharing-links scan

A NoAccess-locked site (typically an offboarded user's OneDrive) blocks
all content access including sharing-link redemption, so its links are
dead while the lock stands. The scan previously completed such sites as
failed, which protected their cached rows every cycle and logged a
warning per site per scan. A locked site now completes un-failed
without scanning, letting finalisation prune its inactive links; an
unlock later triggers a fresh full scan that re-adds them. Locks
appearing mid-scan get the same treatment at the drive level.

Synced from CyberDrain/CIPP@94b9e73

feat(halo): add configurable ticket request source

Synced from CyberDrain/CIPP@62ca847

Fix(mobile): layout fix 900-1200 viewport, mobile side nav scroll fixes

Synced from CyberDrain/CIPP@ac32924

…0819

Synced from CyberDrain/CIPP@0d7b4c9

Synced from CyberDrain/CIPP@6b53d10

Synced from CyberDrain/CIPP@0dd8f77

…0820

Synced from CyberDrain/CIPP@d23afd8

- Improved `Invoke-EditGroup` function to better handle owner additions and removals with enhanced identity resolution.
- Updated `CippApiDialog` to integrate CSV field handling and nested value resolution.
- Introduced `CippDataTableButton` and `CippTableCardButton` components for improved action handling in data tables.
- Added sub-table functionality in `CippDataTable` for displaying members and owners with dynamic API integration.
- Refactored `CIPPTableToptoolbar` to support parent row attachment for bulk actions.

These changes enhance the usability and functionality of group management and data display within the CIPP module.

Synced from CyberDrain/CIPP@791c697

Feat: Quarantine overhaul with enhanced message details and actions

Synced from CyberDrain/CIPP@23ff8d1

Synced from CyberDrain/CIPP@d47978d

Synced from CyberDrain/CIPP@3ba5d04

Synced from CyberDrain/CIPP@f2394a9