[pull] master from KelvinTegelaar:master

Config/BaselineStandards/Copilot (M365) Standards/CopilotLimitedMode.json

@@ -1,5 +1,6 @@
 {
   "name": "CopilotLimitedMode",
+  "disabled": true,
   "label": "Set Copilot Limited Mode",
   "cat": "Copilot (M365) Standards",
   "tag": [],

Config/BaselineStandards/Defender Standards/QuarantineRequestAlert.json

@@ -36,7 +36,13 @@
       "type": "textField",
       "label": "E-mail to receive the alert",
       "helperText": "Ignored when the alert state is Removed.",
-      "required": true
+      "required": true,
+      "validators": {
+        "pattern": {
+          "value": "^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$",
+          "message": "Must be a valid e-mail address"
+        }
+      }
     },
     "AllowExtraAddresses": {
       "type": "switch",

Config/BaselineStandards/Defender Standards/SpamFilterPolicy.json

@@ -302,6 +302,26 @@
       "required": true,
       "default": 7
     },
+    "BulkMovesEnabled": {
+      "type": "select",
+      "multiple": false,
+      "label": "Bulk moves enabled (deliver bulk mail below the threshold to the Promotions folder - Preview)",
+      "options": [
+        {
+          "label": "Do not configure",
+          "value": ""
+        },
+        {
+          "label": "On",
+          "value": "On"
+        },
+        {
+          "label": "Off",
+          "value": "Off"
+        }
+      ],
+      "default": ""
+    },
     "IncreaseScoreWithImageLinks": {
       "type": "switch",
       "label": "Increase score with image links",

Config/BaselineStandards/Entra (AAD) Standards/AdminSSPR.json

@@ -36,6 +36,10 @@
   "read": {
     "cacheType": "AuthorizationPolicy"
   },
+  "writeTarget": "authorizationPolicy",
+  "writeTargetProperties": {
+    "allowedToUseSSPR": "%allowSSPR%"
+  },
   "remediate": {
     "executor": "GraphRequest",
     "requests": [

Config/BaselineStandards/Entra (AAD) Standards/AppDeploy.json

@@ -46,7 +46,8 @@
         "url": "/api/ListAppApprovalTemplates",
         "labelField": "TemplateName",
         "valueField": "TemplateId",
-        "queryKey": "StdAppApprovalTemplateList"
+        "queryKey": "StdAppApprovalTemplateList",
+        "templateView": { "title": "App Approval Template" }
       }
     },
     "appids": {

Config/BaselineStandards/Entra (AAD) Standards/AuthMethodsPolicyMigration.json

@@ -44,6 +44,10 @@
   "read": {
     "cacheType": "AuthenticationMethodsPolicy"
   },
+  "writeTarget": "authenticationMethodsPolicy",
+  "writeTargetProperties": {
+    "policyMigrationState": "%migrationState%"
+  },
   "remediate": {
     "executor": "GraphRequest",
     "requests": [

Config/BaselineStandards/Entra (AAD) Standards/AuthMethodsSettings.json

@@ -81,6 +81,11 @@
   "read": {
     "cacheType": "AuthenticationMethodsPolicy"
   },
+  "writeTarget": "authenticationMethodsPolicy",
+  "writeTargetProperties": {
+    "reportSuspiciousActivitySettings.state": "%reportSuspiciousActivity%",
+    "systemCredentialPreferences.state": "%systemCredential%"
+  },
   "remediate": {
     "executor": "GraphRequest",
     "requests": [

Config/BaselineStandards/Entra (AAD) Standards/AuthenticationMethods.json

@@ -24,99 +24,249 @@
   "compare": "subset",
   "variables": {
     "MicrosoftAuthenticatorEnabled": {
-      "label": "Microsoft Authenticator: manage this method",
+      "creatable": false,
+      "options": [
+        {
+          "value": true,
+          "label": "Enabled"
+        },
+        {
+          "value": false,
+          "label": "Disabled"
+        },
+        {
+          "value": "notConfigured",
+          "label": "Not Configured"
+        }
+      ],
       "omitWhenBlank": true,
-      "type": "switch"
+      "type": "autoComplete",
+      "label": "Microsoft Authenticator: state (Not Configured = leave as-is)"
     },
     "MicrosoftAuthenticatorGroup": {
       "label": "Microsoft Authenticator: target group (blank = all users)",
       "omitWhenBlank": true,
       "type": "textField"
     },
     "FIDO2Enabled": {
-      "label": "FIDO2 Security Keys: manage this method",
+      "creatable": false,
+      "options": [
+        {
+          "value": true,
+          "label": "Enabled"
+        },
+        {
+          "value": false,
+          "label": "Disabled"
+        },
+        {
+          "value": "notConfigured",
+          "label": "Not Configured"
+        }
+      ],
       "omitWhenBlank": true,
-      "type": "switch"
+      "type": "autoComplete",
+      "label": "FIDO2 Security Keys: state (Not Configured = leave as-is)"
     },
     "FIDO2Group": {
       "label": "FIDO2 Security Keys: target group (blank = all users)",
       "omitWhenBlank": true,
       "type": "textField"
     },
     "TAPEnabled": {
-      "label": "Temporary Access Pass: manage this method",
+      "creatable": false,
+      "options": [
+        {
+          "value": true,
+          "label": "Enabled"
+        },
+        {
+          "value": false,
+          "label": "Disabled"
+        },
+        {
+          "value": "notConfigured",
+          "label": "Not Configured"
+        }
+      ],
       "omitWhenBlank": true,
-      "type": "switch"
+      "type": "autoComplete",
+      "label": "Temporary Access Pass: state (Not Configured = leave as-is)"
     },
     "TAPGroup": {
       "label": "Temporary Access Pass: target group (blank = all users)",
       "omitWhenBlank": true,
       "type": "textField"
     },
     "SoftwareOathEnabled": {
-      "label": "Software OATH Tokens: manage this method",
+      "creatable": false,
+      "options": [
+        {
+          "value": true,
+          "label": "Enabled"
+        },
+        {
+          "value": false,
+          "label": "Disabled"
+        },
+        {
+          "value": "notConfigured",
+          "label": "Not Configured"
+        }
+      ],
       "omitWhenBlank": true,
-      "type": "switch"
+      "type": "autoComplete",
+      "label": "Software OATH Tokens: state (Not Configured = leave as-is)"
     },
     "SoftwareOathGroup": {
       "label": "Software OATH Tokens: target group (blank = all users)",
       "omitWhenBlank": true,
       "type": "textField"
     },
     "HardwareOathEnabled": {
-      "label": "Hardware OATH Tokens: manage this method",
+      "creatable": false,
+      "options": [
+        {
+          "value": true,
+          "label": "Enabled"
+        },
+        {
+          "value": false,
+          "label": "Disabled"
+        },
+        {
+          "value": "notConfigured",
+          "label": "Not Configured"
+        }
+      ],
       "omitWhenBlank": true,
-      "type": "switch"
+      "type": "autoComplete",
+      "label": "Hardware OATH Tokens: state (Not Configured = leave as-is)"
     },
     "HardwareOathGroup": {
       "label": "Hardware OATH Tokens: target group (blank = all users)",
       "omitWhenBlank": true,
       "type": "textField"
     },
     "SMSEnabled": {
-      "label": "SMS: manage this method",
+      "creatable": false,
+      "options": [
+        {
+          "value": true,
+          "label": "Enabled"
+        },
+        {
+          "value": false,
+          "label": "Disabled"
+        },
+        {
+          "value": "notConfigured",
+          "label": "Not Configured"
+        }
+      ],
       "omitWhenBlank": true,
-      "type": "switch"
+      "type": "autoComplete",
+      "label": "SMS: state (Not Configured = leave as-is)"
     },
     "SMSGroup": {
       "label": "SMS: target group (blank = all users)",
       "omitWhenBlank": true,
       "type": "textField"
     },
     "VoiceEnabled": {
-      "label": "Voice Call: manage this method",
+      "creatable": false,
+      "options": [
+        {
+          "value": true,
+          "label": "Enabled"
+        },
+        {
+          "value": false,
+          "label": "Disabled"
+        },
+        {
+          "value": "notConfigured",
+          "label": "Not Configured"
+        }
+      ],
       "omitWhenBlank": true,
-      "type": "switch"
+      "type": "autoComplete",
+      "label": "Voice Call: state (Not Configured = leave as-is)"
     },
     "VoiceGroup": {
       "label": "Voice Call: target group (blank = all users)",
       "omitWhenBlank": true,
       "type": "textField"
     },
     "EmailEnabled": {
-      "label": "Email OTP: manage this method",
+      "creatable": false,
+      "options": [
+        {
+          "value": true,
+          "label": "Enabled"
+        },
+        {
+          "value": false,
+          "label": "Disabled"
+        },
+        {
+          "value": "notConfigured",
+          "label": "Not Configured"
+        }
+      ],
       "omitWhenBlank": true,
-      "type": "switch"
+      "type": "autoComplete",
+      "label": "Email OTP: state (Not Configured = leave as-is)"
     },
     "EmailGroup": {
       "label": "Email OTP: target group (blank = all users)",
       "omitWhenBlank": true,
       "type": "textField"
     },
     "x509CertificateEnabled": {
-      "label": "Certificate-Based Authentication: manage this method",
+      "creatable": false,
+      "options": [
+        {
+          "value": true,
+          "label": "Enabled"
+        },
+        {
+          "value": false,
+          "label": "Disabled"
+        },
+        {
+          "value": "notConfigured",
+          "label": "Not Configured"
+        }
+      ],
       "omitWhenBlank": true,
-      "type": "switch"
+      "type": "autoComplete",
+      "label": "Certificate-Based Authentication: state (Not Configured = leave as-is)"
     },
     "x509CertificateGroup": {
       "label": "Certificate-Based Authentication: target group (blank = all users)",
       "omitWhenBlank": true,
       "type": "textField"
     },
     "QRCodePinEnabled": {
-      "label": "QR Code Pin: manage this method",
+      "creatable": false,
+      "options": [
+        {
+          "value": true,
+          "label": "Enabled"
+        },
+        {
+          "value": false,
+          "label": "Disabled"
+        },
+        {
+          "value": "notConfigured",
+          "label": "Not Configured"
+        }
+      ],
       "omitWhenBlank": true,
-      "type": "switch"
+      "type": "autoComplete",
+      "label": "QR Code Pin: state (Not Configured = leave as-is)"
     },
     "QRCodePinGroup": {
       "label": "QR Code Pin: target group (blank = all users)",
@@ -268,6 +418,28 @@
     "cacheType": "AuthenticationMethodsPolicy"
   },
   "prepare": "Get-CIPPBaselineAuthenticationMethodsState",
+  "writeTarget": "authenticationMethodsPolicy",
+  "writeTargetProperties": {
+    "Sms.state": "%SMSEnabled%",
+    "Voice.state": "%VoiceEnabled%",
+    "Email.state": "%EmailEnabled%",
+    "x509Certificate.state": "%x509CertificateEnabled%",
+    "HardwareOath.state": "%HardwareOathEnabled%",
+    "SoftwareOath.state": "%SoftwareOathEnabled%",
+    "QRCodePin.state": "%QRCodePinEnabled%",
+    "Fido2.state": "%FIDO2Enabled%",
+    "MicrosoftAuthenticator.state": "%MicrosoftAuthenticatorEnabled%",
+    "MicrosoftAuthenticator.isSoftwareOathEnabled": "%MicrosoftAuthenticatorSoftwareOath%",
+    "MicrosoftAuthenticator.featureSettings.displayAppInformationRequiredState.state": "%MicrosoftAuthenticatorDisplayAppInfo%",
+    "MicrosoftAuthenticator.featureSettings.displayLocationInformationRequiredState.state": "%MicrosoftAuthenticatorDisplayLocation%",
+    "MicrosoftAuthenticator.featureSettings.companionAppAllowedState.state": "%MicrosoftAuthenticatorCompanionApp%",
+    "TemporaryAccessPass.state": "%TAPEnabled%",
+    "TemporaryAccessPass.isUsableOnce": "%TAPUsableOnce%",
+    "TemporaryAccessPass.defaultLifetimeInMinutes": "%TAPDefaultLifetime%",
+    "TemporaryAccessPass.minimumLifetimeInMinutes": "%TAPMinLifetime%",
+    "TemporaryAccessPass.maximumLifetimeInMinutes": "%TAPMaxLifetime%",
+    "TemporaryAccessPass.defaultLength": "%TAPDefaultLength%"
+  },
   "remediate": {
     "executor": "AuthenticationMethods"
   }