[pull] main from KelvinTegelaar:main by pull[bot] · Pull Request #7 · orangehand/CIPP

pull · 2026-06-18T17:43:31Z

See Commits and Changes for more details.

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

…dev/tanstack/react-query-5.101.2 chore(deps): bump @tanstack/react-query from 5.101.0 to 5.101.2

…dev/eslint-config-next-16.2.10 chore(deps-dev): bump eslint-config-next from 16.2.3 to 16.2.10

…s/dev/LanceMcCarthy/Action-AzureBlobUpload-3.15.0 chore(deps): bump LanceMcCarthy/Action-AzureBlobUpload from 3.12.0 to 3.15.0

…dev/react-redux-9.3.0 chore(deps): bump react-redux from 9.2.0 to 9.3.0

…dev/react-apexcharts-2.1.1 chore(deps): bump react-apexcharts from 2.1.0 to 2.1.1

…dev/tiptap/pm-3.27.1 chore(deps): bump @tiptap/pm from 3.22.3 to 3.27.1

[pull] dev from KelvinTegelaar:dev

The BEC page and PDF report only showed inbox rules that still exist, so rules an attacker created, used and deleted were invisible. The backend now returns InboxRuleChanges (7-day audit log rule events) and a RecentlyChanged flag on surviving rules; display both, sort recently changed rules first, and count rule changes toward the report threat score.

feat: new workflows

…resets Add audit log alert presets: external mailbox forwarding & Exchange admin elevation

[pull] dev from KelvinTegelaar:dev

…s catalog JIT Admin assigns Entra directory roles directly to a user (directoryRoles member add via roleTemplateId), which is independent of GDAP delegation. Sharing GDAPRoles.json coupled two different role sets. Add src/data/JitAdminRoles.json (assignable directory-role templates, excluding the non-assignable/deprecated Device Join, Device Users, Workplace Device Join and Directory Synchronization Accounts) and point the three JIT pages at it.

…ip Administrator This role is customer-side (accept/view/terminate GDAP relationships with partners) and cannot be delegated to a partner via GDAP, so it must not be offered in the GDAP role picker (which is served from GDAPRoles.json). It remains available for JIT admin via JitAdminRoles.json - a concrete example of why the two role lists are decoupled.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Add the backup administrator roles that are assignable directly at tenant level and are a real MSP JIT need but were missing from the catalog: Microsoft 365 Backup Administrator, SharePoint Backup Administrator, Exchange Backup Administrator, Entra Backup Administrator and Entra Backup Reader. Purview Workload Content roles are intentionally NOT added: Microsoft advises against assigning those Entra roles directly (they are synced from Purview role groups).

The JIT list inherited legacy/GDAP-framework role labels from the shared GDAPRoles.json catalog. Align the display names (and descriptions) with the current Microsoft Entra built-in role names (same roleTemplateId / ObjectId): - Company Administrator -> Global Administrator - Azure AD Joined Device Local Administrator -> Microsoft Entra Joined Device Local Administrator - Power BI Administrator -> Fabric Administrator - Customer LockBox Access Approver -> Customer Lockbox Access Approver Only labels change; the ObjectId (roleTemplateId) is unchanged, so existing JIT templates are unaffected.

fix: dev to hotfix Synced from CyberDrain/CIPP@037779e

Updated Node.js and jsdom versions in package.json. Signed-off-by: John Duprey <john@cyberdrain.com>

fix: Dev to hotfix Synced from CyberDrain/CIPP@c64f881