Skip to content

[pull] master from KelvinTegelaar:master #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pull merged 1 commit into from
Jul 24, 2026
Merged

[pull] master from KelvinTegelaar:master #54

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions AddMSPApp/datto.app.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
<ApplicationInfo xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ToolVersion="1.8.3.0">
<Name>install.ps1</Name>
<UnencryptedContentSize>693</UnencryptedContentSize>
<FileName>datto.intunewin</FileName>
<SetupFile>install.ps1</SetupFile>
<EncryptionInfo>
<EncryptionKey>jobB9Ga7J3CbO6acWJyvBRE56nFXwqGfcnGfZRMsJC4=</EncryptionKey>
<MacKey>53SOzs0l6Po2btsGFSMZgkV8vwhH+PxTN8BZDUcfWfg=</MacKey>
<InitializationVector>VjM/osrvPElbu79J+mdXuw==</InitializationVector>
<Mac>UZZXO53Np/tG6Ms+qvwLcNOeD1GRH6NRPFg/TuMz39M=</Mac>
<ProfileIdentifier>ProfileVersion1</ProfileIdentifier>
<FileDigest>KtAWAl29064LG0eyDinbDs0JUbK+EK7GsJovu8obBM4=</FileDigest>
<FileDigestAlgorithm>SHA256</FileDigestAlgorithm>
</EncryptionInfo>
<ApplicationInfo xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ToolVersion="1.8.3.0">
<Name>install.ps1</Name>
<UnencryptedContentSize>693</UnencryptedContentSize>
<FileName>datto.intunewin</FileName>
<SetupFile>install.ps1</SetupFile>
<EncryptionInfo>
<EncryptionKey>jobB9Ga7J3CbO6acWJyvBRE56nFXwqGfcnGfZRMsJC4=</EncryptionKey>
<MacKey>53SOzs0l6Po2btsGFSMZgkV8vwhH+PxTN8BZDUcfWfg=</MacKey>
<InitializationVector>VjM/osrvPElbu79J+mdXuw==</InitializationVector>
<Mac>UZZXO53Np/tG6Ms+qvwLcNOeD1GRH6NRPFg/TuMz39M=</Mac>
<ProfileIdentifier>ProfileVersion1</ProfileIdentifier>
<FileDigest>KtAWAl29064LG0eyDinbDs0JUbK+EK7GsJovu8obBM4=</FileDigest>
<FileDigestAlgorithm>SHA256</FileDigestAlgorithm>
</EncryptionInfo>
</ApplicationInfo>
5 changes: 5 additions & 0 deletions Config/CIPPDBCacheTypes.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -304,6 +304,11 @@
"friendlyName": "SharePoint & OneDrive Sharing Links",
"description": "Sharing links and external grants on SharePoint and OneDrive files and folders"
},
{
"type": "SharePointPermissions",
"friendlyName": "SharePoint Permissions",
"description": "Site and document library permission assignments, including libraries that no longer inherit and grants to tenant-wide claims such as Everyone except external users"
},
{
"type": "OfficeActivations",
"friendlyName": "Office Activations",
Expand Down
4 changes: 3 additions & 1 deletion Config/FeatureFlags.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,20 +25,22 @@
{
"Id": "SuperAdminNG",
"Name": "Super Admin",
"Description": "Additional super admin pages for CIPP instances (CIPP Users, SSO, Container management).",
"Description": "Additional super admin pages for CIPP instances (CIPP Users, SSO, Container management, Custom Domains).",
"Enabled": false,
"AllowUserToggle": false,
"Timers": [],
"Endpoints": [
"ExecCIPPUsers",
"ListCIPPUsers",
"ExecContainerManagement",
"ExecAppServiceDomains",
"ListContainerLogs",
"ListWorkerHealth"
],
"Pages": [
"/cipp/advanced/super-admin/cipp-users",
"/cipp/advanced/super-admin/container",
"/cipp/advanced/super-admin/custom-domains",
"/cipp/advanced/container-logs",
"/cipp/advanced/worker-health"
],
Expand Down
35 changes: 33 additions & 2 deletions Config/standards.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,12 @@
"name": "standards.CopilotSettings.allowWebSearch",
"options": [
{ "label": "Do not configure", "value": "donotconfigure" },
{ "label": "Enabled", "value": "1" },
{ "label": "Disabled", "value": "0" }
{ "label": "Enabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", "value": "2" },
{ "label": "Disabled in Microsoft 365 Copilot and Microsoft 365 Copilot Chat", "value": "1" },
{
"label": "Disabled in Microsoft 365 Copilot Work mode, Enabled in Microsoft 365 Copilot Chat",
"value": "0"
}
]
},
{
Expand Down Expand Up @@ -1627,6 +1631,33 @@
"recommendedBy": ["CIS", "CIPP"],
"requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"]
},
{
"name": "standards.DisableInactiveUsers",
"cat": "Entra (AAD) Standards",
"tag": ["CMMC (IA.L2-3.5.6)", "NIST SP 800-171 (3.5.6)"],
"helpText": "Blocks login for cloud-only member users that have not signed in for a configurable number of days (minimum 30). Includes accounts that have never signed in when the account is older than the threshold. Hybrid (on-premises synced) users are skipped. Users without sign-in activity data are not disabled.",
"docsDescription": "Disables enabled Member user accounts after a defined period of inactivity (minimum 30 days), supporting CMMC IA.L2-3.5.6 / NIST SP 800-171 3.5.6. Inactivity is based on signInActivity.lastSuccessfulSignInDateTime. Accounts that have never signed in (signInActivity present but no successful sign-in) are included when createdDateTime is older than the threshold. Users missing signInActivity entirely are skipped so incomplete Graph data cannot cause accidental disables. Hybrid-synced (onPremisesSyncEnabled) users are skipped because Entra disable often will not stick. Recently re-enabled accounts (last 7 days) are also skipped. Values below 30 days are rejected at runtime.",
"executiveText": "Automatically disables unused employee accounts that have not signed in for a configured number of days, reducing risk from dormant accounts and supporting CMMC / NIST inactive-identifier requirements. Hybrid directory-synced accounts are left alone so on-premises identity remains the source of truth for those users.",
"addedComponent": [
{
"type": "number",
"name": "standards.DisableInactiveUsers.days",
"required": true,
"defaultValue": 180,
"label": "Days of inactivity (minimum 30)",
"validators": {
"min": { "value": 30, "message": "Minimum value is 30" }
}
}
],
"label": "Disable Member accounts that have not logged on for a number of days",
"impact": "High Impact",
"impactColour": "danger",
"addedDate": "2026-07-22",
"powershellEquivalent": "Get-MgUser -Property SignInActivity & Update-MgUser -AccountEnabled $false",
"recommendedBy": ["CIPP", "CMMC"],
"requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"]
},
{
"name": "standards.OauthConsent",
"cat": "Entra (AAD) Standards",
Expand Down
Loading