feat(tenant configuration view): Tenant configuration view page and template pages moved into tabbed layout - #489
Draft
Zacgoose wants to merge 2 commits into
Draft
feat(tenant configuration view): Tenant configuration view page and template pages moved into tabbed layout#489Zacgoose wants to merge 2 commits into
Zacgoose wants to merge 2 commits into
Conversation
Zacgoose
force-pushed
the
preview/tenant-configuration
branch
2 times, most recently
from
September 4, 2026 10:17
2c279d8 to
9579291
Compare
Zacgoose
changed the title
Zacgoose
force-pushed
the
preview/tenant-configuration
branch
from
September 4, 2026 14:09
9579291 to
55d26cc
Compare
Adds a Configuration tab under Manage Tenant with a master-detail layout: choose a Microsoft 365 area on the left, view and set its tenant-level settings on the right, separate from the Standards drift system. Each area loads its current values live when selected, and only that area is queried. Areas: - SharePoint & OneDrive (timezone, external sharing level, domain restriction, reshare, legacy auth, site creation, mac sync, sync excluded extensions, deleted-user OneDrive retention) - Audit Log (enable or disable the Unified Audit Log) - Usage Reports (conceal user, group, and site names) Reads are live (never cached) so settings are always current before a change. SharePoint booleans are sent to Graph as string booleans because the beta endpoint silently ignores real JSON booleans. Resolves #477. feat(tenant): category-tree nav and all-tenants fleet view for Configuration Reworks the Configuration page into a category tree (categories to leaves, one leaf per Microsoft 365 resource). Selecting a specific tenant shows the leaf's live single-tenant form; selecting All Tenants shows a cached fleet table of every tenant's current values for that leaf, served by a new ListTenantConfigFleet endpoint (one cached row per tenant for a whitelisted config cache type). Adds the SharePoint CSOM tenant read (ListSpoTenantSettings) as the basis for the upcoming Sharing and Sync leaf. feat(tenant): add Exchange Online and SharePoint Sharing config leaves Adds two Configuration leaves, each one live read + one write: - Exchange Online > Organization settings (Set-OrganizationConfig toggles; the UI shows AuditDisabled as 'Mailbox auditing enabled') - SharePoint & OneDrive > Sharing & sync (SPO admin CSOM property toggles) Write endpoints accept either a single tenantFilter or a tenants[] array so the All Tenants fleet view can bulk-set. Exchange has a cached fleet view via ExoOrganizationConfig; the CSOM leaf is single-tenant only (its values are not in the reporting cache) and needs SharePoint app-only consent. feat(tenant): add Entra authorization policy config leaf Adds an Entra (Identity) category with an Authorization policy leaf: guest invite scope, guest access level, SSPR, and the default-user-role permissions (app/group/tenant creation, BitLocker key read, directory read, block legacy MSOnline). Read flattens defaultUserRolePermissions for the UI; the write PATCH-merges (nested) and accepts a tenantFilter or tenants[] for fleet bulk-set. Security Defaults and device-join/register are intentionally left out (Conditional Access conflict / high-impact) for a later, gated pass. feat(tenant): add Teams config leaves, secured settings, search and deep-linking - Teams category with Meetings, Messaging, External access, and Client & guest access leaves (one policy type each via New-TeamsRequestV2; federation domain lists deliberately excluded). Generic ListTeamsConfig/ExecSetTeamsConfig endpoints, bulk-capable. - Secured settings: security-relevant toggles (EWS, mailbox auditing, modern auth, SharePoint legacy auth, infected-file download, block legacy MSOL, Unified Audit Log) can only be set to their secure state. Enforced in the UI (locked/one-way switch with a note pointing to the enforcing standard) and in the API (write endpoints drop insecure values for these fields). - Settings search that jumps to the matching section. - Selected leaf is kept in the URL (?section=) for deep-linking. refactor(tenant): restrict Configuration write endpoints to a single tenant These endpoints are for one-off, per-tenant changes; bulk enforcement across tenants is done via Standards. Removes the tenants[] bulk-write path from the Exchange, SharePoint CSOM, Entra and Teams config write endpoints so each only accepts a single tenantFilter. The read-only All Tenants fleet view is kept. feat(tenant): add Entra cross-tenant access config leaf Adds an Entra > Cross-tenant access leaf to set the default policy's inbound trust (trust MFA, compliant-device and hybrid-joined claims from other Entra tenants). Single-tenant live read/write with a cached All Tenants fleet view (CrossTenantAccessPolicy). feat(tenant): expand Configuration with OWA, org contacts, device registration and more Exchange toggles - Exchange Online: adds connectors, link preview, read receipts, public-computer detection, actionable messages and Microsoft Pay toggles to the org leaf. - Exchange Online > OWA mailbox policy: new leaf (third-party storage providers, direct file access on public/private computers). - Organization > Notification contacts: new leaf (technical, security/compliance and marketing notification emails on the org object). - Entra > Device registration: new leaf (Windows LAPS, per-user device quota) via the deviceRegistrationPolicy full-object PUT. All single-tenant, one-off (bulk is via Standards). feat(tenant): make the tenant Configuration page read-only The Configuration page no longer changes tenant state. Manual one-off config pushes MSPs away from Standards/Baselines and leaves changes that are never reapplied or drift-checked, so every leaf is now a live read-only view of one Microsoft 365 area. - Remove all in-page write paths (Save buttons, the one-way SecuredSwitch, the react-hook-form + ApiPostCall machinery); each setting renders as a labelled value or a neutral Enabled/Disabled chip. - Drop two settings that have no live standard behind them: modern authentication (OAuth2ClientProfileEnabled, a deprecated no-op) and block legacy MSOnline PowerShell (no governing standard). - Add a banner that points at whichever management system is live - Standards or Baselines, read from the feature flag - as the place to actually change these settings. refactor(tenant): remove the Configuration page write endpoints The Configuration page is now a read-only view, so these one-off setters have no caller. Removing them leaves no manual path to change tenant state - configuration is changed through Standards or Baselines, which reapply on schedule and detect drift. Removes the ten ExecSet* endpoints under Tenant/Administration/Configuration plus the feature-new Teams-Sharepoint ExecSetSharepointSettings. The List* readers the page still uses are kept. openapi.json is regenerated by the module watcher. feat(tenant): show whether each Configuration setting is under management Adds a management chip to settings that map to a Standard: Managed, Drift from standard, or "not enforced - add to Standards/Baselines". It reads the live management system the tenant is on (ListStandardsCompare, or ListBaselineAlignment when the Baselines feature flag is set) and links to that system's templates page. Settings with no governing standard render without a chip. The field -> standard mapping lives in the new configStandardsMap and is seeded with the confirmed secure-baseline settings (EWS, mailbox auditing, SharePoint legacy auth, infected-file download, unified audit log); expand it as more mappings are confirmed. Management state is provided via context so only mapped rows render a chip, and the join degrades gracefully - no chip until the data is in, and none for the AllTenants view. feat(tenant): expand the setting-to-standard registry Grows configStandardsMap from the 5 seed entries to ~40, covering Exchange org toggles (Bookings, message recall, focused inbox, send-from-alias, customer lockbox), OWA storage providers, SharePoint sharing (reshare, retention, add-to-OneDrive, B2B, people picker), Entra authorization policy (guest invite/role, admin SSPR, app/group/tenant creation, BitLocker key read), cross-tenant inbound trust (MFA, compliant device), the Teams meeting/messaging/external/guest policies, and the unified audit log. Each field was confirmed against the standard that reads/sets that exact property; the Teams policy standards each govern several fields. fix(tenant): render management chips on the Entra and SharePoint leaves The bespoke Authorization policy and SharePoint sections rendered their rows without a field name, so the expanded registry produced no chips there. Pass the field name on the guest-invite/guest-role rows, the Entra authorization toggles, and the SharePoint reshare/retention rows so their management state shows like the switch-list leaves already do.
Zacgoose
force-pushed
the
preview/tenant-configuration
branch
from
September 4, 2026 14:58
55d26cc to
43b1541
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several new backend HTTP function entrypoints for retrieving tenant configuration data across Exchange Online, SharePoint, Teams, Entra, and reporting settings, as well as improvements to the frontend for configuration management and navigation. The backend functions provide live, read-only access to various tenant settings, while the frontend changes enhance the Configuration page's ability to indicate which settings are governed by standards and streamline navigation.
Backend: New HTTP Function Entrypoints for Tenant Configuration
Invoke-ListAdminAuditLogConfig.ps1)Invoke-ListAdminReportSettings.ps1)Invoke-ListCrossTenantAccess.ps1)Invoke-ListDeviceRegistrationPolicy.ps1)Invoke-ListEntraAuthPolicy.ps1)Invoke-ListExchangeOrgConfig.ps1)Invoke-ListOrgContacts.ps1)Invoke-ListOwaMailboxPolicy.ps1)Invoke-ListSpoTenantSettings.ps1)Invoke-ListTeamsConfig.ps1)Invoke-ListTenantConfigFleet.ps1)Frontend: Configuration Standards Mapping and Navigation Improvements
configStandardsMapinconfigStandardsMap.jsto map configuration fields to their governing standards, allowing the Configuration page to display management status for each field and link to the appropriate standard or baseline.