Skip to content

Commit de596a0

Browse files
pull[bot]pull[bot]
authored
Merge pull request #81 from KelvinTegelaar/master
[pull] master from KelvinTegelaar:master
2 parents 078f336 + edd3481 commit de596a0

48 files changed

Lines changed: 2577 additions & 133 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎AddMSPApp/datto.app.xml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
1-
<ApplicationInfo xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ToolVersion="1.8.3.0">
2-
<Name>install.ps1</Name>
3-
<UnencryptedContentSize>693</UnencryptedContentSize>
4-
<FileName>datto.intunewin</FileName>
5-
<SetupFile>install.ps1</SetupFile>
6-
<EncryptionInfo>
7-
<EncryptionKey>jobB9Ga7J3CbO6acWJyvBRE56nFXwqGfcnGfZRMsJC4=</EncryptionKey>
8-
<MacKey>53SOzs0l6Po2btsGFSMZgkV8vwhH+PxTN8BZDUcfWfg=</MacKey>
9-
<InitializationVector>VjM/osrvPElbu79J+mdXuw==</InitializationVector>
10-
<Mac>UZZXO53Np/tG6Ms+qvwLcNOeD1GRH6NRPFg/TuMz39M=</Mac>
11-
<ProfileIdentifier>ProfileVersion1</ProfileIdentifier>
12-
<FileDigest>KtAWAl29064LG0eyDinbDs0JUbK+EK7GsJovu8obBM4=</FileDigest>
13-
<FileDigestAlgorithm>SHA256</FileDigestAlgorithm>
14-
</EncryptionInfo>
1+
<ApplicationInfo xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ToolVersion="1.8.3.0">
2+
<Name>install.ps1</Name>
3+
<UnencryptedContentSize>693</UnencryptedContentSize>
4+
<FileName>datto.intunewin</FileName>
5+
<SetupFile>install.ps1</SetupFile>
6+
<EncryptionInfo>
7+
<EncryptionKey>jobB9Ga7J3CbO6acWJyvBRE56nFXwqGfcnGfZRMsJC4=</EncryptionKey>
8+
<MacKey>53SOzs0l6Po2btsGFSMZgkV8vwhH+PxTN8BZDUcfWfg=</MacKey>
9+
<InitializationVector>VjM/osrvPElbu79J+mdXuw==</InitializationVector>
10+
<Mac>UZZXO53Np/tG6Ms+qvwLcNOeD1GRH6NRPFg/TuMz39M=</Mac>
11+
<ProfileIdentifier>ProfileVersion1</ProfileIdentifier>
12+
<FileDigest>KtAWAl29064LG0eyDinbDs0JUbK+EK7GsJovu8obBM4=</FileDigest>
13+
<FileDigestAlgorithm>SHA256</FileDigestAlgorithm>
14+
</EncryptionInfo>
1515
</ApplicationInfo>

‎Config/CIPPDBCacheTypes.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -304,6 +304,11 @@
304304
"friendlyName": "SharePoint & OneDrive Sharing Links",
305305
"description": "Sharing links and external grants on SharePoint and OneDrive files and folders"
306306
},
307+
{
308+
"type": "SharePointPermissions",
309+
"friendlyName": "SharePoint Permissions",
310+
"description": "Site and document library permission assignments, including libraries that no longer inherit and grants to tenant-wide claims such as Everyone except external users"
311+
},
307312
{
308313
"type": "OfficeActivations",
309314
"friendlyName": "Office Activations",

‎Config/FeatureFlags.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,20 +25,22 @@
2525
{
2626
"Id": "SuperAdminNG",
2727
"Name": "Super Admin",
28-
"Description": "Additional super admin pages for CIPP instances (CIPP Users, SSO, Container management).",
28+
"Description": "Additional super admin pages for CIPP instances (CIPP Users, SSO, Container management, Custom Domains).",
2929
"Enabled": false,
3030
"AllowUserToggle": false,
3131
"Timers": [],
3232
"Endpoints": [
3333
"ExecCIPPUsers",
3434
"ListCIPPUsers",
3535
"ExecContainerManagement",
36+
"ExecAppServiceDomains",
3637
"ListContainerLogs",
3738
"ListWorkerHealth"
3839
],
3940
"Pages": [
4041
"/cipp/advanced/super-admin/cipp-users",
4142
"/cipp/advanced/super-admin/container",
43+
"/cipp/advanced/super-admin/custom-domains",
4244
"/cipp/advanced/container-logs",
4345
"/cipp/advanced/worker-health"
4446
],

‎Config/standards.json‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,12 @@
5151
"name": "standards.CopilotSettings.allowWebSearch",
5252
"options": [
5353
{ "label": "Do not configure", "value": "donotconfigure" },
54-
{ "label": "Enabled", "value": "1" },
55-
{ "label": "Disabled", "value": "0" }
54+
{ "label": "Enabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", "value": "2" },
55+
{ "label": "Disabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", "value": "1" },
56+
{
57+
"label": "Disabled in Microsoft 365 Copilot Work mode, Enabled in Microsoft 365 Copilot Chat",
58+
"value": "0"
59+
}
5660
]
5761
},
5862
{
@@ -1627,6 +1631,33 @@
16271631
"recommendedBy": ["CIS", "CIPP"],
16281632
"requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"]
16291633
},
1634+
{
1635+
"name": "standards.DisableInactiveUsers",
1636+
"cat": "Entra (AAD) Standards",
1637+
"tag": ["CMMC (IA.L2-3.5.6)", "NIST SP 800-171 (3.5.6)"],
1638+
"helpText": "Blocks login for cloud-only member users that have not signed in for a configurable number of days (minimum 30). Includes accounts that have never signed in when the account is older than the threshold. Hybrid (on-premises synced) users are skipped. Users without sign-in activity data are not disabled.",
1639+
"docsDescription": "Disables enabled Member user accounts after a defined period of inactivity (minimum 30 days), supporting CMMC IA.L2-3.5.6 / NIST SP 800-171 3.5.6. Inactivity is based on signInActivity.lastSuccessfulSignInDateTime. Accounts that have never signed in (signInActivity present but no successful sign-in) are included when createdDateTime is older than the threshold. Users missing signInActivity entirely are skipped so incomplete Graph data cannot cause accidental disables. Hybrid-synced (onPremisesSyncEnabled) users are skipped because Entra disable often will not stick. Recently re-enabled accounts (last 7 days) are also skipped. Values below 30 days are rejected at runtime.",
1640+
"executiveText": "Automatically disables unused employee accounts that have not signed in for a configured number of days, reducing risk from dormant accounts and supporting CMMC / NIST inactive-identifier requirements. Hybrid directory-synced accounts are left alone so on-premises identity remains the source of truth for those users.",
1641+
"addedComponent": [
1642+
{
1643+
"type": "number",
1644+
"name": "standards.DisableInactiveUsers.days",
1645+
"required": true,
1646+
"defaultValue": 180,
1647+
"label": "Days of inactivity (minimum 30)",
1648+
"validators": {
1649+
"min": { "value": 30, "message": "Minimum value is 30" }
1650+
}
1651+
}
1652+
],
1653+
"label": "Disable Member accounts that have not logged on for a number of days",
1654+
"impact": "High Impact",
1655+
"impactColour": "danger",
1656+
"addedDate": "2026-07-22",
1657+
"powershellEquivalent": "Get-MgUser -Property SignInActivity & Update-MgUser -AccountEnabled $false",
1658+
"recommendedBy": ["CIPP", "CMMC"],
1659+
"requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"]
1660+
},
16301661
{
16311662
"name": "standards.OauthConsent",
16321663
"cat": "Entra (AAD) Standards",

0 commit comments

Comments
 (0)