[pull] master from KelvinTegelaar:master

Modules/CIPPCore/Public/Get-CIPPDrift.ps1

@@ -429,6 +429,10 @@ function Get-CIPPDrift {
                 # unmanagedSync standard). They are system-managed, cannot be templated and come
                 # back when deleted, so they are never a deviation.
                 if (([string]$TenantCAPolicy.displayName).StartsWith('[SharePoint admin center]')) { continue }
+                # Microsoft-managed CA policies cannot be deleted, only disabled. Once turned off
+                # they are not actionable, so a disabled Microsoft-managed policy is never a
+                # deviation. Enabled or report-only ones still are.
+                if (([string]$TenantCAPolicy.displayName).StartsWith('Microsoft-managed', [System.StringComparison]::OrdinalIgnoreCase) -and $TenantCAPolicy.state -eq 'disabled') { continue }
                 $PolicyFound = $false
 
                 foreach ($TemplateCAPolicy in $TemplateCATemplates) {

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSnoozeAlert.ps1

@@ -16,6 +16,7 @@ function Invoke-ExecSnoozeAlert {
         $TenantFilter = $Request.Body.TenantFilter
         $AlertItem = $Request.Body.AlertItem
         $Duration = [int]$Request.Body.Duration
+        $Reason = [string]$Request.Body.Reason
         $SnoozedBy = try {
             ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails
         } catch { 'Unknown' }
@@ -56,13 +57,17 @@ function Invoke-ExecSnoozeAlert {
             SnoozedAt      = [string]$CurrentUnixTime
             ContentPreview = [string]$HashResult.ContentPreview
             SnoozeKey      = [string]$HashResult.RawKey
+            SnoozeReason   = [string]$Reason
         }
 
         Add-CIPPAzDataTableEntity @SnoozeTable -Entity $SnoozeEntity -Force | Out-Null
 
         $DurationLabel = if ($Duration -eq -1) { 'forever' } else { "$Duration days" }
         $ContentPreview = $HashResult.ContentPreview
         $Result = "Successfully snoozed alert for ${DurationLabel}: ${ContentPreview}"
+        if (-not [string]::IsNullOrWhiteSpace($Reason)) {
+            $Result = "$Result - Reason: $Reason"
+        }
 
         Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Info' -tenant $TenantFilter
 

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListSnoozedAlerts.ps1

@@ -43,6 +43,7 @@ function Invoke-ListSnoozedAlerts {
                     Tenant         = $_.Tenant
                     ContentHash    = $_.ContentHash
                     ContentPreview = $_.ContentPreview
+                    SnoozeReason   = $_.SnoozeReason
                     SnoozedBy      = $_.SnoozedBy
                     SnoozedAt      = $_.SnoozedAt
                     SnoozeUntil    = $_.SnoozeUntil

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-EditGroup.ps1

@@ -124,6 +124,46 @@ function Invoke-EditGroup {
         }
     }
 
+    $AddDevices = $UserObj.AddDevice
+    if ($AddDevices) {
+        $AddDevices | ForEach-Object {
+            $Device = $_
+            try {
+                $DeviceLabel = $Device.label ?? $Device.addedFields.deviceName ?? $Device.value
+                if ($GroupType -eq 'Distribution List' -or $GroupType -eq 'Mail-Enabled Security') {
+                    $Results.Add("Error - Devices cannot be added to a $GroupType group")
+                    Write-LogMessage -headers $Headers -API $APIName -tenant $TenantId -message "Cannot add device $DeviceLabel to $($GroupName): devices are not supported in a $GroupType group" -Sev 'Error'
+                } else {
+                    # Intune device rows carry the Entra deviceId (azureADDeviceId) rather than the
+                    # directory object id - resolve it via the devices alternate key
+                    $DeviceID = $Device.value
+                    if ($Device.addedFields.azureADDeviceId) {
+                        $DeviceID = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/devices(deviceId='$($Device.addedFields.azureADDeviceId)')?`$select=id" -tenantid $TenantId).id
+                    }
+
+                    $AddDeviceBody = @{
+                        'members@odata.bind' = @($MemberODataBindString -f $DeviceID)
+                    }
+                    $BulkRequests.Add(@{
+                            id      = "addDevice-$DeviceID"
+                            method  = 'PATCH'
+                            url     = "groups/$($GroupId)"
+                            body    = $AddDeviceBody
+                            headers = @{
+                                'Content-Type' = 'application/json'
+                            }
+                        })
+                    $GraphLogs.Add(@{
+                            message = "Added device $DeviceLabel to $($GroupName) group"
+                            id      = "addDevice-$DeviceID"
+                        })
+                }
+            } catch {
+                Write-Warning "Error in AddDevices: $($_.Exception.Message)"
+                $Results.Add("Error - Failed to add device $DeviceLabel to $($GroupName): $($_.Exception.Message)")
+            }
+        }
+    }
 
     $AddContacts = $UserObj.AddContact
     if ($AddContacts) {

Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1

@@ -100,9 +100,11 @@ function Invoke-CIPPStandardSafeLinksPolicy {
         # Use existing policy name if found
         $PolicyName = $ExistingPolicy.Name
     }
-    # Derive rule name from policy name, but check for old names for backward compatibility
-    $DesiredRuleName = "$PolicyName Rule"
-    $RuleList = @($DesiredRuleName, 'CIPP Default SafeLinks Rule', 'CIPP Default SafeLinks Policy')
+    # Derive rule name from policy name using the same convention as the Safe Links page and
+    # templates (PolicyName_Rule), but check for old names for backward compatibility so rules
+    # created as "PolicyName Rule" by earlier versions of this standard are adopted, not duplicated
+    $DesiredRuleName = "$($PolicyName)_Rule"
+    $RuleList = @($DesiredRuleName, "$PolicyName Rule", 'CIPP Default SafeLinks Rule', 'CIPP Default SafeLinks Policy')
     $ExistingRule = $AllSafeLinksRule | Where-Object -Property Name -In $RuleList | Select-Object -First 1
     if ($null -eq $ExistingRule.Name) {
         # No existing rule - use the derived name