[pull] master from KelvinTegelaar:master

Config/DocsSynonyms.json

@@ -0,0 +1,75 @@
+{
+  "_comment": "Query-expansion map for the SearchDocs MCP tool (Find-CippDoc). Keys are matched against the caller's query after tokenisation and stemming, so write them as ordinary words; the loader stems them. Values are expansion phrases scored at a damped weight, which is what lets a search for 'CA policy' reach pages that only ever say 'conditional access'. This is where most of the perceived semantic behaviour comes from without an embedding model, so it is worth extending whenever a real search misses.",
+  "expansions": {
+    "ca": ["conditional access policy"],
+    "mfa": ["multifactor authentication", "multi factor"],
+    "2fa": ["multifactor authentication"],
+    "sso": ["single sign on", "saml", "identity provider"],
+    "gdap": ["granular delegated admin privileges", "delegated access", "relationship"],
+    "dap": ["delegated admin privileges"],
+    "sam": ["secure application model", "service account", "application registration"],
+    "bec": ["business email compromise", "compromise remediation", "indicators of compromise"],
+    "bpa": ["best practice analyser", "report builder"],
+    "cis": ["compliance benchmark test"],
+    "spf": ["domain analyser", "email authentication", "dns record"],
+    "dkim": ["domain analyser", "email authentication", "dns record"],
+    "dmarc": ["domain analyser", "email authentication", "dns record"],
+    "dns": ["domain analyser", "domain health"],
+    "offboard": ["offboarding user removal"],
+    "onboard": ["onboarding tenant setup wizard"],
+    "standard": ["drift remediation baseline template"],
+    "drift": ["standards deviation baseline"],
+    "alert": ["alerting notification webhook"],
+    "tenant": ["customer client organisation"],
+    "intune": ["endpoint manager device management"],
+    "autopilot": ["device enrolment provisioning"],
+    "defender": ["security threat protection antivirus"],
+    "exchange": ["exchange online mailbox email"],
+    "exo": ["exchange online"],
+    "spam": ["spamfilter quarantine mail flow"],
+    "quarantine": ["spamfilter released message"],
+    "mailbox": ["exchange mailbox permissions shared"],
+    "license": ["licence sku subscription assignment"],
+    "licence": ["license sku subscription assignment"],
+    "sku": ["license subscription"],
+    "role": ["permission access rbac custom role"],
+    "permission": ["role access rbac consent"],
+    "rbac": ["role based access control permission"],
+    "log": ["audit log logbook activity history"],
+    "audit": ["log logbook activity history"],
+    "webhook": ["notification alert subscription"],
+    "psa": ["integration halo autotask connectwise"],
+    "rmm": ["integration ninja datto syncro"],
+    "backup": ["restore recovery export"],
+    "restore": ["backup recovery import"],
+    "template": ["policy blueprint preset"],
+    "policy": ["template configuration profile"],
+    "group": ["distribution list security group team"],
+    "user": ["account identity member"],
+    "password": ["credential reset passwordless authentication method"],
+    "device": ["endpoint computer workstation managed device"],
+    "app": ["application enterprise application service principal"],
+    "application": ["app enterprise application service principal"],
+    "sharepoint": ["onedrive site document library"],
+    "onedrive": ["sharepoint site storage"],
+    "teams": ["team channel meeting collaboration"],
+    "report": ["reporting export dashboard analytics"],
+    "dashboard": ["overview home report"],
+    "scheduler": ["scheduled task recurring job cron"],
+    "queue": ["scheduled task job processing"],
+    "error": ["troubleshooting failure issue problem"],
+    "fail": ["troubleshooting error issue problem"],
+    "troubleshoot": ["error failure diagnostic issue"],
+    "install": ["deployment setup provisioning"],
+    "deploy": ["installation setup provisioning"],
+    "upgrade": ["update version migration"],
+    "update": ["upgrade version release"],
+    "api": ["endpoint integration rest client"],
+    "mcp": ["model context protocol tool integration"],
+    "copilot": ["microsoft copilot ai"],
+    "hosted": ["cyberdrain hosted managed instance sponsor"],
+    "selfhost": ["self hosted azure deployment"],
+    "azure": ["subscription resource group function app"],
+    "graph": ["microsoft graph api request"]
+  }
+}

Config/openapi.json

@@ -4670,10 +4670,20 @@
                     }
                   },
                   "TemplateGuid": {
-                    "type": "string"
+                    "type": "string",
+                    "description": "The deploy drawer and wizard send the chosen row's GUID as TemplateList.value, not as TemplateID. Template display names are not unique - re-imports create same-named twins - so resolving by display name below can land on a different row than the one the user picked. The selected RowKey must win whenever the request carries one. String rather than Guid: built-in templates are stored with their filename as RowKey."
                   },
                   "TemplateID": {
-                    "type": "string"
+                    "type": "string",
+                    "description": "The deploy drawer and wizard send the chosen row's GUID as TemplateList.value, not as TemplateID. Template display names are not unique - re-imports create same-named twins - so resolving by display name below can land on a different row than the one the user picked. The selected RowKey must win whenever the request carries one. String rather than Guid: built-in templates are stored with their filename as RowKey."
+                  },
+                  "TemplateList": {
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/LabelValue"
+                      }
+                    ],
+                    "description": "The deploy drawer and wizard send the chosen row's GUID as TemplateList.value, not as TemplateID. Template display names are not unique - re-imports create same-named twins - so resolving by display name below can land on a different row than the one the user picked. The selected RowKey must win whenever the request carries one. String rather than Guid: built-in templates are stored with their filename as RowKey."
                   },
                   "TemplateType": {
                     "type": "string"
@@ -38916,6 +38926,86 @@
         "x-cipp-role": "CIPP.Core.Read"
       }
     },
+    "/api/ListCippDocs": {
+      "get": {
+        "summary": "Search the CIPP documentation, or fetch one documentation page in full.",
+        "operationId": "ListCippDocs",
+        "tags": [
+          "CIPP > Core"
+        ],
+        "description": "Searches the GitBook documentation shipped with this build and returns matching sections,\neach with an excerpt and links back to docs.cipp.app and to the file on GitHub. Pages under\nuser-documentation also report the CIPP route they document, so a screen can be traced to\nits docs and back.\n\nPass path on its own to list the pages under a documentation subtree or a CIPP route, or\nwith full=true to return one page's entire text. This backs the SearchDocs and GetDoc MCP\ntools and is available to the UI and API clients on the same terms.",
+        "parameters": [
+          {
+            "name": "full",
+            "in": "query",
+            "description": "Return the whole page rather than matching sections. Requires path.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "description": "Maximum results to return (default 8, max 25).",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "path",
+            "in": "query",
+            "description": "A documentation subtree ('user-documentation/identity') or a CIPP route ('/identity/administration/users').",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "query",
+            "in": "query",
+            "description": "Keywords or a plain-language question, e.g. 'how do I set up GDAP'.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "CIPP.Core.Read",
+        "x-cipp-any-tenant": true
+      }
+    },
     "/api/ListCippQueue": {
       "get": {
         "summary": "ListCippQueue",
@@ -46309,21 +46399,24 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "corrupt": {
+                        "x-cipp-field-source": "backend"
+                      },
                       "description": {
-                        "x-cipp-field-source": "frontend"
+                        "x-cipp-field-source": "backend,frontend"
                       },
                       "displayName": {
-                        "x-cipp-field-source": "frontend"
+                        "x-cipp-field-source": "backend,frontend"
                       },
                       "ETag": {
                         "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "guid": {
-                        "x-cipp-field-source": "storage"
+                        "x-cipp-field-source": "storage,backend"
                       },
                       "isSynced": {
-                        "x-cipp-field-source": "frontend"
+                        "x-cipp-field-source": "backend,frontend"
                       },
                       "JSON": {
                         "x-cipp-field-source": "storage"
@@ -46332,7 +46425,7 @@
                         "x-cipp-field-source": "backend"
                       },
                       "package": {
-                        "x-cipp-field-source": "storage,frontend"
+                        "x-cipp-field-source": "storage,backend,frontend"
                       },
                       "PartitionKey": {
                         "x-cipp-field-source": "storage"
@@ -46348,7 +46441,7 @@
                         "x-cipp-field-source": "storage"
                       },
                       "source": {
-                        "x-cipp-field-source": "storage"
+                        "x-cipp-field-source": "storage,backend"
                       },
                       "templateCount": {
                         "x-cipp-field-source": "backend"
@@ -49144,6 +49237,48 @@
         "x-cipp-role": "Tenant.Relationship.Read"
       }
     },
+    "/api/ListPartnerTenantInfo": {
+      "get": {
+        "summary": "ListPartnerTenantInfo",
+        "operationId": "ListPartnerTenantInfo",
+        "tags": [
+          "CIPP > Core"
+        ],
+        "description": "Reports whether the CIPP host tenant is a Microsoft Partner tenant, so the frontend can\ndecide whether partner-only flows (GDAP onboarding, reseller invites, GDAP permission\nchecks) apply to this instance.\n\nMarked AnyTenant deliberately. This answers a question about the CIPP instance, not\nabout a tenant the caller wants to act on, and Get-CippPartnerTenantInfo pins the lookup\nto $env:TenantID. Without the flag, Test-CIPPAccess falls back to $env:TenantID as the\ntenant filter and denies any custom role that blocks the partner tenant, which silently\ngreys out partner-only UI for roles that are otherwise fully permitted.",
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "CIPP.Core.Read",
+        "x-cipp-any-tenant": true
+      }
+    },
     "/api/ListPendingWebhooks": {
       "get": {
         "summary": "ListPendingWebhooks",

Modules/AzBobbyTables/3.6.2/AzBobbyTables.psd1

@@ -75,6 +75,7 @@ CmdletsToExport = @(
     'Remove-AzDataTableEntity'
     'Remove-AzDataTableLargeEntity'
     'Update-AzDataTableEntity'
+    'Update-AzDataTableLargeEntity'
     'New-AzDataTableContext'
     'Remove-AzDataTable'
     'New-AzDataTable'

Modules/AzBobbyTables/3.6.2/CHANGELOG.md

@@ -7,10 +7,12 @@ The format is based on and uses the types of changes according to [Keep a Change
 ### Added
 
 - Added `Add-AzDataTableLargeEntity`, `Get-AzDataTableLargeEntity` and `Remove-AzDataTableLargeEntity` for working with entities that exceed the Azure Table Storage size limits (64 KiB per string property, 1 MiB per entity). Oversized string properties are split into chunk properties recorded in a `SplitOverProps` JSON manifest, and entities that are still too large are distributed over multiple rows marked with `OriginalEntityId` and `PartIndex`; reads reassemble the original entity transparently and removes delete all part rows. The existing entity cmdlets are unaffected.
+- Added `Update-AzDataTableLargeEntity` for updating entities that exceed the Azure Table Storage size limits. Unlike the upsert operation types of `Add-AzDataTableLargeEntity`, entities that do not exist cause an error instead of being created. `UpdateReplace` rewrites the logical entity and removes part rows the new version no longer uses; `UpdateMerge` merges a plain single-row entity in place, and reads, merges and rewrites entities that were split for size, since merging onto physical rows directly would corrupt reassembly.
 
 ### Fixed
 
 - `Get-AzDataTableEntity` no longer fails with `400 InvalidInput` when `-First` is given a value above 1000. The page-size hint introduced in 3.6.1 was passed to the service unclamped, and Azure Table Storage rejects a page size over its limit of 1000 rather than capping it. The hint is now clamped to that limit. Results are unchanged: the hint only sizes each page, so requests for more than 1000 entities are served by paging, as they were before 3.6.1.
+- `Update-AzDataTableEntity` no longer creates entities that do not exist when called with `-Force` or with entities that carry no ETag. Batched update actions were submitted without an `If-Match` header in those cases, which the table service treats as an insert-or-merge. Update actions now always carry `If-Match` (`*` when no ETag applies), matching the non-batched path and the documented behavior.
 
 ## [3.6.1] - 2026-07-29