[pull] master from KelvinTegelaar:master

Config/ConversionTable.csv

@@ -1864,6 +1864,7 @@ Microsoft 365 E3,SPE_E3,05e9a617-0261-4cee-bb44-138d3ef5d965,KAIZALA_O365_P3,aeb
 Microsoft 365 E3,SPE_E3,05e9a617-0261-4cee-bb44-138d3ef5d965,FORMS_PLAN_E3,2789c901-c14e-48ab-a76a-be334d9d793a,Microsoft Forms (Plan E3)
 Microsoft 365 E3,SPE_E3,05e9a617-0261-4cee-bb44-138d3ef5d965,MDE_LITE,292cc034-7b7c-4950-aaf5-943befd3f1d4,Microsoft Defender for Endpoint Plan 1
 Microsoft 365 E3,SPE_E3,05e9a617-0261-4cee-bb44-138d3ef5d965,MICROSOFT_SEARCH,94065c59-bc8e-4e8b-89e5-5138d471eaff,Microsoft Search
+Microsoft 365 E3,SPE_E3,05e9a617-0261-4cee-bb44-138d3ef5d965,ATP_ENTERPRISE,f20fedf3-f3c3-43c3-8267-2bfdd51c0939,Microsoft Defender for Office 365 (Plan 1)
 Microsoft 365 E3 - Unattended License,SPE_E3_RPA1,c2ac2ee4-9bb1-47e4-8541-d689c7e83371,SHAREPOINTENTERPRISE,5dbe027f-2339-4123-9542-606e4d348a72,SharePoint (Plan 2)
 Microsoft 365 E3 - Unattended License,SPE_E3_RPA1,c2ac2ee4-9bb1-47e4-8541-d689c7e83371,PROJECT_O365_P2,31b4e2fc-4cd6-4e7d-9c1b-41407303bd66,Project for Office (Plan E3)
 Microsoft 365 E3 - Unattended License,SPE_E3_RPA1,c2ac2ee4-9bb1-47e4-8541-d689c7e83371,MCOSTANDARD,0feaeb32-d00e-4d66-bd5a-43b5b83db82c,Skype for Business Online (Plan 2)
@@ -2147,6 +2148,7 @@ Microsoft 365 E3_USGOV_DOD,SPE_E3_USGOV_DOD,d61d61cc-f992-433f-a577-5bd016037eeb
 Microsoft 365 E3_USGOV_DOD,SPE_E3_USGOV_DOD,d61d61cc-f992-433f-a577-5bd016037eeb,AAD_PREMIUM,41781fb2-bc02-4b7c-bd55-b576c07bb09d,Microsoft Entra ID P1
 Microsoft 365 E3_USGOV_DOD,SPE_E3_USGOV_DOD,d61d61cc-f992-433f-a577-5bd016037eeb,SHAREPOINTENTERPRISE,5dbe027f-2339-4123-9542-606e4d348a72,SharePoint Online (Plan 2)
 Microsoft 365 E3_USGOV_DOD,SPE_E3_USGOV_DOD,d61d61cc-f992-433f-a577-5bd016037eeb,RMS_S_ENTERPRISE,bea4c11e-220a-4e6d-8eb8-8ea15d019f90,Microsoft Microsoft Entra Rights
+Microsoft 365 E3_USGOV_DOD,SPE_E3_USGOV_DOD,d61d61cc-f992-433f-a577-5bd016037eeb,ATP_ENTERPRISE,f20fedf3-f3c3-43c3-8267-2bfdd51c0939,Microsoft Defender for Office 365 (Plan 1)
 Microsoft 365 E3_USGOV_GCCHIGH,SPE_E3_USGOV_GCCHIGH,ca9d1dd9-dfe9-4fef-b97c-9bc1ea3c3658,OFFICESUBSCRIPTION,43de0ff5-c92c-492b-9116-175376d08c38,Office 365 ProPlus
 Microsoft 365 E3_USGOV_GCCHIGH,SPE_E3_USGOV_GCCHIGH,ca9d1dd9-dfe9-4fef-b97c-9bc1ea3c3658,STREAM_O365_E3,9e700747-8b1d-45e5-ab8d-ef187ceec156,Microsoft Stream for O365 E3 SKU
 Microsoft 365 E3_USGOV_GCCHIGH,SPE_E3_USGOV_GCCHIGH,ca9d1dd9-dfe9-4fef-b97c-9bc1ea3c3658,TEAMS_AR_GCCHIGH,9953b155-8aef-4c56-92f3-72b0487fce41,Microsoft Teams for GCCHigh (AR)
@@ -2161,6 +2163,7 @@ Microsoft 365 E3_USGOV_GCCHIGH,SPE_E3_USGOV_GCCHIGH,ca9d1dd9-dfe9-4fef-b97c-9bc1
 Microsoft 365 E3_USGOV_GCCHIGH,SPE_E3_USGOV_GCCHIGH,ca9d1dd9-dfe9-4fef-b97c-9bc1ea3c3658,RMS_S_PREMIUM,6c57d4b6-3b23-47a5-9bc9-69f17b4947b3,Azure Information Protection Premium P
 Microsoft 365 E3_USGOV_GCCHIGH,SPE_E3_USGOV_GCCHIGH,ca9d1dd9-dfe9-4fef-b97c-9bc1ea3c3658,RMS_S_ENTERPRISE,bea4c11e-220a-4e6d-8eb8-8ea15d019f90,Microsoft Microsoft Entra Rights
 Microsoft 365 E3_USGOV_GCCHIGH,SPE_E3_USGOV_GCCHIGH,ca9d1dd9-dfe9-4fef-b97c-9bc1ea3c3658,ADALLOM_S_DISCOVERY,932ad362-64a8-4783-9106-97849a1a30b9,Cloud App Security Discovery
+Microsoft 365 E3_USGOV_GCCHIGH,SPE_E3_USGOV_GCCHIGH,ca9d1dd9-dfe9-4fef-b97c-9bc1ea3c3658,ATP_ENTERPRISE,f20fedf3-f3c3-43c3-8267-2bfdd51c0939,Microsoft Defender for Office 365 (Plan 1)
 Microsoft 365 E5,SPE_E5,06ebc4ee-1bb5-47dd-8120-11324bc54e06,Deskless,8c7d2df8-86f0-4902-b2ed-a0458298f3b3,Microsoft StaffHub
 Microsoft 365 E5,SPE_E5,06ebc4ee-1bb5-47dd-8120-11324bc54e06,MCOSTANDARD,0feaeb32-d00e-4d66-bd5a-43b5b83db82c,Skype for Business Online (Plan 2)
 Microsoft 365 E5,SPE_E5,06ebc4ee-1bb5-47dd-8120-11324bc54e06,SHAREPOINTENTERPRISE,5dbe027f-2339-4123-9542-606e4d348a72,SharePoint (Plan 2)
@@ -2925,6 +2928,8 @@ Microsoft 365 E5 Suite features,M365_E5_SUITE_COMPONENTS,99cc8282-2f74-4954-83b7
 Microsoft 365 E5 Suite features,M365_E5_SUITE_COMPONENTS,99cc8282-2f74-4954-83b7-c6a9a1999067,WINDOWSUPDATEFORBUSINESS_DEPLOYMENTSERVICE,7bf960f6-2cd9-443a-8046-5dbff9558365,Windows Update for Business Deployment Service
 Microsoft 365 E5 Suite features,M365_E5_SUITE_COMPONENTS,99cc8282-2f74-4954-83b7-c6a9a1999067,Defender_for_Iot_Enterprise,99cd49a9-0e54-4e07-aea1-d8d9f5f704f5,Defender for IoT - Enterprise IoT Security
 Microsoft 365 E5 Suite features,M365_E5_SUITE_COMPONENTS,99cc8282-2f74-4954-83b7-c6a9a1999067,MESH_AVATARS_ADDITIONAL_FOR_TEAMS,3efbd4ed-8958-4824-8389-1321f8730af8,Avatars for Teams (additional)
+Microsoft 365 E5 Suite features,M365_E5_SUITE_COMPONENTS,99cc8282-2f74-4954-83b7-c6a9a1999067,CLOUD_PKI,795aec3a-93a2-45be-92c4-47b9a76340ca,Microsoft Cloud PKI
+Microsoft 365 E5 Suite features,M365_E5_SUITE_COMPONENTS,99cc8282-2f74-4954-83b7-c6a9a1999067,3_PARTY_APP_PATCH,3afa0b92-83ef-41c1-8d64-586ab882a951,Intune Enterprise Application Management
 Microsoft 365 E5 with Calling Minutes,SPE_E5_CALLINGMINUTES,a91fc4e0-65e5-4266-aa76-4037509c1626,PREMIUM_ENCRYPTION,617b097b-4b93-4ede-83de-5f075bb5fb2f,Premium Encryption in Office 365
 Microsoft 365 E5 with Calling Minutes,SPE_E5_CALLINGMINUTES,a91fc4e0-65e5-4266-aa76-4037509c1626,BI_AZURE_P2,70d33638-9c74-4d01-bfd3-562de28bd4ba,Power BI Pro
 Microsoft 365 E5 with Calling Minutes,SPE_E5_CALLINGMINUTES,a91fc4e0-65e5-4266-aa76-4037509c1626,POWERAPPS_O365_P3,9c0dab89-a30c-4117-86e7-97bda240acd2,Power Apps for Office 365 (Plan 3)
@@ -3535,6 +3540,7 @@ Microsoft 365 G3 GCC,M365_G3_GOV,e823ca47-49c4-46b3-b38d-ca11d5abe3d2,POWERAPPS_
 Microsoft 365 G3 GCC,M365_G3_GOV,e823ca47-49c4-46b3-b38d-ca11d5abe3d2,INTUNE_A,c1ec4a95-1f05-45b3-a911-aa3fa01094f5,Microsoft Intune Plan 1
 Microsoft 365 G3 GCC,M365_G3_GOV,e823ca47-49c4-46b3-b38d-ca11d5abe3d2,CDS_O365_P2_GCC,a70bbf38-cdda-470d-adb8-5804b8770f41,Common Data Service for Teams
 Microsoft 365 G3 GCC,M365_G3_GOV,e823ca47-49c4-46b3-b38d-ca11d5abe3d2,FLOW_O365_P2_GOV,c537f360-6a00-4ace-a7f5-9128d0ac1e4b,Power Automate for Office 365 for Government
+Microsoft 365 G3 GCC,M365_G3_GOV,e823ca47-49c4-46b3-b38d-ca11d5abe3d2,ATP_ENTERPRISE,f20fedf3-f3c3-43c3-8267-2bfdd51c0939,Microsoft Defender for Office 365 (Plan 1)
 Microsoft 365 GCC G5,M365_G5_GCC,e2be619b-b125-455f-8660-fb503e431a5d,FORMS_GOV_E5,843da3a8-d2cc-4e7a-9e90-dc46019f964c,Microsoft Forms for Government (Plan E5)
 Microsoft 365 GCC G5,M365_G5_GCC,e2be619b-b125-455f-8660-fb503e431a5d,CDS_O365_P3_GCC,bce5e5ca-c2fd-4d53-8ee2-58dfffed4c10,Common Data Service for Teams
 Microsoft 365 GCC G5,M365_G5_GCC,e2be619b-b125-455f-8660-fb503e431a5d,LOCKBOX_ENTERPRISE_GOV,89b5d3b1-3855-49fe-b46c-87c66dbc1526,Customer Lockbox for Government
@@ -4507,6 +4513,7 @@ Office 365 E1 (no Teams),Office_365_E1_(no_Teams),f8ced641-8e17-4dc5-b014-f5a2d5
 Office 365 E1 (no Teams),Office_365_E1_(no_Teams),f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,DYN365_CDS_O365_P1,40b010bb-0b69-4654-ac5e-ba161433f4b4,Common Data Service
 Office 365 E1 (no Teams),Office_365_E1_(no_Teams),f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,MICROSOFTBOOKINGS,199a5c09-e0ca-4e37-8f7c-b05d533e1ea2,Microsoft Bookings
 Office 365 E1 (no Teams),Office_365_E1_(no_Teams),f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,SHAREPOINTWAC,e95bec33-7c88-4a70-8e19-b10bd9d0c014,Office for the Web
+Office 365 E1 (no Teams),Office_365_E1_(no_Teams),f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,MDOLITE_ENTERPRISE,c6675fa4-68fe-415f-aec1-a44520f0c3a3,Microsoft 365 built-in email and collaboration security
 Office 365 E1 EEA (no Teams),Office_365_w/o_Teams_Bundle_E1,b57282e3-65bd-4252-9502-c0eae1e5ab7f,SHAREPOINTWAC,e95bec33-7c88-4a70-8e19-b10bd9d0c014,Office for the Web
 Office 365 E1 EEA (no Teams),Office_365_w/o_Teams_Bundle_E1,b57282e3-65bd-4252-9502-c0eae1e5ab7f,YAMMER_ENTERPRISE,7547a3fe-08ee-4ccb-b430-5077c5041653,Yammer Enterprise
 Office 365 E1 EEA (no Teams),Office_365_w/o_Teams_Bundle_E1,b57282e3-65bd-4252-9502-c0eae1e5ab7f,VIVAENGAGE_CORE,a82fbf69-b4d7-49f4-83a6-915b2cf354f4,Viva Engage Core
@@ -4603,6 +4610,7 @@ Office 365 E3,ENTERPRISEPACK,6fd2c87f-b296-42f0-b197-1e91e994b900,FLOW_O365_P2,7
 Office 365 E3,ENTERPRISEPACK,6fd2c87f-b296-42f0-b197-1e91e994b900,POWERAPPS_O365_P2,c68f8d98-5534-41c8-bf36-22fa496fa792,Power Apps for Office 365
 Office 365 E3,ENTERPRISEPACK,6fd2c87f-b296-42f0-b197-1e91e994b900,YAMMER_ENTERPRISE,7547a3fe-08ee-4ccb-b430-5077c5041653,Yammer Enterprise
 Office 365 E3,ENTERPRISEPACK,6fd2c87f-b296-42f0-b197-1e91e994b900,POWER_VIRTUAL_AGENTS_O365_P2,041fe683-03e4-45b6-b1af-c0cdc516daee,Power Virtual Agents for Office 365
+Office 365 E3,ENTERPRISEPACK,6fd2c87f-b296-42f0-b197-1e91e994b900,ATP_ENTERPRISE,f20fedf3-f3c3-43c3-8267-2bfdd51c0939,Microsoft Defender for Office 365 (Plan 1)
 Office 365 E3 (no Teams),Office_365_E3_(no_Teams),46c3a859-c90d-40b3-9551-6178a48d5c18,MESH_AVATARS_FOR_TEAMS,dcf9d2f4-772e-4434-b757-77a453cfbc02,Avatars for Teams
 Office 365 E3 (no Teams),Office_365_E3_(no_Teams),46c3a859-c90d-40b3-9551-6178a48d5c18,KAIZALA_O365_P3,aebd3021-9f8f-4bf8-bbe3-0ed2f4f047a1,Microsoft Kaizala Pro
 Office 365 E3 (no Teams),Office_365_E3_(no_Teams),46c3a859-c90d-40b3-9551-6178a48d5c18,FORMS_PLAN_E3,2789c901-c14e-48ab-a76a-be334d9d793a,Microsoft Forms (Plan E3)
@@ -4693,6 +4701,7 @@ Office 365 E3_USGOV_DOD,ENTERPRISEPACK_USGOV_DOD,b107e5a3-3e60-4c0d-a184-a7e4395
 Office 365 E3_USGOV_DOD,ENTERPRISEPACK_USGOV_DOD,b107e5a3-3e60-4c0d-a184-a7e4395eb44c,SHAREPOINTENTERPRISE,5dbe027f-2339-4123-9542-606e4d348a72,SharePoint Online (Plan 2)
 Office 365 E3_USGOV_DOD,ENTERPRISEPACK_USGOV_DOD,b107e5a3-3e60-4c0d-a184-a7e4395eb44c,MCOSTANDARD,0feaeb32-d00e-4d66-bd5a-43b5b83db82c,Skype for Business Online (Plan 2)
 Office 365 E3_USGOV_DOD,ENTERPRISEPACK_USGOV_DOD,b107e5a3-3e60-4c0d-a184-a7e4395eb44c,OFFICESUBSCRIPTION,43de0ff5-c92c-492b-9116-175376d08c38,Office 365 ProPlus
+Office 365 E3_USGOV_DOD,ENTERPRISEPACK_USGOV_DOD,b107e5a3-3e60-4c0d-a184-a7e4395eb44c,ATP_ENTERPRISE,f20fedf3-f3c3-43c3-8267-2bfdd51c0939,Microsoft Defender for Office 365 (Plan 1)
 Office 365 E3_USGOV_GCCHIGH,ENTERPRISEPACK_USGOV_GCCHIGH,aea38a85-9bd5-4981-aa00-616b411205bf,MCOSTANDARD,0feaeb32-d00e-4d66-bd5a-43b5b83db82c,Skype for Business Online (Plan 2)
 Office 365 E3_USGOV_GCCHIGH,ENTERPRISEPACK_USGOV_GCCHIGH,aea38a85-9bd5-4981-aa00-616b411205bf,SHAREPOINTENTERPRISE,5dbe027f-2339-4123-9542-606e4d348a72,SharePoint Online (Plan 2)
 Office 365 E3_USGOV_GCCHIGH,ENTERPRISEPACK_USGOV_GCCHIGH,aea38a85-9bd5-4981-aa00-616b411205bf,SHAREPOINTWAC,e95bec33-7c88-4a70-8e19-b10bd9d0c014,Office Online
@@ -4702,6 +4711,7 @@ Office 365 E3_USGOV_GCCHIGH,ENTERPRISEPACK_USGOV_GCCHIGH,aea38a85-9bd5-4981-aa00
 Office 365 E3_USGOV_GCCHIGH,ENTERPRISEPACK_USGOV_GCCHIGH,aea38a85-9bd5-4981-aa00-616b411205bf,RMS_S_ENTERPRISE,bea4c11e-220a-4e6d-8eb8-8ea15d019f90,Microsoft Microsoft Entra Rights
 Office 365 E3_USGOV_GCCHIGH,ENTERPRISEPACK_USGOV_GCCHIGH,aea38a85-9bd5-4981-aa00-616b411205bf,EXCHANGE_S_ENTERPRISE,efb87545-963c-4e0d-99df-69c6916d9eb0,Exchange Online (Plan 2)
 Office 365 E3_USGOV_GCCHIGH,ENTERPRISEPACK_USGOV_GCCHIGH,aea38a85-9bd5-4981-aa00-616b411205bf,TEAMS_AR_GCCHIGH,9953b155-8aef-4c56-92f3-72b0487fce41,Microsoft Teams for GCCHigh (AR)
+Office 365 E3_USGOV_GCCHIGH,ENTERPRISEPACK_USGOV_GCCHIGH,aea38a85-9bd5-4981-aa00-616b411205bf,ATP_ENTERPRISE,f20fedf3-f3c3-43c3-8267-2bfdd51c0939,Microsoft Defender for Office 365 (Plan 1)
 Office 365 E4,ENTERPRISEWITHSCAL,1392051d-0cb9-4b7a-88d5-621fee5e8711,BPOS_S_TODO_2,c87f142c-d1e9-4363-8630-aaea9c4d9ae5,BPOS_S_TODO_2
 Office 365 E4,ENTERPRISEWITHSCAL,1392051d-0cb9-4b7a-88d5-621fee5e8711,Deskless,8c7d2df8-86f0-4902-b2ed-a0458298f3b3,MICROSOFT STAFFHUB
 Office 365 E4,ENTERPRISEWITHSCAL,1392051d-0cb9-4b7a-88d5-621fee5e8711,FLOW_O365_P2,76846ad7-7776-4c40-a281-a386362dd1b9,FLOW FOR OFFICE 365
@@ -5058,6 +5068,7 @@ Office 365 G3 GCC,ENTERPRISEPACK_GOV,535a3a29-c5f0-42fe-8215-d3b9e1f38c4a,MIP_S_
 Office 365 G3 GCC,ENTERPRISEPACK_GOV,535a3a29-c5f0-42fe-8215-d3b9e1f38c4a,ContentExplorer_Standard,2b815d45-56e4-4e3a-b65c-66cb9175b560,Information Protection and Governance Analytics – Standard
 Office 365 G3 GCC,ENTERPRISEPACK_GOV,535a3a29-c5f0-42fe-8215-d3b9e1f38c4a,PROJECT_O365_P2_GOV,e7d09ae4-099a-4c34-a2a2-3e166e95c44a,Project for Government (Plan E3)
 Office 365 G3 GCC,ENTERPRISEPACK_GOV,535a3a29-c5f0-42fe-8215-d3b9e1f38c4a,MYANALYTICS_P2_GOV,6e5b7995-bd4f-4cbd-9d19-0e32010c72f0,Insights by MyAnalytics for Government
+Office 365 G3 GCC,ENTERPRISEPACK_GOV,535a3a29-c5f0-42fe-8215-d3b9e1f38c4a,ATP_ENTERPRISE,f20fedf3-f3c3-43c3-8267-2bfdd51c0939,Microsoft Defender for Office 365 (Plan 1)
 Office 365 G3 without Microsoft 365 Apps GCC,ENTERPRISEPACKWITHOUTPROPLUS_GOV,24aebea8-7fac-48d0-8750-de4ee1fde205,CDS_O365_P2_GCC,a70bbf38-cdda-470d-adb8-5804b8770f41,Common Data Service for Teams
 Office 365 G3 without Microsoft 365 Apps GCC,ENTERPRISEPACKWITHOUTPROPLUS_GOV,24aebea8-7fac-48d0-8750-de4ee1fde205,EXCHANGE_S_ENTERPRISE_GOV,8c3069c0-ccdb-44be-ab77-986203a67df2,Exchange Online (Plan 2) for Government
 Office 365 G3 without Microsoft 365 Apps GCC,ENTERPRISEPACKWITHOUTPROPLUS_GOV,24aebea8-7fac-48d0-8750-de4ee1fde205,MIP_S_CLP1,5136a095-5cf0-4aff-bec3-e84448b38ea5,Information Protection for Office 365 - Standard

Config/SAMManifest.json

@@ -626,6 +626,10 @@
         {
           "id": "e2edbde8-4448-4e49-8ebb-d53ba72df0f3",
           "type": "Scope"
+        },
+        {
+          "id": "3bc15058-7858-4141-b24f-ae43b4e80b52",
+          "type": "Scope"
         }
       ]
     },

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Webhooks/Push-AuditLogTenantDownload.ps1

@@ -26,13 +26,8 @@ function Push-AuditLogTenantDownload {
             $CIPPURL = $LegacyUrl
         } else {
             if (!$CippConfig) {
-                $CippConfig = @{
-                    PartitionKey = 'InstanceProperties'
-                    RowKey       = 'CIPPURL'
-                    Value        = [string]([System.Uri]$Request.Headers.'x-ms-original-url').Host
-                }
-                Add-AzDataTableEntity @CippConfigTable -Entity $CippConfig -Force
-                $CIPPURL = 'https://{0}' -f $CippConfig.Value
+                # No request context here, so this resolves from the platform hostname and stores it
+                $CIPPURL = 'https://{0}' -f (Get-CIPPHostname -Save)
             } else { $CIPPURL = 'https://{0}' -f $CippConfig.Value }
         }
 

Modules/CIPPCore/Public/AuditLogs/Get-CippAuditLogSearchResults.ps1

@@ -28,6 +28,8 @@ function Get-CippAuditLogSearchResults {
             $GraphRequest.CountOnly = $true
         }
 
-        New-GraphGetRequest @GraphRequest -ErrorAction Stop | Sort-Object -Property createdDateTime -Descending
+        # Deliberately unsorted: Sort-Object blocks until the entire window is in memory, and
+        # no caller depends on the order.
+        New-GraphGetRequest @GraphRequest -Stream -ErrorAction Stop
     }
 }

Modules/CIPPCore/Public/Functions/Get-CIPPHostname.ps1

@@ -0,0 +1,86 @@
+function Get-CIPPHostname {
+    <#
+    .SYNOPSIS
+        Resolves the hostname the CIPP instance is currently being served from
+    .DESCRIPTION
+        Works out the host of the running instance, preferring the inbound request so the value always
+        reflects the URL the user is on at the time of the call. Falls back to the stored instance
+        property and then the platform hostname for contexts where no request is available.
+        Returns the host only (no scheme, no port), matching the format stored in Config/InstanceProperties/CIPPURL.
+    .PARAMETER Headers
+        The request headers, usually $Request.Headers. Optional - omit for non-HTTP contexts.
+    .PARAMETER Save
+        Persist the resolved hostname to Config/InstanceProperties/CIPPURL so background jobs pick up the current URL.
+    .FUNCTIONALITY
+        Internal
+    .EXAMPLE
+        Get-CIPPHostname -Headers $Request.Headers -Save
+    #>
+    [CmdletBinding()]
+    param(
+        $Headers,
+        [switch]$Save
+    )
+
+    $Hostname = $null
+
+    if ($Headers) {
+        # x-ms-original-url carries the full URL the client requested, including any custom domain
+        $Candidates = @(
+            $Headers.'x-ms-original-url'
+            $Headers.origin
+            $Headers.referer
+        )
+        foreach ($Candidate in $Candidates) {
+            if ([string]::IsNullOrWhiteSpace($Candidate)) { continue }
+            try {
+                $Parsed = [System.Uri]$Candidate
+                if ($Parsed.Host) {
+                    $Hostname = $Parsed.Host
+                    break
+                }
+            } catch {
+                continue
+            }
+        }
+
+        # Proxied deployments may only expose the host, not a full URL
+        if (!$Hostname) {
+            $HostHeader = $Headers.'x-forwarded-host' ?? $Headers.host
+            if (![string]::IsNullOrWhiteSpace($HostHeader)) {
+                $Hostname = (($HostHeader -split ',')[0]).Trim().Split(':')[0]
+            }
+        }
+    }
+
+    # Only touch storage when we actually need it: as a fallback, or to persist the resolved value
+    $StoredConfig = $null
+    if (!$Hostname -or $Save.IsPresent) {
+        $ConfigTable = Get-CIPPTable -TableName 'Config'
+        $StoredConfig = Get-CIPPAzDataTableEntity @ConfigTable -Filter "PartitionKey eq 'InstanceProperties' and RowKey eq 'CIPPURL'"
+    }
+
+    if (!$Hostname -and ![string]::IsNullOrWhiteSpace($StoredConfig.Value)) {
+        $Hostname = $StoredConfig.Value
+    }
+
+    if (!$Hostname -and ![string]::IsNullOrWhiteSpace($env:WEBSITE_HOSTNAME)) {
+        $Hostname = $env:WEBSITE_HOSTNAME
+    }
+
+    if ($Save.IsPresent -and ![string]::IsNullOrWhiteSpace($Hostname) -and $StoredConfig.Value -ne $Hostname) {
+        try {
+            $AddObject = @{
+                PartitionKey = 'InstanceProperties'
+                RowKey       = 'CIPPURL'
+                Value        = [string]$Hostname
+            }
+            Add-CIPPAzDataTableEntity @ConfigTable -Entity $AddObject -Force
+            Write-Information "Get-CIPPHostname: updated stored CIPPURL from '$($StoredConfig.Value)' to '$Hostname'"
+        } catch {
+            Write-Information "Get-CIPPHostname: failed to store CIPPURL: $($_.Exception.Message)"
+        }
+    }
+
+    return $Hostname
+}

Modules/CIPPCore/Public/GraphHelper/New-CIPPAzRestRequest.ps1

@@ -105,6 +105,35 @@ function New-CIPPAzRestRequest {
         [int]$MaxRetries = 3
     )
 
+    # Confirm the Uri targets a known Azure service host that is consistent with the token audience (ResourceUrl).
+    # This prevents the Managed Identity bearer token from being sent to an arbitrary/attacker-controlled host.
+    # Validated before token acquisition so an invalid service never triggers a token request.
+    $AzureServiceHosts = @{
+        'https://management.azure.com' = @('management.azure.com')
+        'https://vault.azure.net'      = @('*.vault.azure.net')
+        'https://api.loganalytics.io'  = @('api.loganalytics.io')
+        'https://storage.azure.com'    = @('*.blob.core.windows.net', '*.table.core.windows.net', '*.queue.core.windows.net', '*.file.core.windows.net')
+    }
+
+    $UriHost = $Uri.Host
+    $NormalizedResource = $ResourceUrl.TrimEnd('/')
+    $AllowedHosts = $AzureServiceHosts[$NormalizedResource]
+
+    if (-not $AllowedHosts) {
+        $ValidationError = "ResourceUrl '$ResourceUrl' is not a recognized Azure service. Allowed resources: $($AzureServiceHosts.Keys -join ', ')"
+        Write-LogMessage -API 'New-CIPPAzRestRequest' -message $ValidationError -Sev 'Error' -LogData @{ Uri = $Uri.ToString(); ResourceUrl = $ResourceUrl }
+        Write-Error -Message $ValidationError -ErrorAction $ErrorActionPreference
+        return
+    }
+
+    $HostAllowed = $AllowedHosts | Where-Object { $UriHost -eq $_ -or ($_ -like '*.*' -and $UriHost -like $_) }
+    if (-not $HostAllowed) {
+        $ValidationError = "Uri host '$UriHost' is not valid for resource '$ResourceUrl'. Allowed hosts: $($AllowedHosts -join ', ')"
+        Write-LogMessage -API 'New-CIPPAzRestRequest' -message $ValidationError -Sev 'Error' -LogData @{ Uri = $Uri.ToString(); ResourceUrl = $ResourceUrl; UriHost = $UriHost }
+        Write-Error -Message $ValidationError -ErrorAction $ErrorActionPreference
+        return
+    }
+
     # Resolve bearer token: prefer manually-supplied AccessToken, otherwise fetch via Managed Identity
     $Token = $null
     if ($AccessToken) {