Merge pull request #170 from KelvinTegelaar/master

[pull] master from KelvinTegelaar:master

Author: pull[bot]

Config/PermissionsTranslator.json

@@ -38886,6 +38886,58 @@
         "x-cipp-role": "Endpoint.Autopilot.Read"
       }
     },
+    "/api/ListApiEgress": {
+      "get": {
+        "summary": "ListApiEgress",
+        "operationId": "ListApiEgress",
+        "tags": [
+          "CIPP > Settings"
+        ],
+        "description": "Per-API-client egress usage for this instance against the daily cap. Reads the\nCraftEgressAccounting table that the Craft runtime mirrors its egress accounting into (the same\nstorage account, so this reads it directly): a per-day audit row per client plus an instance\ntotal, and 15-minute buckets for the trend. Returns today's instance summary (used-of-cap,\nenforcing, when the cap was first hit, how many requests were shed), the per-client breakdown,\nand the last-24h instance trend. When the table has no data for today - accounting off, a\nnon-hosted instance, or simply no app-only traffic yet - Enabled is false and the UI hides the\ncard. SuperAdmin only.",
+        "parameters": [
+          {
+            "name": "Hours",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "CIPP.SuperAdmin.Read",
+        "x-cipp-any-tenant": true
+      }
+    },
     "/api/ListApiTest": {
       "get": {
         "summary": "ListApiTest",
@@ -49090,24 +49142,6 @@
                       "Bucket": {
                         "x-cipp-field-source": "storage"
                       },
-                      "EgressBytes": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "EgressBytesToday": {
-                        "type": "integer",
-                        "x-cipp-field-source": "storage"
-                      },
-                      "EgressCapBytes": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "EgressRejectClients": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
-                      },
-                      "EgressRejectCount": {
-                        "type": "integer",
-                        "x-cipp-field-source": "storage"
-                      },
                       "ErrCount": {
                         "type": "integer",
                         "x-cipp-field-source": "storage"

Config/openapi.json

@@ -242,6 +242,18 @@ function Push-DomainAnalyserDomain {
             $Result.DKIMEnabled = $false
             $ScoreExplanation.Add('DKIM Not Configured') | Out-Null
         }
+
+        # Persist the selectors the analyser just discovered so GetDkimSelectors reads them from the
+        # Domains table instead of returning nothing (mirrors how Invoke-ListDomainHealth/ExecDnsConfig store them).
+        $DiscoveredSelectors = @($DkimRecord.Selectors | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) | Sort-Object -Unique
+        if ($DiscoveredSelectors.Count -gt 0) {
+            $DkimSelectorsJson = [string]($DiscoveredSelectors | ConvertTo-Json -Compress)
+            if ($DomainObject.PSObject.Properties.Name -notcontains 'DkimSelectors') {
+                $DomainObject | Add-Member -MemberType NoteProperty -Name DkimSelectors -Value $DkimSelectorsJson -Force
+            } else {
+                $DomainObject.DkimSelectors = $DkimSelectorsJson
+            }
+        }
     } catch {
         $Message = 'DKIM Exception'
         Write-LogMessage -API 'DomainAnalyser' -tenant $DomainObject.TenantId -message $Message -LogData (Get-CippException -Exception $_) -sev Error

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserDomain.ps1

@@ -0,0 +1,81 @@
+function Grant-CippAppGraphConsent {
+    <#
+    .SYNOPSIS
+        Ensures a tenant-wide (AllPrincipals) oauth2PermissionGrant exists from an app's service
+        principal to Microsoft Graph, covering the given delegated scopes.
+    .DESCRIPTION
+        Admin-consents delegated Microsoft Graph scopes for an app registration in the partner
+        tenant, so users signing in through it are not prompted to consent. Used to pre-consent
+        the OIDC + offline_access scopes an MCP client (Copilot Studio, Claude, ChatGPT, VS Code)
+        requests: without offline_access consent, Entra will not issue a refresh token and the
+        client re-authenticates every time the access token expires (~hourly).
+
+        This matters most in tenants that disable user consent to applications (which CIPP's own
+        OauthConsentLowSec standard recommends): there, an un-consented offline_access request
+        silently yields no refresh token. Admin consent is the only reliable path.
+
+        Additive — existing consented scopes are preserved and only the missing ones are added.
+        The service principal of a freshly created app is not always queryable immediately, so
+        the client SP lookup retries briefly before giving up.
+    .PARAMETER AppId
+        Application (client) ID of the app whose service principal should receive the grant.
+    .PARAMETER Scopes
+        Delegated Microsoft Graph scope names to ensure are consented (e.g. openid, profile,
+        offline_access).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]
+        [string]$AppId,
+
+        [Parameter(Mandatory)]
+        [string[]]$Scopes
+    )
+
+    $GraphAppId = '00000003-0000-0000-c000-000000000000'
+
+    # The app's own service principal may still be replicating right after creation.
+    $ClientSp = $null
+    for ($Attempt = 1; $Attempt -le 3 -and -not $ClientSp.id; $Attempt++) {
+        try {
+            $ClientSp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals(appId='$AppId')?`$select=id" -NoAuthCheck $true -asapp $true
+        } catch {
+            Write-Information "[App-Consent] Service principal for $AppId not queryable yet (attempt $Attempt): $($_.Exception.Message)"
+        }
+        if (-not $ClientSp.id -and $Attempt -lt 3) { Start-Sleep -Seconds 2 }
+    }
+    if (-not $ClientSp.id) {
+        throw "Service principal for app '$AppId' was not found; cannot write consent grant yet."
+    }
+
+    $GraphSp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals(appId='$GraphAppId')?`$select=id" -NoAuthCheck $true -asapp $true
+    if (-not $GraphSp.id) {
+        throw 'Microsoft Graph service principal was not found in this tenant.'
+    }
+
+    $Grants = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals/$($ClientSp.id)/oauth2PermissionGrants" -NoAuthCheck $true -asapp $true)
+    $TenantGrant = $Grants | Where-Object { $_.resourceId -eq $GraphSp.id -and $_.consentType -eq 'AllPrincipals' } | Select-Object -First 1
+
+    if ($TenantGrant) {
+        $CurrentScopes = @($TenantGrant.scope -split ' ' | Where-Object { $_ })
+        $MissingScopes = @($Scopes | Where-Object { $_ -notin $CurrentScopes })
+        if ($MissingScopes.Count -eq 0) {
+            return [PSCustomObject]@{ AppId = $AppId; Action = 'nochange'; Scopes = $CurrentScopes }
+        }
+        $MergedScopes = (@($CurrentScopes + $MissingScopes) | Sort-Object -Unique) -join ' '
+        $PatchBody = @{ scope = $MergedScopes } | ConvertTo-Json -Compress
+        $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/$($TenantGrant.id)" -body $PatchBody -type PATCH -NoAuthCheck $true -asapp $true
+        return [PSCustomObject]@{ AppId = $AppId; Action = 'updated'; Scopes = @($MergedScopes -split ' ') }
+    }
+
+    $CreateBody = @{
+        clientId    = $ClientSp.id
+        consentType = 'AllPrincipals'
+        resourceId  = $GraphSp.id
+        scope       = ($Scopes -join ' ')
+    } | ConvertTo-Json -Compress
+    $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/oauth2PermissionGrants' -body $CreateBody -type POST -NoAuthCheck $true -asapp $true
+    return [PSCustomObject]@{ AppId = $AppId; Action = 'created'; Scopes = @($Scopes) }
+}

Modules/CIPPCore/Public/Authentication/Grant-CippAppGraphConsent.ps1

@@ -243,6 +243,59 @@ function Initialize-CIPPAuth {
                     } else {
                         Write-Information "[Auth-Init] EasyAuth already matches $($EnabledClients.Count) enabled API client(s) — no update needed"
                     }
+
+                    # Ensure offline_access is admin-consented on every MCP-enabled client so Entra
+                    # issues a refresh token — without it, MCP clients (Copilot Studio especially)
+                    # re-authenticate roughly every hour when the access token expires. Set at
+                    # client-creation time by Set-CIPPMCPClientApp, but re-checked here so a client
+                    # created before this existed, or whose service principal had not replicated at
+                    # creation, self-heals on the next warmup. Idempotent and cheap: the grant helper
+                    # no-ops once the scopes are present. Best-effort per client.
+                    foreach ($McpId in $McpClientIds) {
+                        if ([string]::IsNullOrEmpty($McpId)) { continue }
+                        try {
+                            $McpConsent = Grant-CippAppGraphConsent -AppId $McpId -Scopes @('openid', 'profile', 'offline_access')
+                            if ($McpConsent.Action -ne 'nochange') {
+                                Write-Information "[Auth-Init] MCP client $McpId offline_access consent: $($McpConsent.Action)"
+                            }
+                        } catch {
+                            Write-Information "[Auth-Init] MCP client $McpId offline_access consent reconcile failed (non-fatal): $_"
+                        }
+                    }
+
+                    # Ensure the MCP OAuth scope advertisement (challenge header + discovery docs)
+                    # includes offline_access. These app settings are written by "Save to Azure",
+                    # but a code deploy does NOT regenerate them — an instance that never re-saved
+                    # after offline_access was added would still hand strict discovery clients
+                    # (e.g. Copilot CLI) a scope with no offline_access, so they re-authenticate
+                    # ~hourly. Reconcile on drift only: once offline_access is present this never
+                    # writes (or restarts) again. Values come from the same helper Save to Azure
+                    # uses, so a write here is byte-identical and self-terminating.
+                    if ($McpClientIds.Count -gt 0 -and $env:WEBSITE_HOSTNAME) {
+                        try {
+                            $McpScope = "https://$($env:WEBSITE_HOSTNAME)/user_impersonation"
+                            $HeaderTokens = @("$($env:WEBSITE_AUTH_PRM_DEFAULT_WITH_SCOPES)" -split ' ' | Where-Object { $_ })
+                            $ScopeDrift = ('offline_access' -notin $HeaderTokens) -or ($McpScope -notin $HeaderTokens)
+                            if (-not $ScopeDrift -and $env:CIPPNG) {
+                                foreach ($DocJson in @($env:CRAFT_PRM, $env:CRAFT_PRM_AS)) {
+                                    $Supported = $null
+                                    try { $Supported = @(($DocJson | ConvertFrom-Json -ErrorAction Stop).scopes_supported) } catch { $ScopeDrift = $true; break }
+                                    if ('offline_access' -notin $Supported -or $McpScope -notin $Supported) { $ScopeDrift = $true; break }
+                                }
+                            }
+                            if ($ScopeDrift) {
+                                $McpRg = Get-CIPPFunctionAppResourceGroup -SiteName $env:WEBSITE_SITE_NAME
+                                $McpAppSettings = Get-CippMcpScopeAppSettings -Hostname $env:WEBSITE_HOSTNAME -TenantId $env:TenantID -IsCippNg:([bool]$env:CIPPNG)
+                                $null = Update-CIPPAzFunctionAppSetting -Name $env:WEBSITE_SITE_NAME -ResourceGroupName $McpRg -AppSetting $McpAppSettings
+                                Write-Information '[Auth-Init] MCP OAuth scope advertisement was missing offline_access — reconciled app settings and requesting restart'
+                                Request-CIPPRestart -Reason 'MCP OAuth scope settings reconciled (offline_access) during warmup'
+                            } else {
+                                Write-Information '[Auth-Init] MCP OAuth scope advertisement already includes offline_access — no update needed'
+                            }
+                        } catch {
+                            Write-Information "[Auth-Init] MCP OAuth scope reconcile failed (non-fatal): $_"
+                        }
+                    }
                 }
             } catch {
                 Write-Information "[Auth-Init] API client reconcile failed (non-fatal): $_"

Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1

@@ -125,12 +125,36 @@ function Set-CIPPMCPClientApp {
         $SpaRedirectUris.Add($Uri)
     }
 
+    # Declare offline_access (Microsoft Graph, delegated) so Entra will issue a refresh token to
+    # MCP clients. Without it, Copilot Studio (Manual OAuth) and stricter discovery clients
+    # re-prompt for sign-in roughly every hour when the access token expires. Additive — every
+    # permission already on the app is preserved; only offline_access is added if missing.
+    $GraphResourceId = '00000003-0000-0000-c000-000000000000'
+    $OfflineAccessId = '7427e0e9-2fba-42fe-b0c0-848c9e6a8182'
+    $RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
+    $GraphEntrySeen = $false
+    foreach ($Resource in @($App.requiredResourceAccess)) {
+        $ResourceAccess = [System.Collections.Generic.List[object]]::new()
+        foreach ($Access in @($Resource.resourceAccess)) { $ResourceAccess.Add(@{ id = $Access.id; type = $Access.type }) }
+        if ($Resource.resourceAppId -eq $GraphResourceId) {
+            $GraphEntrySeen = $true
+            if (-not ($ResourceAccess | Where-Object { $_.id -eq $OfflineAccessId })) {
+                $ResourceAccess.Add(@{ id = $OfflineAccessId; type = 'Scope' })
+            }
+        }
+        $RequiredResourceAccess.Add(@{ resourceAppId = $Resource.resourceAppId; resourceAccess = @($ResourceAccess) })
+    }
+    if (-not $GraphEntrySeen) {
+        $RequiredResourceAccess.Add(@{ resourceAppId = $GraphResourceId; resourceAccess = @(@{ id = $OfflineAccessId; type = 'Scope' }) })
+    }
+
     $PatchBody = @{
         identifierUris         = @($IdentifierUris)
         api                    = $Api
         web                    = @{ redirectUris = @($WebRedirectUris) }
         spa                    = @{ redirectUris = @($SpaRedirectUris) }
         publicClient           = @{ redirectUris = @($PublicRedirectUris) }
+        requiredResourceAccess = @($RequiredResourceAccess)
         # "Allow public client flows" — required for the secret-less PKCE redemption every MCP
         # client above performs.
         isFallbackPublicClient = $true
@@ -140,6 +164,20 @@ function Set-CIPPMCPClientApp {
         try {
             $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$($App.id)" -type PATCH -body $PatchBody -NoAuthCheck $true -asapp $true
             Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "Configured app registration $AppId as MCP resource (identifier URIs, v2 tokens, known MCP client callbacks + pre-authorization)." -Sev 'Info'
+
+            # Admin-consent the OIDC + offline_access delegated scopes for this app so Entra
+            # issues the refresh token without a per-user consent prompt. Copilot Studio uses
+            # Manual OAuth and never reads the challenge/discovery scope, so this app-registration
+            # consent — not WEBSITE_AUTH_PRM_DEFAULT_WITH_SCOPES — is what makes its refresh work.
+            # Best-effort: the app still works without it (users may see a one-time prompt, or the
+            # grant is retried the next time the client is saved), so a failure here is non-fatal.
+            try {
+                $ConsentResult = Grant-CippAppGraphConsent -AppId $AppId -Scopes @('openid', 'profile', 'offline_access')
+                Write-Information "[MCP-Client] offline_access admin-consent for $AppId : $($ConsentResult.Action)"
+            } catch {
+                Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "MCP client $AppId configured, but admin-consent for offline_access could not be written (refresh tokens may prompt on first use): $($_.Exception.Message)" -Sev 'Warning'
+            }
+
             return @{ Success = $true; IdentifierUris = @($IdentifierUris); RedirectUris = @($PublicRedirectUris) }
         } catch {
             $ErrMsg = $_.Exception.Message

Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1

@@ -35,19 +35,17 @@ function Get-CIPPBaselineGroupTemplateState {
     if (-not $Template -or [string]::IsNullOrWhiteSpace($GroupName)) { return @{ Current = $null } }
 
     if ("$($Template.groupType)" -eq 'dynamicDistribution') {
-        $Distros = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'ExoDynamicDistributionGroup')
-        if ($Distros.Count -eq 0 -and -not (Test-CIPPBaselineCacheCollected -TenantFilter $TenantFilter -Type 'ExoDynamicDistributionGroup')) {
-            return @{ Current = $null }
-        }
-        $Existing = $Distros | Where-Object { "$($_.Name)" -eq $GroupName } | Select-Object -First 1
-    } else {
-        $Groups = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'Groups')
-        if ($Groups.Count -eq 0 -and -not (Test-CIPPBaselineCacheCollected -TenantFilter $TenantFilter -Type 'Groups')) {
-            return @{ Current = $null }
-        }
-        $Existing = $Groups | Where-Object { "$($_.displayName)" -eq $GroupName } | Select-Object -First 1
+        # Dynamic Distribution Groups are not supported by CIPP: do not grade them (a graded DDL reads as
+        # permanent drift and its executor write throws). Return not-applicable, consistent with the executor skip.
+        return @{ Current = $null }
     }
 
+    $Groups = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'Groups')
+    if ($Groups.Count -eq 0 -and -not (Test-CIPPBaselineCacheCollected -TenantFilter $TenantFilter -Type 'Groups')) {
+        return @{ Current = $null }
+    }
+    $Existing = $Groups | Where-Object { "$($_.displayName)" -eq $GroupName } | Select-Object -First 1
+
     $Current = [PSCustomObject]@{ deployed = [bool]$Existing }
     # Carried for the executor, not graded.
     $Current | Add-Member -NotePropertyName 'templateBody' -NotePropertyValue $Template