fix: Dev to hotfix (KelvinTegelaar#2148)

Author: JohnDuprey

.github/scripts/validate-json.mjs

@@ -0,0 +1,73 @@
+import { readFile, readdir, writeFile, appendFile } from "node:fs/promises";
+import path from "node:path";
+
+// Usage: node validate-json.mjs [--strip <prefix>] <dir> [dir...]
+// --strip removes a leading path prefix from reported filenames, so a PR checked
+// out into a subdirectory still reports repo-relative paths.
+const argv = process.argv.slice(2);
+let strip = "";
+const roots = [];
+for (let i = 0; i < argv.length; i++) {
+  if (argv[i] === "--strip") {
+    strip = argv[++i] ?? "";
+  } else {
+    roots.push(argv[i]);
+  }
+}
+
+async function collect(dir) {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  const files = [];
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === "node_modules") continue;
+      files.push(...(await collect(full)));
+    } else if (entry.name.endsWith(".json")) {
+      files.push(full);
+    }
+  }
+  return files;
+}
+
+const report = (file) => {
+  const normalised = file.split(path.sep).join("/");
+  return strip && normalised.startsWith(strip) ? normalised.slice(strip.length) : normalised;
+};
+
+const failures = [];
+let checked = 0;
+
+for (const root of roots) {
+  for (const file of await collect(root)) {
+    checked++;
+    // Strip a leading UTF-8 BOM: it's tolerated by PowerShell's ConvertFrom-Json
+    // (how the API loads these files) but rejected by Node's JSON.parse.
+    const contents = (await readFile(file, "utf8")).replace(/^\uFEFF/, "");
+    try {
+      JSON.parse(contents);
+    } catch (error) {
+      failures.push({ file: report(file), message: error.message.replace(/\r?\n/g, " ") });
+    }
+  }
+}
+
+for (const { file, message } of failures) {
+  // Annotate the PR diff via a GitHub Actions error command.
+  console.log(`::error file=${file}::${message}`);
+}
+console.log(`Checked ${checked} JSON file(s), ${failures.length} invalid.`);
+
+// Hand the results to the workflow so it can comment on the PR.
+if (process.env.GITHUB_OUTPUT) {
+  await appendFile(process.env.GITHUB_OUTPUT, `invalid_count=${failures.length}\n`);
+}
+await writeFile("json-validation-results.json", JSON.stringify(failures, null, 2));
+
+process.exit(failures.length > 0 ? 1 : 0);

.github/workflows/Validate_JSON.yml

@@ -0,0 +1,121 @@
+---
+name: Validate JSON
+on:
+  # pull_request_target (not pull_request) so the token can comment on fork PRs.
+  # The PR's own code is never executed: it is checked out into ./pr as data only,
+  # and parsed by the validator script from the trusted base checkout.
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+      - dev
+    paths:
+      - "Config/**/*.json"
+      - "Tools/**/*.json"
+      - "AddMSPApp/**/*.json"
+      - ".github/workflows/Validate_JSON.yml"
+      - ".github/scripts/validate-json.mjs"
+  push:
+    branches:
+      - dev
+    paths:
+      - "Config/**/*.json"
+      - "Tools/**/*.json"
+      - "AddMSPApp/**/*.json"
+      - ".github/workflows/Validate_JSON.yml"
+      - ".github/scripts/validate-json.mjs"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  validate:
+    name: Parse JSON in Config, Tools and AddMSPApp
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout base (trusted validator script)
+        uses: actions/checkout@v6
+
+      - name: Checkout PR head (untrusted, data only)
+        if: github.event_name == 'pull_request_target'
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: pr
+          persist-credentials: false
+
+      - name: Validate JSON files
+        id: validate
+        continue-on-error: true
+        env:
+          ROOT: ${{ github.event_name == 'pull_request_target' && 'pr/' || '' }}
+        run: >-
+          node .github/scripts/validate-json.mjs --strip "$ROOT"
+          "${ROOT}Config" "${ROOT}Tools" "${ROOT}AddMSPApp"
+
+      - name: Comment on PR
+        if: github.event_name == 'pull_request_target'
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            const marker = '<!-- validate-json -->';
+            const resultsFile = 'json-validation-results.json';
+            if (!fs.existsSync(resultsFile)) {
+              // The validator crashed before reporting; let its own error stand.
+              core.warning('No validation results found — skipping PR comment.');
+              return;
+            }
+            const failures = JSON.parse(fs.readFileSync(resultsFile, 'utf8'));
+
+            // Find a previous comment from this workflow so we update instead of piling up.
+            const { data: comments } = await github.rest.issues.listComments({
+              ...context.repo,
+              issue_number: context.issue.number,
+              per_page: 100,
+            });
+            const existing = comments.find(
+              (c) => c.user.type === 'Bot' && c.body.includes(marker)
+            );
+
+            let body;
+            if (failures.length > 0) {
+              const list = failures
+                .map(({ file, message }) => `- \`${file}\`\n  > ${message}`)
+                .join('\n');
+              body =
+                `${marker}\n### ⚠️ Invalid JSON detected\n\n` +
+                `${failures.length} JSON file(s) in this PR could not be parsed. ` +
+                `These files are loaded directly by CIPP, so a syntax error here breaks the app at runtime.\n\n` +
+                `${list}\n\n` +
+                `Please fix the syntax and push again — this comment will update automatically.`;
+            } else if (existing) {
+              body = `${marker}\n### ✅ JSON is valid\n\nAll JSON files in \`Config\`, \`Tools\` and \`AddMSPApp\` parse correctly. Thanks for fixing it!`;
+            } else {
+              // Nothing was ever broken — stay quiet.
+              return;
+            }
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                ...context.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - name: Fail if any JSON is invalid
+        if: steps.validate.outputs.invalid_count != '0'
+        run: |
+          echo "::error::${{ steps.validate.outputs.invalid_count }} invalid JSON file(s). See annotations above."
+          exit 1

Config/CIPPDBCacheTypes.json

@@ -294,6 +294,11 @@
     "friendlyName": "SharePoint Site Usage",
     "description": "SharePoint site usage statistics"
   },
+  {
+    "type": "SiteActivity",
+    "friendlyName": "Site Activity",
+    "description": "Per-site activity with siteType classification (SharePoint, SharePointAndTeams, OneDrive) and separate workload activity columns"
+  },
   {
     "type": "SharePointSharingLinks",
     "friendlyName": "SharePoint & OneDrive Sharing Links",

Config/standards.json

@@ -1459,10 +1459,23 @@
     "cat": "Entra (AAD) Standards",
     "tag": ["CISA (MS.AAD.21.1v1)", "SMB1001 (2.8)"],
     "appliesToTest": ["SMB1001_2_8", "ZTNA21868"],
-    "helpText": "Restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc",
-    "docsDescription": "Users by default are allowed to create M365 groups. This restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc",
-    "executiveText": "Restricts the creation of Microsoft 365 groups, Teams, and SharePoint sites to authorized administrators, preventing uncontrolled proliferation of collaboration spaces. This ensures proper governance, naming conventions, and resource management while maintaining oversight of all collaborative environments.",
-    "addedComponent": [],
+    "helpText": "Restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc. Optionally allows members of a specific security group to keep creating groups (GroupCreationAllowedGroupId).",
+    "docsDescription": "Users by default are allowed to create M365 groups. This restricts M365 group creation to certain admin roles. This disables the ability to create Teams, SharePoint sites, Planner, etc. Optionally, a security group can be named whose members remain allowed to create groups; the group is resolved by display name in each tenant and can be created automatically when it does not exist. When no group is named, the existing GroupCreationAllowedGroupId value in the tenant is left untouched.",
+    "executiveText": "Restricts the creation of Microsoft 365 groups, Teams, and SharePoint sites to authorized administrators, preventing uncontrolled proliferation of collaboration spaces. This ensures proper governance, naming conventions, and resource management while maintaining oversight of all collaborative environments. An approved group of designated users can optionally retain the ability to create groups.",
+    "addedComponent": [
+      {
+        "type": "textField",
+        "name": "standards.DisableM365GroupUsers.AllowedGroupName",
+        "label": "Optional: name of the group whose members may still create M365 groups",
+        "required": false
+      },
+      {
+        "type": "switch",
+        "name": "standards.DisableM365GroupUsers.CreateGroup",
+        "label": "Create the allowed group if it does not exist",
+        "required": false
+      }
+    ],
     "label": "Disable M365 Group creation by users",
     "impact": "Low Impact",
     "impactColour": "info",
@@ -3219,6 +3232,21 @@
     "powershellEquivalent": "Get-Mailbox & Update-MgUser",
     "recommendedBy": ["CIS", "CIPP"]
   },
+  {
+    "name": "standards.TeamsDisableResourceAccounts",
+    "cat": "Teams Standards",
+    "tag": ["NIST CSF 2.0 (PR.AA-01)"],
+    "helpText": "Blocks sign-in for all Teams resource accounts used by Auto Attendants and Call Queues. Microsoft's guidance is to block sign-in for resource accounts as they do not require an interactive login to function.",
+    "docsDescription": "Teams resource accounts (the accounts backing Auto Attendants and Call Queues) do not require interactive sign-in to function. If sign-in is enabled and the password is reset, the account can be logged into directly, which presents a security risk. Microsoft's guidance is to block sign-in for these accounts. Accounts that are synced from on-premises AD are excluded, as account state is managed in the on-premises AD.",
+    "executiveText": "Prevents direct login to the service accounts that power phone system features like Auto Attendants and Call Queues. These accounts work without anyone signing into them, so blocking sign-in removes an unnecessary attack surface while keeping the phone system fully functional.",
+    "addedComponent": [],
+    "label": "Block sign-in for Teams resource accounts",
+    "impact": "Medium Impact",
+    "impactColour": "warning",
+    "addedDate": "2026-07-17",
+    "powershellEquivalent": "Get-CsOnlineApplicationInstance & Update-MgUser",
+    "recommendedBy": ["Microsoft", "CIPP"]
+  },
   {
     "name": "standards.DisableResourceMailbox",
     "cat": "Exchange Standards",

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecSharePointTemplateDeploy.ps1

@@ -0,0 +1,57 @@
+function Push-ExecSharePointTemplateDeploy {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .DESCRIPTION
+        Queue worker that deploys a SharePoint provisioning template to a single tenant.
+        Queued per tenant by Invoke-ExecSharePointTemplate (Action=Deploy). Progress is
+        written to the shared CacheAsyncDeployments status rows so the frontend can poll
+        it live via Action=DeployStatus.
+    #>
+    param($Item)
+
+    try {
+        $Item = $Item | ConvertTo-Json -Depth 10 | ConvertFrom-Json
+        $TemplateId = $Item.TemplateId
+        $DeploymentId = $Item.DeploymentId
+        if (-not $TemplateId) {
+            Write-LogMessage -message 'No SharePoint template specified' -tenant $Item.Tenant -API 'Deploy SharePoint Template' -sev Error
+            return $false
+        }
+
+        $Table = Get-CIPPTable -TableName 'templates'
+        $Template = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'SharePointTemplate' and RowKey eq '$TemplateId'"
+        if (-not $Template) {
+            Write-LogMessage -message "SharePoint template $TemplateId not found" -tenant $Item.Tenant -API 'Deploy SharePoint Template' -sev Error
+            if ($DeploymentId) {
+                Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $Item.Tenant -Status 'failed' -Logs "Template $TemplateId not found"
+            }
+            return $false
+        }
+
+        if ($DeploymentId) {
+            Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $Item.Tenant -Status 'running'
+        }
+
+        $TemplateData = $Template.JSON | ConvertFrom-Json
+        $Results = Invoke-CIPPSharePointTemplateDeploy -TemplateData $TemplateData -SiteOwner $Item.SiteOwner -TenantFilter $Item.Tenant -DeploymentId $DeploymentId
+        foreach ($Result in $Results) {
+            Write-Information $Result
+        }
+
+        # Overall verdict: failed when any step failed, otherwise succeeded.
+        if ($DeploymentId) {
+            $Row = Get-CIPPAsyncDeployment -JobId $DeploymentId | Where-Object { $_.Name -eq $Item.Tenant }
+            $FinalStatus = 'succeeded'
+            if (@($Row.Steps | Where-Object { $_.Status -eq 'failed' }).Count -gt 0) { $FinalStatus = 'failed' }
+            Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $Item.Tenant -Status $FinalStatus -Logs ($Results -join "`n")
+        }
+        return $true
+    } catch {
+        Write-LogMessage -message "Error deploying SharePoint template to tenant $($Item.Tenant) - $($_.Exception.Message)" -tenant $Item.Tenant -API 'Deploy SharePoint Template' -sev Error
+        if ($Item.DeploymentId) {
+            Set-CIPPAsyncDeploymentStatus -JobId $Item.DeploymentId -Name $Item.Tenant -Status 'failed' -Logs $_.Exception.Message
+        }
+        Write-Error $_.Exception.Message
+    }
+}

Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveLicensedUsers.ps1

@@ -47,6 +47,13 @@ function Get-CIPPAlertInactiveLicensedUsers {
             $GraphRequest = New-GraphGetRequest -uri $Uri -scope 'https://graph.microsoft.com/.default' -tenantid $TenantFilter |
                 Where-Object { $null -ne $_.assignedLicenses -and $_.assignedLicenses.Count -gt 0 }
 
+            $LicenseOverview = @()
+            try {
+                $LicenseOverview = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'LicenseOverview')
+            } catch {
+                Write-Information "Could not get the license overview from the reporting DB, license names will fall back to SKU IDs: $($_.Exception.Message)"
+            }
+
             $AlertData = foreach ($user in $GraphRequest) {
                 $lastInteractive = $user.signInActivity.lastSignInDateTime
                 $lastNonInteractive = $user.signInActivity.lastNonInteractiveSignInDateTime
@@ -67,19 +74,28 @@ function Get-CIPPAlertInactiveLicensedUsers {
                 if (-not $IncludeNeverSignedIn -and -not $lastSignIn) { continue }
                 # Only process inactive users
                 if ($isInactive) {
+                    $daysSinceSignIn = $null
                     if (-not $lastSignIn) {
                         $Message = 'User {0} has never signed in but still has a license assigned.' -f $user.UserPrincipalName
                     } else {
                         $daysSinceSignIn = [Math]::Round(((Get-Date) - [DateTime]$lastSignIn).TotalDays)
                         $Message = 'User {0} has been inactive for {1} days but still has a license assigned. Last sign-in: {2}' -f $user.UserPrincipalName, $daysSinceSignIn, $lastSignIn
                     }
+                    $LicenseNames = foreach ($SkuId in $user.assignedLicenses.skuId) {
+                        $Sku = $LicenseOverview | Where-Object { $_.skuId -eq $SkuId } | Select-Object -First 1
+                        if ($Sku.License) { $Sku.License } else { $SkuId }
+                    }
 
                     [PSCustomObject]@{
-                        UserPrincipalName = $user.UserPrincipalName
-                        Id                = $user.id
-                        lastSignIn        = $lastSignIn
-                        Message           = $Message
-                        Tenant            = $TenantFilter
+                        UserPrincipalName   = $user.UserPrincipalName
+                        Id                  = $user.id
+                        lastSignIn          = $lastSignIn
+                        DaysSinceLastSignIn = if ($null -ne $daysSinceSignIn) { $daysSinceSignIn } else { 'N/A' }
+                        AccountEnabled      = $user.accountEnabled
+                        LicenseNames        = $LicenseNames -join ', '
+                        SkuIds              = @($user.assignedLicenses.skuId) -join ', '
+                        Message             = $Message
+                        Tenant              = $TenantFilter
                     }
                 }
             }